NPU Cyberpolice ('StopRussia | MRIYA' / 'BRAMA') & >UAH 1.02B in Enterprise IT (ThreatQ TDR, HYAS Insight, Cellebrite) vs. 14 of 14 Live Borshchahivka Telegram Torpedoes and Unchecked 'Kill the Cops and Burn Their Cars' Triggers (UID 8895205236)
The Cyberpolice Department of the National Police of Ukraine (EDRPOU 40116400, headed by Police General of the 3rd Rank Yurii Vykhodets) regularly briefs Western technical-assistance donors (EUAM Ukraine, Council of Europe C-PROC CyberEast+, OSCE SPU, CRDF Global, US State Dept INL) on hundreds of thousands of 'blocked hostile resources' under its crowdsourced 'StopRussia | MRIYA' ecosystem (rebranded as 'BRAMA'), while centralized NPU procuring entity SI 'TSOP NPU' (EDRPOU 40108981) awarded over UAH 1.02 billion in 2025–2026 IT contracts for enterprise servers, NetApp storage, ThreatQ TDR threat-intelligence orchestration (UAH 33.91M, UA-2025-11-17-013428-a), HYAS Protect / HYAS Insight adversary-infrastructure attribution (UAH 48.98M, UA-2025-05-28-012192-a), Cellebrite UFED 4PC Ultimate suites (UAH 17.97M), and video-analytics cyber defense (UAH 126.80M). Yet live forensic verification as of 07 Nov 2026 (Day 5 after the 02 Nov 2026 assault on a military deployment point in Petropavlivska Borshchahivka and Day 3 after the 04 Nov 2026 Palladina Ave blockade and Obolon protests in Kyiv) proves: (1) 14 out of 14 (100%) named Telegram torpedoes remain active and unblocked; (2) a fresh no-username burner account (MTProto user_id=8895205236 in thread @truexakyiv/96829) freely posted direct calls to murder police officers and burn police cars ('Kill the cops and burn their cars'), while user_id=5832863517 called to beat police crews at roadblocks, because the manual URL/@username crowdsourcing model of 'MRIYA / BRAMA' is architecturally blind to accounts with username: null and Telegram Premium SendAsPeer channel masks (@kyivskiydvish, channel_id=3913826799); (3) no automated MTProto stop-list by immutable 64-bit user_id was provided by the agency to Kyiv municipal channels — our team built and published that open JSON stop-feed for free (/feeds/telegram-nomadic-torpedoes.json and Methodology M-22).
| Official (Full Name) | Position & Agency (Nov 2026) | Statutory Mandate & Unfulfilled Norm |
|---|---|---|
| Police General of the Third Rank Yurii Vykhodets | Head of the Cyberpolice Department of the National Police of Ukraine Cyberpolice Department of the National Police of Ukraine (EDRPOU 40116400) |
Law of Ukraine 'On the National Police', Law of Ukraine 'On the Basic Principles of Ensuring Cybersecurity of Ukraine', Arts. 114-1, 345, 348 of the Criminal Code of Ukraine — technical attribution, disruption, and forensic documentation of coordinated Telegram attacks on police units and military facilities, and ensuring that the donor-backed 'StopRussia | MRIYA' ('BRAMA') ecosystem operates on immutable MTProto user_id identifiers rather than disposable @username strings. |
| Andrii Sharonov | First Deputy Head of the Cyberpolice Department of the National Police of Ukraine Cyberpolice Department of the National Police of Ukraine (EDRPOU 40116400) |
Operational supervision of cybercrime units and rapid response to organized burner-account swarms (including user_id=8895205236 and user_id=5832863517) that incited the murder of police officers and arson of police vehicles in Kyiv on 04 Nov 2026. |
| Oleg Zavorotnii | Deputy Head of the Cyberpolice Department of the National Police of Ukraine Cyberpolice Department of the National Police of Ukraine (EDRPOU 40116400) |
Oversight of analytical and technical divisions of the Cyberpolice Department and coordination with international donor missions (EUAM Ukraine, Council of Europe C-PROC CyberEast+, OSCE, CRDF Global, US INL). |
| Volodymyr Kryvolapov | Deputy Head of the Cyberpolice Department of the National Police of Ukraine Cyberpolice Department of the National Police of Ukraine (EDRPOU 40116400) |
Digital forensic and operational-technical support for cyber investigations, including unmasking Telegram SendAsPeer channel masks (PeerChannel 3913826799 @kyivskiydvish) and cross-district nomadic provocateurs (user_id=5225374042 @Denov1977b). |
