ANTI-CORRUPTION

ATTACK ON ARMA

Attack on ARMA: The Attempted Capture of Ukraine's Asset Recovery Agency — Smart Times
Smart Times · Anti-Corruption · Breaking

Attack on ARMA: The Brazen Attempt to Install a Presidential Office Loyalist at Ukraine's Asset Recovery Agency

International partners intervened to stop a sham competition designed to remove Ukraine's most consequential anti-corruption reformer and replace her with a known operative tied to corruption networks. The Cabinet of Ministers must now explain what happens next.

Ukraine's Asset Recovery and Management Agency — ARMA — is the institution responsible for seizing, managing, and liquidating assets frozen in corruption and criminal cases. It holds billions of hryvnias worth of confiscated property, including oligarchic real estate, seized corporate stakes, and assets linked to individuals on NABU's most sensitive case dossiers. Whoever controls ARMA does not merely run an administrative body: they decide which frozen assets get preserved and which quietly disappear into opaque management arrangements. Last week, forces connected to the Presidential Office attempted to seize that control through a recruitment competition so transparently rigged that international observers had no choice but to intervene publicly.

The scheme was straightforward in its mechanics, even if brazen in its ambition. A formal competition was announced for the position of ARMA head, a post currently held in an acting capacity by Yaroslava Maksymenko, the reformist official appointed in August 2025. Among the candidates put forward was Viktor Dubovyk — a Presidential Office employee described by anti-corruption watchdogs and agency insiders as a figure with known corruption associations, whose selection would have represented a direct reversal of the independent-agency model that international partners have spent years defending.

"The competition was not a competition. It was an installation ceremony interrupted."

Anti-corruption expert, Kyiv, April 2026

Who is Viktor Dubovyk — and why does it matter

Viktor Dubovyk currently heads the Legal Policy Directorate of the Presidential Office. His background, documented in an investigation by Schemes (Radio Liberty's Ukrainian investigative unit), raises questions that go well beyond factional loyalty. During the Revolution of Dignity, Dubovyk served as an adviser to Serhii Arbuzov — the former Deputy Prime Minister of Ukraine who is now wanted and has fled the country. That association alone would normally disqualify a candidate for a senior anti-corruption role. It did not appear to do so here.

The significance of placing such a figure at the head of ARMA cannot be overstated. ARMA manages frozen assets linked to figures including oligarchs connected to Medvedchuk, Levochkin, Fridman, Zhevago, Fuks, and Mindich — individuals whose networks have long sought to recover, redirect, or neutralize seized property. A politically compliant ARMA director would not need to formally intervene in any case: the mere administrative flexibility to delay auctions, select compliant asset managers, and slow evidentiary preservation would be sufficient to serve the interests of those applying pressure from outside the agency.

Yaroslava Maksymenko: eight months that made enemies

To understand why the removal attempt happened now, it is necessary to understand what Maksymenko has actually done since taking the position. In approximately eight months, she oversaw the dismissal of roughly one third of ARMA's staff on corruption-related grounds — a purge of embedded networks that had spent years facilitating the very asset mismanagement the agency was created to prevent. A significant number of those dismissed have since received summonses from the prosecutor's office, a signal that the dismissals were not merely administrative but evidentiary.

Critically, Maksymenko has actively resisted pressure from the oligarchic networks whose assets ARMA manages. Sources with direct knowledge of the agency's operations describe sustained pressure campaigns from networks associated with Medvedchuk, Levochkin, Fridman, Zhevago, Fuks, and Mindich — all figures who appear in Ukraine's Corruption Risk Index with scores reflecting significant reputational and legal exposure. In each instance, the agency under Maksymenko held its position. She is described by reform advocates and international observers as the first ARMA head who is not a political appointee in any meaningful sense — not a placement from any faction, oligarchic network, or party apparatus. That independence is precisely what made her removal an urgent objective for those whose assets she oversees.

