2025: Ukrainian Intelligence and Its Emerging Role in the National Security Architecture

HUR Is Systematically Reshaping the Rules of War — for the Adversary, for Partners, and for Ukraine Itself

The year 2025 demonstrated that, under wartime conditions, Main Directorate of Intelligence at Ukraine’s Ministry of Defense (HUR MoD) has moved beyond the role of a purely defensive instrument. HUR has increasingly acted as an architect of a new model of warfare — one that integrates global intelligence, precision strikes, technological innovation, information and sanctions pressure, and a humanitarian dimension.

For the adversary, this translates into persistent uncertainty, loss of balance, and erosion of initiative. For international partners, it serves as evidence of Ukraine’s capacity to act as a contributor to global security rather than merely a recipient of assistance. For Ukrainian society, it reinforces confidence that the State is capable not only of defending itself, but of achieving strategic advantage and long-term success.

Today, Ukrainian intelligence operates proactively — both temporally and geographically.

GLOBAL INTELLIGENCE: INFORMATION AS A FRONT-LINE WEAPON

In 2025, HUR’s intelligence operations have finally expanded beyond the immediate battlefield and Ukraine’s territories currently occupied by Russia. The collection of intelligence on the intentions, capabilities, and vulnerabilities of Russia and its allies was conducted on a global scale, stretching from the Caucasus through Africa to the Middle East, as well as across the Black Sea and the Sea of Azov.

Crucially, this effort is not limited to traditional human intelligence or precision strike operations. HUR’s operational practice has increasingly combined cyber intelligence, space-based capabilities, open-source intelligence, comprehensive analysis of classified data sets, and undercover intelligence operations. Taken together, these elements enabled the production of high-value analytical assessments and early warnings — not only for Ukraine’s Armed Forces and military leadership, but also for senior government decision-makers and international partners.

A particularly illustrative episode of Ukrainian intelligence operations occurred in August, when HUR publicly released classified technical documentation related to Russia’s latest Borei-A class nuclear-powered submarine, the K-555 Knyaz Pozharsky.

This disclosure sent a clear signal: even the most heavily protected segments of Russia’s war machine are no longer beyond the reach of the Ukrainian intelligence. It demonstrated both the depth of access achieved by Ukrainian specialists and the erosion of Russia’s presumed technological and informational invulnerability.

That episode, however, should be viewed not in isolation, but as part of a broader and systematic pattern.

PROTECTING CITIZENS: INTELLIGENCE AS AN INSTRUMENT OF HUMANITARIAN SECURITY

A distinct dimension of the HUR’s activities over the past year has consisted in its role in evacuation and rescue operations outside Ukraine, carried out on the instruction from the Supreme Commander-in-Chief and in close coordination with the Ministry of Foreign Affairs.

The evacuation of Ukrainian nationals from Syria, Israel, Iran, and the Gaza Strip, as well as the release of Ukrainian seafarers held captive by Yemen’s Houthi movement, illustrate cases in which intelligence services operated not from the shadows, but in highly visible, complex international environments marked by elevated risk and severe time constraints.

In effect, HUR has operated as government’s rapid-response mechanism in the face of global crises, reinforcing the principle that the protection of citizens is an integral component to national defense rather than a secondary, purely “humanitarian” task.

From HUR MoD’s official sources:

January 22: HUR MoD, acting in coordination with the Ministry of Foreign Affairs, successfully evacuated Ukrainian sailors—crew members of the cargo vessel Galaxy Leader—who had been held in captivity by Yemen’s Houthi forces.

April 29: As a result of a complex evacuation mission, a Ukrainian woman and her two children were released from the detention camp al-Roj in northeast Syria. In total, 89 Ukrainian citizens were held in al-Roj, the majority of them women, including individuals originating from Crimea.

June 22: A total of 176 individuals were evacuated from the territory of the State of Israel amid a deteriorating security situation. Among them were 133 Ukrainian nationals, in addition to citizens of Moldova, Latvia, Azerbaijan, Estonia, and the United States.

June 24: 31 Ukrainian citizens, among them 5 men, 12 women, and 14 minors, were successfully evacuated from the territory of the Islamic Republic of Iran.