| Oleksii Hryhorovych | Head of the Department of Information and Analytical Support of the National Police of Ukraine (DIAP NPU) Department of Information and Analytical Support of NPU (EDRPOU 40108578) |
Operation of centralized NPU analytical databases and integration of automated threat-intelligence indicators (ThreatQ TDR / HYAS Insight) to detect cross-district migration of provocateurs across Kyiv municipal chats. |
| Prozorro ID & Buyer | Contract / Value (UAH) | Procurement Subject | Contractor (EDRPOU) & USR Beneficiaries |
|---|---|---|---|
| UA-2026-04-17-011312-a ↗ State Institution 'Center for Servicing Subdivisions of the National Police of Ukraine' / SI 'TSOP NPU' (EDRPOU 40108981) |
UAH 138,822,000.00 (plus UA-2026-04-29-011641-a for UAH 30,211,230.00 and UA-2025-03-07-008751-a for UAH 24,868,800.00 — total UAH 193,902,030.00) | NetApp enterprise data storage complex (UAH 138.82M), network switches (UAH 30.21M), and Cisco Secure Endpoint license renewals (UAH 24.87M) | DINTEKH LLC (EDRPOU 45431544; incorporated 18.03.2024 with UAH 300,000 charter capital; per EDR sole ultimate beneficial owner (100%) and director — Iryna Romashka) |
| UA-2026-10-02-010977-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 148,226,880.00 (plus UA-2025-11-17-013428-a for UAH 33,905,490.00 — total UAH 182,132,370.00) | Enterprise server hardware for NPU information systems (UAH 148.23M) and cyber-threat intelligence & orchestration software ThreatQ TDR Orchestrator Solution (UAH 33.91M) | OPTIDATA LLC (EDRPOU 39693067; charter capital UAH 1,000; per EDR ultimate beneficial owners — Kostiantyn Atamanenko (50%) and Mariia Bilyk (50%, CEO)) |
| UA-2025-09-18-011332-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 92,444,124.00 (plus UA-2025-05-15-011553-a for UAH 35,185,800.00 and UA-2025-05-27-012996-a for UAH 24,508,353.00 — total UAH 152,138,277.00) | Server data storage complex (UAH 92.44M), backup and recovery software packages (UAH 35.19M), and enterprise servers (UAH 24.51M) | COMPUTER FORENSICS LABORATORY LLC / TOV 'LABORATORIIA KOMPIUTERNOI KRYMINALISTYKY' (EDRPOU 39818376; charter capital UAH 20,000; per EDR sole UBO (100%) and director — Serhii Denysenko) |
| UA-2025-11-13-015549-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 99,994,746.00 (plus UA-2026-10-16-011354-a for UAH 26,805,738.00 — total UAH 126,800,484.00) | Hardware-software complex for video surveillance and video analytics (UAH 99.99M) and expansion of the NPU video-analytics monitoring and cyber-defense center (UAH 26.81M) | SECURITY INFRASTRUCTURE LLC / TOV 'INFRASTRUKTURA BEZPEKY' (EDRPOU 44717970; charter capital UAH 50,000; per EDR UBOs — Yevheniia Aleksieieva (50%) and Serhii Baklan (50%), director — Ihor Sementsiv) |
| UA-2025-05-29-010338-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 91,915,697.48 | SSD/HDD storage drives and RAM modules for NPU server complexes | PROFTEKHPOSTACH LLC (EDRPOU 38964381; charter capital UAH 1,000,000; per EDR sole UBO (100%) and director — Oleksii Novikov) |
| UA-2025-11-27-015121-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 34,101,918.00 (plus UA-2026-04-29-010961-a for UAH 33,065,910.00 and UA-2025-09-01-008185-a for UAH 22,231,800.00 — total UAH 89,399,628.00) | Three contracts for ESET PROTECT MDR managed detection and response license renewals | DATASTREAM LLC (EDRPOU 37814762; charter capital UAH 20,000; per EDR sole UBO (100%) — Ihor Skryhun, director — Svitlana Stetsenko) |
| UA-2025-05-28-012192-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 48,981,000.00 | License renewal for HYAS Protect and HYAS Insight specialized adversary-infrastructure attribution software for identifying current attack sources | IT BUSINESS SYSTEMS OF UKRAINE LLC (EDRPOU 41302701; charter capital UAH 1,000; per EDR sole UBO (100%) and director — Fedir Shebeta) |
| UA-2026-10-01-010899-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 29,805,720.00 (plus UA-2025-10-21-014812-a for UAH 17,971,074.00 — total UAH 47,776,794.00) | Hardware-software complex licenses (UAH 29.81M) and upgrade of Cellebrite UFED 4PC Ultimate mobile forensic extraction suites (UAH 17.97M) | NOTRACE LLC / TOV 'NOTREIS' (EDRPOU 45435397; incorporated 08.08.2024; per EDR UBOs — Volodymyr Vecher (70%, director) and Yevheniia Velyka (30%)) |