CRI Reference — Oligarchs Whose Networks Pressured ARMA
Viktor Medvedchuk
CRI 760 Very High
EU sanctioned; Russia-linked; assets under ARMA management
Serhiy Levochkin
CRI 720 Very High
Yanukovych-era operative; frozen asset interests
Pavel Fuks
CRI 683 Very High
NSDC sanctioned; Russia ties; fled Ukraine
Kostyantyn Zhevago
CRI 710+ Very High
NABU-investigated; assets under ARMA freeze orders

Cyberattack on ARMA: a second front

The competition scandal did not occur in isolation. In mid-April, ARMA confirmed that its staff had been subjected to a cyberattack — one linked by investigators to Russian-affiliated hackers. According to a statement by Maksymenko to Interfax-Ukraine, the agency's Digital Transformation Directorate, working in coordination with Ukraine's State Special Communications Service, conducted a full review of the incident. The conclusion: internal information systems were not penetrated, and no leak from databases or state information resources occurred. The attack was limited to access to staff email accounts, and the matter has been referred to law enforcement for legal assessment.

The context surrounding the attack is significant. According to reporting by Korrespondent.net, Russian-linked hackers have over the past two years gained access to more than 170 email accounts belonging to Ukrainian prosecutors and investigators — at least 284 accounts compromised between 2024 and 2026. The breach was discovered not by Ukrainian authorities but by British and American cyber-threat researchers from the Ctrl-Alt-Intel group, after the hackers inadvertently left the compromised data exposed. The same hacker network has also targeted military and government structures in several NATO member states, including Romania, Bulgaria, and Greece.

The timing of a cyberattack on ARMA — during the same week that the fraudulent leadership competition was being contested — is unlikely to be coincidental. Whether the two operations were coordinated or merely parallel, the effect is the same: ARMA, under a reformist head who has made real enemies among oligarchic networks with frozen assets and among Presidential Office factions, is simultaneously under legal and digital pressure. The cyberattack's failure to penetrate core systems is a credit to the agency's technical defenses. That it was attempted at all is a measure of how consequential the institution's independence has become.

Budanov's office: caught by surprise

One dimension of the affair that has generated significant commentary in Kyiv's anti-corruption community concerns Kyrylo Budanov, the head of the Defense Intelligence of Ukraine (HUR), who oversees the Presidential Office employee at the center of the scheme. According to multiple sources with knowledge of the situation, Budanov was not informed of Dubovyk's candidacy and was not part of the planning behind the competition. His reaction upon learning of the episode is described as one of genuine displeasure: he neither sanctioned the operation nor was consulted about it, and Dubovyk is now expected to face dismissal as a consequence. The episode reflects a broader pattern in which operators within the Presidential Office apparatus pursue factional objectives without the knowledge — let alone the approval — of every senior figure nominally connected to them.

"The new head of the office did not know about his employee's intrigues. Now he is very displeased."

Sources with knowledge of internal Presidential Office dynamics, April 2026

International intervention: the same playbook that saved NABU

What stopped the competition from producing its intended result was not domestic political opposition alone — it was direct intervention by international partners with standing to do so. The pattern is familiar: it is the same mechanism that produced the reversal of Law 12414 in July 2025, when EU aid freezes and G7 diplomatic pressure forced the restoration of NABU's independence within nine days of the law's passage. In this instance, international representatives with observer status in the competition process made clear — publicly and privately — that a competition conducted in this manner, producing this candidate, would not be recognized as legitimate and would have consequences for Ukraine's institutional standing.

The intervention follows a template established across multiple iterations of anti-corruption pressure in Ukraine: Ukrainian civil society identifies the mechanism of capture; reform-oriented officials and agency heads resist internally; international bodies with financial and diplomatic leverage apply external pressure; the capture attempt is blocked. Each iteration raises the question of how long this external scaffolding must substitute for internal political will — and whether the institutions being protected are developing the resilience to hold on their own.

Why international partners intervened — what ARMA controls
  • Frozen oligarchic assets worth billions of hryvnias, including property linked to sanctioned individuals
  • Asset management contracts that can be used to redirect income from frozen property before formal confiscation
  • Auction processes for confiscated assets — the gateway through which seized property re-enters private ownership
  • Evidentiary preservation of asset records used in NABU, SAPO, and HACC prosecutions
  • War-related confiscations of Russian-linked assets, whose management has direct implications for Ukraine's reconstruction financing

The reform record at stake

The attempt to remove Maksymenko arrives at a moment when ARMA's eight-month reform record is beginning to produce measurable institutional results. The dismissal of approximately one third of staff — estimated at several dozen employees — has disrupted embedded networks that had operated within the agency for years, some of whom are now subjects of prosecutorial interest. The agency has, for the first time in its history, maintained visible resistance to oligarchic pressure campaigns without reversing course under political pressure. That track record is what the removal attempt was designed to erase.