September 30: A mixed team of the Main Directorate of Intelligence (HUR) and the Ministry of Foreign Affairs of Ukraine conducted an extremely risky operation to evacuate 57 individuals, among them 48 Ukrainian citizens, including 16 minors, from the Gaza Strip.

OPERATIONS AGAINST THE ENEMY BEYOND UKRAINE: DISMANTLING RUSSIAN INFLUENCE

The year 2025 showcased that HUR operates in a systematic manner not only against Russian military forces, but also against Russia’s strategic influence operations. Ukrainian intelligence had exposed Kremlin plans aimed at:

the militarization of the South Caucasus (notably the military base in Gyumri, Armenia),

hybrid expansion into Africa through the construction of civilian infrastructure,

influence via sports events, education, and religious institutions,

global recruitment of mercenaries to fight against Ukraine.

This activity had a clearly preventive character: disrupting Russian scenarios at the planning stage rather than reacting after the fact.

From HUR’s official sources:

July 5: HUR disclosed intelligence indicating that the Kremlin had accelerated efforts to reinforce its military base in Gyumri, Armenia, as part of a broader campaign aimed to increase its military and political pressure on the South Caucasus countries.

HUR found out that the Kremlin is expanding its influence in Africa through infrastructure projects. The aggressor state uses educational programs, sports events, and the Orthodox Church as an instrument for exerting long-term hybrid leverage and influence on the African continent. Russian state-controlled media organizations—most particularly TASS and RT—are actively involved. Russian propaganda outlets broadcast in more than 40 African countries in six languages.

HUR warned the international community that Russia is recruiting mercenaries worldwide. Fighters from Cuba, several African states, Asia, and other pro-Russian countries undergo military training in occupied Crimea before being deployed to fight against Ukraine.

COMBAT OPERATIONS: TACTICS THAT SHAPE THE FUTURE OF WAR

In 2025, HUR’s active operations forces have developed into one of the most flexible and technologically advanced components of Ukraine’s Defense Forces. Operations in the Black and Azov Seas, raids in Crimea, operations in the Donetsk, Zaporizhzhia, and Lyman sectors of the front, as well as the defense of Pokrovsk were all united by one defining feature: asymmetry, mobility, agility, and technological superiority.

The year was climaxed by Ukraine’s Magura maritime drones destructing hostile combat helicopters and fixed-wing aircraft for the first time ever, as well as by successful strikes against Kalibr missile–carrying ships in the Black Sea. In effect, HUR demonstrated that the enemy’s sea, air, and rear areas are no longer “safe” domains. The very concept of a “safe hinterland” has ceased to exist.

From HUR MoD’s official sources:

July 28: HUR special forces landed on the Tendra Spit and eliminated an occupying forces’ position and personnel, along with the electronic warfare system Zont, and the radar station Rosa.

August: The HUR unit “Artan”, acting in concert with the 2nd Assault Battalion of the 3rd Assault Brigade conducted a successful offensive operation aimed to reclaim control over the settlement of Novomykhailivka, the Donetsk Oblast.

September: As part of a raid on the Crimean Peninsula, special forces of the “Prymary” (Ghosts) unit attacked and burned down two Russian An-26 transport aircraft and delivered successful strikes against Russian surface-surveillance radar and an MR-10M1 “Mis M1” coastal radar station.

Large-scale joint operation to defend Pokrovsk: HUR special forces carried out a series of special operations targeting inner Russia, setting up defensive bridgeheads for Ukraine’s Defense and Security Forces.

November 4 saw a successful airborne landing by the 6th Special Operations Detachment from the Tymur Special Force. After the forward group was inserted by helicopters and secured designated positions, a ground corridor was breached, allowing additional special forces to link up. Other HUR special forces continue to carry out combat missions in the defense of Pokrovsk.

November Operations and Technological Breakthroughs

In November, special forces of the HUR’s Department of Active Operations conducted a series of successful combat missions in the Zaporizhzhia and Lyman sectors of the front. In particular, HUR forces located and destroyed the headquarters of Russian occupying forces, including elements of Rubikon command-and-control center.

