One life sentence now sits at the center of Ukraine’s most sensitive spy scandal in months: Col Dmytro Kozyura, a former senior Security Service of Ukraine official, has been jailed for spying for Russia’s FSB.
XOOMAR Intelligence
Analyst Take
Kozyura was found guilty of high treason under martial law and the illegal handling of weapons, ammunition or explosives by the Shevchenkivskyy District Court in Kyiv, according to BBC World. Prosecutors said he agreed to pass information “constituting state secrets” for financial reward and then systematically disclosed classified material.
Dmytro Kozyura gets life sentence after Ukraine’s “rat” operation
Kozyura was not a peripheral source. He had served as chief of staff of the SBU’s anti-terrorism centre, a role prosecutors said gave him access to state secrets and responsibility for coordinating counterterrorism work.
The SBU said an operation codenamed “rat” found that Kozyura used a safehouse in Kyiv to communicate with Russian handlers who wanted classified information about Ukraine’s military and leadership. After his arrest in February 2025, the SBU released an image showing him alongside Ukraine’s intelligence chief Vasyl Malyuk, who led the investigation.
“Anyone who wears Ukrainian epaulets and begins working for the FSB becomes an enemy of Ukraine,” Prosecutor General Ruslan Kravchenko said. “Only the harshest punishment is appropriate for such individuals.”
The case comes as Kyiv continues to announce operations aimed at exposing Russian agents inside Ukraine since Moscow launched its full-scale invasion in February 2022, a war still marked by deadly Russian missile attacks. That broader wartime setting matters, but the Kozyura case stands out because of where prosecutors say the breach occurred: inside Ukraine’s own security service.
| Issue | Details from Ukrainian authorities |
|---|---|
| Conviction | High treason under martial law and illegal handling of weapons, ammunition or explosives |
| Sentence | Life in prison |
| Former role | Chief of staff of the SBU anti-terrorism centre |
| Russian service named | FSB |
| Alleged handler | Yuriy Shatalov, described by the SBU as coordinating a network of agents |
| Operation name | “rat” |
A 2018 Vienna recruitment claim puts the breach inside Ukraine’s security core
The SBU said after sentencing that Kozyura had been recruited by the FSB in Vienna in 2018, though several years passed before Russian handlers resumed contact in December 2024. Ukrainian authorities said he was then asked to gather information about Russian troop deployment and movement, Ukraine’s weapons, infrastructure, and political and military leadership.
Prosecutors described the alleged activity as systematic. Kravchenko’s office said Kozyura spied on SBU command posts and “systematically” shared the consequences of Russian strikes, including numbers of wounded soldiers and civilians. He was also accused of sharing documents marked “secret” while remaining in “constant communication” with handlers.
“The colonel, a career officer in the SBU, had access to state secrets and was responsible for co-ordinating the fight against terrorism,” prosecutors said.
XOOMAR analysis: The significance is not just that an alleged Russian agent was convicted. It is that prosecutors say the agent sat inside a function tied to counterterrorism coordination and had access to classified information. The source material does not prove specific battlefield damage from the disclosures, and Ukrainian authorities have not publicly detailed every compromised document. But the categories they named, including command posts, weapons, infrastructure and leadership information, are the kinds of material a wartime intelligence service tries hardest to shield.
Ukraine’s security service also claimed it turned the operation back against Moscow before the arrest. The SBU said it “monitored every step of the agent around the clock” and used him to “flood Russian forces with a massive amount of disinformation” while preventing him from accessing important intelligence.
That claim is central to Kyiv’s message: the state was penetrated, but not blind. Whether Ukrainian authorities release enough evidence to support that full counterintelligence narrative is a separate question.
For readers tracking how intelligence institutions become pressure points in other systems, XOOMAR’s separate coverage of Russ Vought Grabs the Keys to Intelligence Budgets examines a very different fight over intelligence power and control. Europe’s internal-security strains also show up in another form in Germany’s 58,700 Far-Right Extremists Rattle Democracy, though that case is unrelated to Kozyura.
February 2025 arrest leaves Kyiv with hard questions about exposure
Kozyura was arrested after SBU officials found he had communicated with a Russian operative from a safehouse using a separate mobile phone and Wi-Fi router, the agency said. The named FSB handler, Yuriy Shatalov, was described as someone whose role was to coordinate a network of agents.
That detail widens the issue beyond one colonel. If Shatalov was coordinating a network, Ukrainian investigators may still be assessing whether Kozyura was one node in a larger structure, whether any other contacts remain active, and whether any classified material was reused by Russian services.
XOOMAR analysis: The most sensitive unanswered question is duration. The SBU says recruitment happened in 2018, contact resumed in December 2024, and arrest followed in February 2025. That timeline gives prosecutors a clear period for the active phase they described, but it does not fully answer what happened in the years between recruitment and renewed contact.
Authorities have also not disclosed whether anyone else inside Ukrainian institutions has been charged in connection with the case. Nor is it clear from the supplied record whether Kozyura will appeal.
The next phase will test how much Ukraine is willing to reveal. More disclosure could reassure the public that the damage was contained, but it could also expose counterintelligence methods or sensitive gaps. Less disclosure protects the service but leaves room for Moscow to exploit uncertainty.
Kyiv has secured the harshest possible sentence. Now it has to show that the breach stopped with Kozyura, or at least that any wider network is being cut down faster than Russia can use it.
Impact Analysis
- The conviction exposes a serious alleged breach inside Ukraine’s own security apparatus during wartime.
- The life sentence signals Kyiv’s intent to impose maximum penalties for collaboration with Russian intelligence.
- The case underscores the ongoing counterintelligence threat Ukraine faces more than two years after Russia’s full-scale invasion.
Primary Sources & Disclosures
Written by
XOOMAR Insights Team
Research and Editorial Desk
The XOOMAR Insights Team pairs automated research with human editorial judgment. We track hundreds of sources across technology, fintech, trading, SaaS, and cybersecurity, cross-check the facts, and explain what happened, why it matters, and what to watch next. We do not just rewrite headlines. Every article is fact-checked and scored for reliability before it goes live, and we link back to the original sources so you can verify anything yourself.