The broader implication is one that applies beyond ARMA. Each of Ukraine's independent anti-corruption institutions — NABU, SAPO, HACC, NAZK, the Bureau of Economic Security — faces recurring pressure campaigns designed to install compliant leadership, subordinate investigative independence to political authority, or simply demoralize staff through administrative harassment. ARMA was targeted not because it is the most powerful of these bodies, but because its leadership position was open and the competition mechanism provided a formal procedural cover for what would otherwise have been an unconcealed political appointment.

CRI Signal — Yaroslava Maksymenko

Yaroslava Maksymenko appears in CRI Version 5 in the Anti-Corruption Agencies category. Her score reflects the reform actions taken during her tenure and the pressure campaigns mounted against her. The attempted removal, the identity of the candidate proposed to replace her, and the international intervention required to block it are treated as significant institutional signals in the CRI methodology — not merely as a personnel dispute, but as a stress test of ARMA's independence that the agency, with external support, passed.

The timeline of the affair

Key Events — ARMA Leadership Competition, April 2026
Aug 2025
Yaroslava Maksymenko appointed ARMA Acting Head; begins internal audit and staff review
Aug–Mar 2026
Approximately one third of ARMA staff dismissed on corruption-related grounds; some receive prosecutorial summonses; oligarchic pressure campaigns intensify
Early Apr 2026
Formal competition for permanent ARMA head position announced; Viktor Dubovyk (Presidential Office employee) among candidates put forward
16 Apr 2026
ARMA confirms cyberattack on staff emails; Maksymenko states internal systems not breached, no database leak; matter referred to law enforcement; Russian-linked hackers suspected
Mid-Apr 2026
International observer representatives flag competition as procedurally improper; refuse to recognize process as legitimate
Late Apr 2026
Competition suspended or results blocked; Dubovyk candidacy neutralized; Budanov's office distances itself; dismissal of Dubovyk expected
Now
Cabinet of Ministers expected to announce next steps for ARMA leadership competition; international partners monitoring closely

What happens next: the Cabinet must act

The blocking of the Dubovyk candidacy does not resolve the underlying situation. ARMA still requires a permanent head — the acting capacity in which Maksymenko serves is not a sustainable institutional arrangement, and the vulnerability that an open competition creates will persist until a legitimate process produces a legitimate outcome. The Cabinet of Ministers now faces the obligation to announce a credible path forward: a competition that meets international standards, conducted with genuine transparency, producing a candidate who is selected on qualifications rather than factional affiliation.

International institutions — including the EU, IMF, OECD, and FATF-affiliated bodies — have already demonstrated in multiple prior episodes that they will intervene when Ukraine's anti-corruption framework is directly threatened. The question the Cabinet's next announcement will answer is whether the political will exists to conduct the ARMA competition correctly, or whether a second attempt at the same capture will follow once the immediate international attention subsides.

What the Cabinet of Ministers must now address
  • Announce a new, transparent competition timeline with clear international observer participation
  • Publish selection criteria and candidate qualification standards in advance
  • Confirm that no Presidential Office employees or their direct nominees will participate in competition panels
  • Address the procedural violations in the prior competition — including whether any officials involved face accountability
  • Provide a formal response to international partners whose intervention was required to stop the original process

For every foreign investor, Western official, and reconstruction-financing institution tracking Ukraine's governance environment, the ARMA affair is a data point — not an isolated scandal but part of the recurring pattern the Corruption Risk Index was built to make legible. The same networks that tried to capture ARMA are the networks whose assets ARMA manages. The conflict of interest is not incidental. It is the point. The question the next several weeks will answer is whether Ukraine's institutional immune system — reinforced by international partners — holds again, or whether the pressure finds another vector.

2026-04-26 21:25