On November 21, drones operated by the Ghosts special unit of Ukraine's defense intelligence struck a Russian Ka-27 naval helicopter along with four high-value radar stations in occupied Crimea.

Overnight on December 4, Ukraine's defense intelligence agency HUR struck a Russian MiG-29 fighter jet and an Irtysh radar system in currently Russian-occupied Crimea. Both attacks were carried out with long-range drones operated  by the Prymary ("Ghosts") unit. The MiG-29 fighter was destroyed at the Kacha air base, just outside the occupied port city of Sevastopol, while the radar was struck near the Crimean capital of Simferopol.

MAGURA AND INDIGENOUS TECHNOLOGIES: INTELLIGENCE AS THE R&D ELEMENT TO THE WAR

In 2025, the HUR has firmly established itself as one of the key technological drivers of the war. Magura-series maritime drones evolved from purely strike platforms into multifunctional combat systems capable of operating in swarms, destroying ships, downing enemy aircraft and helicopters, and engaging enemy personnel.

On a parallel track, ground-based robotic systems, mobile air defense systems armed with R-73 missiles, as well as new command, control, and target acquisition systems were developed, manufactured, and fielded.

This marked a fundamental shift: HUR is no longer merely a consumer of technology, but it has evolved into a developer, generator, and live testing ground for cutting-edge military innovations.

From HUR MoD’s official sources:

May 2: Magura-7, a Ukrainian maritime drone (USV: uncrewed surface vessel) operated by Group 13 of defense intelligence (HUR) has made history, being the first uncrewed vessel ever to successfully shoot down an enemy fast jet.  The historic event took place on May 2 close to the strategic Russian naval base of Novorossiysk in the eastern Black Sea. It is the first time a fast jet has been shot down by an uncrewed vessel. It is unconfirmed exactly which type of missile was used, but the AIM-9 missile or a similar weapon seems likely. These infrared homing missiles were designed for aircraft launch but have been adapted by Ukraine as ground and sea-based systems. They are called Sea Dragon when launched from USVs.

The Main Directorate of Intelligence of the Ukrainian Ministry of Defense (HUR) made history by destroying two Russian helicopters and damaged a third in an operation that used MAGURA V5 unmanned surface vessels (USVs) armed with surface-to-air missiles (SAMs). The operation, conducted by the HUR’s Group 13 special forces unit, took place in the Black Sea near Cape Tarkhankut off the western tip of the Russian-occupied Crimean Peninsula on 31 December 2024. The SAMs used by the MAGURA V5s were identified by the HUR as “R-73 ‘SeeDragon’ missiles” -- ground-launched variants of the Soviet-designed R-73 short-range air-to-air missile. Each USV can carry two R-73s mounted on launch rails.

From HUR MoD’s official sources:

August 28: HUR attacked and damaged a Russian Project 21631 Buyan-M-class small missile ship, a carrier of Kalibr cruise missiles, near Russian-occupied Crimea in the Azov Sea on August 28. During the operation, fighters from HUR’s special unit "Prymary" (Ghosts”) damaged the ship’s radar system using a drone strike, while special forces launched an attack directly on the missile carrier. The missile ship, stationed in Temryuk Bay and ready to launch Kalibr missiles, was forced to retreat from its patrol zone after the attack.

September 10: A HUR-operated drone hit a multifunctional vessel of the Russian Black Sea Fleet off Novorossiysk on September 10, inflicting costly damage. The Project MPSV07 ship was tracked down and hit while carrying out reconnaissance and patrolling Novorossiysk Bay near Russia's Krasnodar Krai region, where the Black Sea Fleet is currently based.

September 12: HUR hit two Russian Be-12 Chayka anti-submarine amphibious aircraft in occupied Crimea. The attack was carried out on Sept. 21 by HUR’s special force unit Prymary (Ghosts). This attack marked the first-ever destruction of Be-12 aircraft in history.

August 12: HUR Chief Kyrylo Budanov inspected positions of the “Tymur Special Unit” on Zmiinyi (Snake) Island and at gas extraction platforms in the Black Sea. He reviewed forces and capabilities involved in defending the maritime area and the so-called “Boyko Towers,” which were returned to under Ukrainian control after successful HUR operations in 2022.

