KP in Ukraine

Profile narrative

The organisation is known by the alias KP in Ukraine and its headquarters is located in Ukraine. It operates as the cyber police unit within the National Police of Ukraine, reporting to the Ministry of Internal Affairs. Its primary mandate is to detect, prevent, and investigate cybercrime affecting individuals, businesses, and state institutions.

The unit carries out technical examinations of digital evidence, tracks malicious online activity, and supports victims of cyber attacks such as phishing, malware distribution, and ransomware incidents. It issues alerts and recommendations to help organisations strengthen their defences against emerging threats. In addition, the cyber police conducts proactive monitoring of underground forums and threat actor behaviour to anticipate potential campaigns.

A distinguishing attribute of the organisation is its specialised focus on cyber threats, which includes expertise in analysing malware, tracing command‑and‑control infrastructure, and decrypting communications used by criminals. It maintains a dedicated team of investigators, forensic analysts, and technical specialists who work closely with the State Service of Special Communications and Information Protection (SSSCIP) and the Security Service of Ukraine. This inter‑agency cooperation enables rapid information sharing and coordinated responses to large‑scale incidents.

Structurally, the cyber police is a subordinate division of the National Police, integrated into the broader law‑enforcement framework of the country. It participates in international cybercrime initiatives, contributing to joint operations and training programmes with partners in Europe and beyond. While specific personnel numbers or budget figures are not disclosed in the available sources, the unit’s role is consistently referenced in reports concerning the mitigation of cyber attacks against Ukrainian governmental and critical infrastructure targets.

Incidents

16 incidents linked to this organisation.