Zelensky Taps SBU's Khmara as Acting Defense Minister Amid Ukraine Reshuffle
Ukrainian President Volodymyr Zelensky has appointed Yevhenii Khmara, the acting head of the Security Service of Ukraine (SBU), as acting defense minister, tapping a major general with deep intelligence and counterterrorism credentials to lead Kyiv's war effort. Khmara, who has run the SBU on an interim basis since January following the dismissal of Vasyl Malyuk, previously commanded the agency's elite Alpha Special Operations Center—a unit tied to counterterrorism operations, intelligence support, and long-range strike missions against Russian targets. He also participated in operations to expel Russian forces from the Kyiv region during the early phase of the 2022 full-scale invasion. Zelensky framed the choice as strategic, citing Khmara's "unprecedented experience in conducting technology-driven strike operations" as critical to Ukraine's evolving defense posture.
The appointment comes in the wake of a controversial cabinet reshuffle that triggered public protests across Kyiv and other Ukrainian cities following the dismissal of former Defense Minister Mykhailo Fedorov. While Ukraine's parliament approved most of Zelensky's new cabinet on Thursday, the defense and foreign minister positions remain vacant pending separate presidential nominations, as required by Ukrainian law. Several lawmakers have raised legal concerns about Khmara's eligibility, arguing that Ukrainian legislation mandates the defense minister and deputy defense ministers be civilians rather than active-duty military officers. As Khmara transitions to the Ministry of Defense, his first deputy, Oleksandr Poklad, is expected to take over as acting head of the SBU, maintaining operational continuity at an agency that has played a central role in Ukraine's cyberwar against Russia.
The leadership shift underscores the increasingly blurred lines between military operations, intelligence work, and cyber defense in Ukraine's conflict with Moscow. Organizations monitoring the region should remain vigilant about state-sponsored APT activity and evolving threat actor tactics—particularly as intelligence agencies undergo restructuring, a process that can create temporary gaps in operational oversight. Security teams are advised to run a privacy checkup on their infrastructure and verify exposure with a port scanner to identify any unintended attack surfaces that could be exploited during periods of geopolitical turbulence. With the SBU's cyber capabilities now under new interim leadership, the broader threat landscape in Eastern Europe warrants close monitoring through dedicated WHOIS lookup and infrastructure attribution tools.