May 14: HUR Chief Kyrylo Budanov and a team of HUR engineers unveiled to the public three of the Magura-family maritime strike drones:

Magura V5 — a swarm-capable “ship killer” optimized for targeting Russia’s Black Sea Fleet ships;

Magura V6P — a multifunctional unmanned surface vehicle (USV);

Magura V7 — a missile-carrying unmanned surface platform.

September 24: HUR-operated USVs attacked logistics infrastructure of the ports of Novorossiysk and Tuapse on Russia’s Black Sea coast.

RESISTANCE MOVEMENT AND DEEP STRIKES INSIDE RUSSIA: A WAR WITHOUT BORDERS

The Resistance Movement operations in 2025—skillfully coordinated and supported by Ukrainian defense intelligence—demonstrated that the war has ceased to be “distant” for Russia. Arson and sabotage attacks, logistics disruptions, attacks on airfields, the Trans-Siberian Railway, and energy infrastructure are no longer isolated incidents, but elements of systematic pressure that destroys war logistics, demoralizes personnel, and undermines confidence in Russian Government’s ability to control its own territory. The war launched by the Russians is now being brought home to Russia.

From HUR MoD’s official sources:

Throughout March, fires destroyed six railway traction units in Russia’s Moscow, Samara, and Tver regions. In the Republic of Mari El, Stavropol Krai and Krasnoyarsk Krai regions, nine railway signaling, centralization, and blocking stations were destroyed.

April 24: At Rostov-on-Don Central airfield, a hostile Su-30SM multirole fighter (tail number “35”) caught fire and burned down.

Night of May 31: On a railway section near Yakymivka in the Zaporizhzhia region’s Melitopol district, a Russian military train was blown up, disrupting a key logistics artery for Russian forces in the occupied Zaporizhzhia region and Crimea.

Night of June 1: the Resistance Movement destroyed railway crossing bridges in Russia’s Bryansk and Kursk regions.

June 14: guerilla forces attacked an industrial power substation in Kaliningrad, completely cutting off electricity supply to Russian military-industrial base facilities.

Night of July 9: As a result of a joint operation by HUR, the Security Service of Ukraine (SBU), and the Foreign Intelligence Service, an Oreshnik ballistic missile was destroyed at the Kapustin Yar test range in Russia.

Night of July 26: At Armavir airfield in Krasnodar Krai region, a Russian Su-27UB combat-capable trainer jet was destroyed by fire.

September 13: HUR and the Special Operations Forces carried out a highly complex operation to halt railway traffic along the Oryol–Kursk route used by Russian occupying forces.

In October, a series of unexplainable fires mysteriously erupted at key logistics and power supply hubs across Russia.

October 26: An explosion struck a railway section between the settlements of Chernihivka and Stulneve in Zaporizhzhia region’s Berdyansk district, leaving a Russian train carrying war supplies derailed and approximately 100 meters of track damaged.

October 31: the HUR MoD conducted a successful special operation aimed to disable the aggressor state’s critically important military asset—the “Koltsevoy” petroleum products pipeline, which had supplied the Russian occupying forces with resources for conducting a genocidal war against the Ukrainian people.

November 13: Near the settlement of Sosnovka in Russia’s Khabarovsk Krai region, an explosion blocked freight traffic on the Trans-Siberian Railway—the key rail artery used by the aggressor state for supplying its forces with armaments and ammunition, including supplies originating from North Korea.

CYBER FRONT, SANCTIONS, AND INFORMATION WARFARE

In 2025, the Main Directorate of Intelligence (HUR) carried out a series of successful operations in cyberspace. These included cyberattacks on major Russian state-owned companies such as Tupolev and Gazprom, attacks on the occupying administration in Crimea, special operations to obtain evidence of the forced deportation of Ukrainian children, the identification of war criminals, and facilitating the enforcement of international sanctions through HUR’s dedicated War & Sanctions web portal.

