SSU Counterintelligence: Vasyl Malyuk and Spy-Catching Operations

The Security Service of Ukraine (SSU — Служба безпеки України) underwent its most consequential transformation since independence during the full-scale war, shifting from an organization with a complex legacy of Soviet institutional culture toward a streamlined wartime counterintelligence and internal security service. Central to this transformation was Vasyl Malyuk, who became SSU head in September 2022 after his predecessor Ivan Bakanov was suspended — and whose tenure was defined by aggressive domestic spy-catching operations and structural purges of Russian-connected personnel.

The Bakanov Crisis and SSU Restructuring

Ivan Bakanov, a childhood friend of President Zelensky who had been appointed SSU chief in 2019, was publicly suspended on 17 July 2022 following revelations that SSU employees had collaborated with Russian forces in the occupied territories. Zelensky's announcement cited over 650 criminal proceedings against SSU officers accused of treason — a stunning figure that reflected the depth of Russian penetration of Ukraine's primary security service, likely cultivated over years if not decades through a combination of ideological sympathy, financial corruption, and blackmail.

The SSU's role in the war's early days was further complicated by pre-invasion Russian cyber operations and deception campaigns that apparently misled some SSU analytical assessments about the scale of the planned invasion. The institutional failures created a political crisis that Zelensky resolved by replacing Bakanov with Vasyl Malyuk — a career SSU counterintelligence officer who had served within the organization rather than arriving from outside, giving him the institutional knowledge to identify and remove compromised personnel.

Vasyl Malyuk: Profile and Approach

Vasyl Malyuk joined the SSU in the 1990s and built his career in counterintelligence — the division focused on identifying and neutralizing foreign spy networks operating within Ukraine. He served as First Deputy Head of the SSU before Zelensky appointed him as acting director, then confirmed him as head in September 2022. Unlike Bakanov, who was a political appointee with no security service background, Malyuk was a professional intelligence officer whose counterintelligence expertise was directly relevant to the SSU's wartime priorities.

Malyuk's approach was characterized by high operational tempo — publicly announcing major counterintelligence operations at a pace that demonstrated both genuine operational success and deliberate information operations designed to signal Ukrainian security capacity to both domestic audiences and foreign partners. His public communications were more professional and less political than Bakanov's, reflecting a service-culture orientation rather than a political one, a change that improved SSU credibility with Western partner services.

Russian Agent Network Neutralization

SSU under Malyuk claimed to have neutralized hundreds of Russian intelligence agents operating in Ukraine across multiple operational cycles from 2022 through 2024. Operations included the arrest of individuals collecting intelligence on Ukrainian air defense positions for Russian targeting purposes, recruitment networks within Ukrainian state enterprises and utilities, and individuals using commercial drone equipment to conduct reconnaissance for Russian artillery targeting.

Several publicly announced operations demonstrated the sophistication of ongoing Russian intelligence efforts against Ukraine. These included cases of Russian FSB-recruited agents within Ukrainian critical infrastructure companies providing access credentials for cyber operations, networks facilitating the transmission of military intelligence about Ukrainian troop movements, and individuals involved in assassination planning targeting Ukrainian military and government figures. The assassinations of Ukrainian civil and military figures that did occur during the war — several documented — demonstrated that Russian networks retained some operational capability despite SSU operations against them.

SSU Operations Summary

The 2022 Collaborator Purge

Beyond spy-catching, the SSU conducted a systematic process of investigating and prosecuting Ukrainian citizens who had collaborated with Russian occupation authorities — particularly in territories liberated in autumn 2022 (Kharkiv Oblast) and winter 2022–2023 (Kherson). Collaborators ranged from individuals who had taken administrative positions under Russian occupation to those who had provided intelligence to Russian forces resulting in civilian deaths, to individuals who had denounced resistance networks to occupying authorities.

The legal framework for collaboration prosecution was established through amendments to the Criminal Code that created new offenses covering collaboration with an occupying power. Prosecutorial approaches attempted to distinguish between those who collaborated under coercion or necessity (less culpable) and those who actively aided military operations or created informational conditions for atrocities (most culpable). The process was complicated by the challenge of investigating events in areas where both evidence and witnesses had been subject to Russian intimidation during occupation.

Frequently Asked Questions

Why did so many SSU officers betray Ukraine?

Multiple factors: Russian intelligence services had decades to cultivate contacts within Ukrainian security structures; SSU culture in some regions reflected Soviet-era ideological ambiguity about Russia-Ukraine relations; financial corruption made some officers vulnerable to material inducements; and some officers in eastern and southern Ukrainian SSU branches had personal and family connections in Russia or Russian-occupied territories that created conflicting loyalties.

How does the SSU differ from the HUR?

SSU is the internal security service handling domestic counterintelligence, counterterrorism, and some foreign intelligence. HUR is military intelligence under the Defence Ministry. They are separate institutions with different chains of command, different mandates, and occasionally overlapping but distinct operational domains.

Has SSU been reformed sufficiently for Western partnership?

Western intelligence services significantly deepened cooperation with SSU under Malyuk compared to the Bakanov period, reflecting improved confidence in operational security. Ukraine's reforms included vetting processes, compartmentalization of sensitive information, and changed personnel management practices designed to reduce vulnerability to Russian penetration.

What surveillance tools does SSU use?

SSU employs technical collection capabilities including telephone and internet monitoring under legal frameworks, physical surveillance, informant networks, border monitoring, and digital forensics. The scale of wartime counterintelligence operations expanded its technical collection significantly from pre-war levels.

Have any prominent Ukrainians been charged with treason by SSU?

Yes. Several former high-ranking officials, ex-politicians, and public figures were investigated or charged with treason-related offenses during the war, involving allegations ranging from providing intelligence to Russia to facilitating propaganda operations. Some cases involved individuals previously associated with pro-Russian political parties.

Sources

1. Security Service of Ukraine. Official Press Releases. sbu.gov.ua, 2022–2024.
2. Ukrainska Pravda. "SSU: How Ukraine's Security Service Was Rebuilt During War." 2023.
3. BBC Ukraine. "Ivan Bakanov suspended: What happened to Ukraine's spy chief?" July 2022.
4. CEPA. "Reforming Ukraine's Security Services." Center for European Policy Analysis, 2023.
5. Reuters. "Ukraine says it exposed hundreds of Russian spies working in its security forces." July 2022.