In the meantime, HUR’s Strategic Communications Directorate (StratCom) was developing a more responsive and mature communication architecture, in which truth, context, and long-term strategic effect took precedence over short-term media impact.

“Strategic communications provide the ability to manage information in a way that enables correct interpretation of the past, shapes reality in the present, and influences the future,” Lieutenant General Kyrylo Budanov, the Head of the HUR MoD, said describing the StratCom’s mission.

From official HUR MoD sources:

May: HUR cyber forces conducted a cyberattack targeting the resources of the Tupolev Design Bureau, Russia’s top aircraft manufacturing company.

July: Ukrainian defense intelligence carried out a major cyberattack against Gazprom, Russia’s giant gas monopoly.

A “digital attack” delivered against the occupying administration in Crimea fully erased data from so-called “government-owned” servers. As part of the operation, HUR cyber forces obtained full access to the occupiers’ documentation.

Ukrainian defense intelligence obtained documents containing evidence of Ukrainian children being forcibly deported from the currently Russian occupied areas of the Kherson, Zaporizhzhia, Donetsk, and Luhansk regions.

HUR assisted investigators from Ukraine’s National Police in identifying and formally incriminating five members of the Russian occupying forces of war crimes involving the execution of 17 civilians in Bucha in 2022.

HUR MoD engaged with Ukraine’s National Police to make public the names and personal data of war criminals—servicemen of the 234th Air Assault Regiment within the Russian Armed Forces’ 76th Division.

HUR established the identity of the Russian Armed Forces officer responsible for preparing the missile strike on the Okhmatdyt Children’s Hospital in Kyiv on July 8. The perpetrator was identified as Major Denis Sheinov, Head of the Engineering Service, the 121st Heavy Bomber Aviation Regiment, the 22nd Heavy Bomber Aviation Division, the Russian Air Force.

August 29: Kyiv hosted the International Forum titled “Information Warfare: From Resistance to Resilience,” jointly organized by the HUR MoD and the Institute for National Resilience and Security with sponsorship from NATO Representative Office in Ukraine. The forum was attended by HUR Chief Kyrylo Budanov, Ukrainian and international intellectuals, as well as information security experts, including military personnel, academics, policymakers, diplomats, media professionals, and members of civil society.

PUNISHMENT FOR TRAITORS AND ENEMIES

There is no statute of limitations on the war crimes committed by Russian forces on Ukrainian territory. Perpetrators will not be shielded by rank, uniform, or borders. Every crime will be documented, every name identified, and justice will inevitably reach those responsible. Ukraine, together with the international community, will not allow impunity to become the norm. Punishment will be unavoidable and lawful. This is not about revenge, but about an obligation to the memory of the victims and to a future in which evil is named explicitly and condemned accordingly.

The HUR Chief, Lieutenant General Kyrylo Budanov, has repeatedly emphasized that all traitors to Ukraine and all servicemen of the Russian Armed Forces who have committed war crimes—especially crimes against civilians—will inevitably face just punishment.

From official HUR MoD sources:

December 29, 2024: On the Vasylivka–Tokmak highway in Zaporizhzhia region, servicemen from the HUR active operations unit “Kraken” eliminated Sergey Melnikov, chief of staff of the “Storm.Ossetia” battalion of the Russian Armed Forces’ 429th Motorized Rifle Regiment, along with his driver.

January 3: An explosion in the town of Shuya outside the provincial capital of Ivanovo killed Captain Konstantin Vladimirovich Nagaiko, a battery commander of the 112th Missile Brigade within the 1st Tank Army of Russia’s Western Military District (military unit no. 03333). His subordinates committed a war crime when they launched a missile strike at a café in the village of Hroza outside of Kupiansk at the time it hosted a memorial gathering on October 5, 2023, killing 59 Ukrainian civilians.

Early hours of February 23: In currently Russian occupied Prymorsk, the Zaporizhzhia region, an explosion occurred in the office of the Russian-installed head of the organization “My Documents MFC.” The target was Roman Podsudevskyi, a collaborator and traitor, formerly a senior official of Ukraine’s State Border Guard Service who fled to occupied Crimea in 2015.

Early hours of May 30: Two explosions were reported in Vladivostok, near Desantnaya Bay, in the deployment area of the 47th Separate Air Assault Battalion within the 155th Separate Guards Naval Infantry Brigade of the Russian Armed Forces.

June 18: In currently occupied Berdiansk, Zaporizhzhia region, collaborator, state traitor, and war criminal Mykhailo Pavlovych Hrytsai was shot dead.

September 16: Explosions occurred in the settlement of Shchytovaya outside Vladivostok in Russia’s Primorsky Krai region, where the 47th Separate Air Assault Battalion of the 155th Separate Guards Naval Infantry Brigade is stationed.

October 22: At least three servicemen of the 247th Caucasian Cossack Airborne Regiment of the Russian Armed Forces were eliminated as a result of a successful HUR operation assisted by the Caucasus Liberation Movement. The incident took place near the checkpoint of military unit no. 54801 in central Stavropol, the Russian Federation.

October 25: In Russia’s Kemerovo region, a vehicle exploded killing Veniamin Vladimirovich Mazzherin, Lieutenant-Colonel of Russia’s OMON riot police. He was implicated in war crimes committed in Kyiv region in the spring of 2022.

PRISONER EXCHANGES, HUMANITARIAN PROJECTS, AND “SOFT POWER”

Prisoner exchanges, the projects “I Want to Live,” “I Want to Find,” “I Want to Go Home,” and the effective, rapid work of Air Medevac services all demonstrate another important feature of the HUR operations this year: the combination of hard power with humanitarian and social responsibility.

More than 6,200 Ukrainians returned from captivity over four long years of full-scale war is not just a statistic figure, it is a direct evidence of Ukrainian government agencies’ effectiveness during a war of attrition.

From official HUR MoD sources:

April 5: School teacher Nataliia Shylo was repatriated to Ukraine. She had spent four years in captivity in the Russian Federation and in currently Russian occupied Ukraine. Shylo was detained by the occupiers on espionage charges in 2021 while traveling to a settlement outside Horlivka to see her sick mother. She was successfully freed from Russian imprisonment.

May 23–25: The Coordinating Headquarters for the Treatment of Prisoners of War, assisted by Ukraine’s defense intelligence service HUR, carried out the largest successful prisoner exchange to date, in which 1,000 Ukrainians returned home.

Overall Results and Closing Reflections

Overall, as of the end of December, thanks to the efforts of the Coordinating Headquarters for the Treatment of Prisoners of War, 6,266 Ukrainian citizens have been released from Russian captivity and returned to Ukraine.

During June, according to the Coordinating Headquarters, 6,057 bodies of Ukrainians—both military personnel and civilians—were repatriated to Ukraine. They had been killed or tortured to death by Russian forces.

Thousands more bodies of fallen Ukrainian defenders were returned home during July, August, and October. The process of identification is ongoing. Eternal memory to the fallen Ukrainian heroes.

P.S.

As previously stated by the HUR Chief Kyrylo Budanov, in just a few years of full-scale war Ukraine’s defense intelligence has gone through a difficult path of profound transformation and reform, having evolved into a flexible and effective instrument of national defense.

“We are constantly in a state of readiness to repel external threats, because modern war has no pauses or stops. National security requires proactive action,” HUR explains, highlighting the need for permanent transformations.

Ukraine’s defense intelligence service has ceased to be merely a “shadow.” The once-familiar phrase “intelligence is working” is no longer just a euphemism—it has become almost a news genre of its own. Sometimes it is an action thriller, sometimes a techno-thriller, sometimes a humanitarian drama with a happy ending.

The HUR of the Ministry of Defense of Ukraine has definitively gone beyond the classical notion of what intelligence is supposed to be. Today it is about a global network, high technology, maritime drones armed with missiles, evacuations from the world’s hottest flashpoints, cyberattacks—and simply very bad news for the adversary, from the Black Sea through Africa to Russia’s Far East.

The HUR is here to stay. There is still a lot of work ahead, and it will definitely be continued...

Yehor Checherynda, Kyiv

(Based on reports from the HUR official website and the War & Sanctions web portal)