| UA-2026-09-23-013729-a ↗ SI 'Center for Servicing Subdivisions of the National Police of Ukraine' (EDRPOU 40108981) |
UAH 31,501,773.00 (plus UA-2025-10-22-011357-a for UAH 18,916,308.00 — total UAH 50,418,081.00) | Information security software packages (plus separate contract UA-2026-10-22-015062-a for UAH 41,347,300.00 awarded to IT-DEVELOPMENT LLC, EDRPOU 41003486, UBO Nataliia Holovenko) | TO YE SOFT LLC (EDRPOU 38005199; per EDR UBOs — Daria Shovkoplias (50%, director since 03.07.2025) and Ihor Melnyk (50%)) |
- 07 Nov 2026 07:51 UTC — live forensic verification of t.me/* web profiles and MTProto discussion graphs: 14 of 14 (100%) named Telegram torpedoes from the Petropavlivska Borshchahivka assault (02 Nov 2026) and 8 no-username burner accounts from the Kyiv blackout protests (04 Nov 2026) remain active on Day 5
- 07 Nov 2026 — publication of the open machine-readable MTProto UID stop-feed https://operbaza.org/feeds/telegram-nomadic-torpedoes.json and Engineering Methodology M-22 (/en/methods/method-22-borshchahivka-14-torpedoes-sorm-blindness-mtproto-uid-filter-2026) enabling zero-cost numeric blocking by 64-bit user_id / channel_id
- 07 Nov 2026 — completion of cross-registry audit of 14 NAZK declarations of the leadership of the Cyberpolice Department of NPU (EDRPOU 40116400) and DIAP NPU (EDRPOU 40108578) alongside 26 Prozorro IT tenders of SI 'TSOP NPU' (EDRPOU 40108981) exceeding UAH 1.02 billion for Western technical-assistance donors (EUAM Ukraine / EEAS CPCC, CoE C-PROC CyberEast+, OSCE SPU, CRDF Global, US State Dept INL)
Tracked Objects & Public Registry Verification (8)
| Code / Channel ID / TIN | Object / Entity | Documented Violation & Primary Registry | Live Status |
|---|---|---|---|
| TG-UID-472827990-OLYATHEBT | @OlyaTheBT (Olha Parkhomets) · MTProto user_id=472827990 · t.me/petropavlivskabor/33717..33720 | Echelon-1 primary igniter in the 'Petropavlivska Borshchahivka and Surroundings' chat (02 Nov 2026 10:20:15 UTC, 4h 18m before Strana.ua amplification): injected the false 'Soniachna St. 7... people are being tortured, medics blocked' alert with zero prior message history in the chat Live Auto-Check: As of 07 Nov 2026 07:51 UTC, profile t.me/OlyaTheBT and seed post t.me/petropavlivskabor/33720 remain completely active and unblocked. |
100% ALIVE ON DAY 5 (07 NOV 2026) |
| TG-UID-6695051993-SNIZHANA | @snizhana_sob (Snizhana) · MTProto user_id=6695051993 · t.me/SofievskayaPetropavBorshchagovka/1644075 | Echelon-1 shock amplifier (02 Nov 2026 13:48–14:03 UTC): posted 12 coordinated physical-assault mobilization calls in 15 minutes across two neighboring district chats ('Police are INACTIVE! Armed unknowns are holding people by force!') Live Auto-Check: As of 07 Nov 2026 07:51 UTC, account t.me/snizhana_sob (fresh 669... UID range) and all 12 assault messages in district chats remain online and unrestricted. |
100% ALIVE ON DAY 5 (07 NOV 2026) |
| TG-PEERCHANNEL-3913826799-KYIVSKIYDVISH | @kyivskiydvish (SendAsPeer single-letter channel mask 'L', 1 subscriber) · PeerChannel channel_id=3913826799 · t.me/koperchat2026/1749076 | Telegram Premium SendAsPeer channel mask in 'Kyiv Operative | Chat' (02 Nov 2026 16:56:19 UTC, 116 reactions): anonymized the operator's personal account behind a 1-subscriber shell channel to amplify anti-mobilization violence narratives Live Auto-Check: As of 07 Nov 2026 07:51 UTC, shell channel t.me/kyivskiydvish and message t.me/koperchat2026/1749076 remain active. |
100% ALIVE ON DAY 5 (07 NOV 2026) |
| TG-UID-5225374042-DENOV1977B | @Denov1977b (D. Zh. O.) · MTProto user_id=5225374042 · cross-district migration Borshchahivka (02 Nov) -> Palladina Ave -> Obolon (04 Nov) | Cross-district nomadic provocateur: operated in the Petropavlivska Borshchahivka assault thread on 02 Nov 2026, then migrated on 04 Nov 2026 at 18:26 and 19:15 UTC into @truexakyiv/96829 (Palladina Ave road blockade) and @truexakyiv/96835 (Obolon) to artificially link utility power outages with the 'combat surgeon' V. Moloda provocation and anti-Maidan tropes Live Auto-Check: As of 07 Nov 2026 07:51 UTC, profile t.me/Denov1977b remains active; zero cross-district stop-filters by MTProto UID 5225374042 have been deployed. |
100% ALIVE ON DAY 5 (07 NOV 2026) |
| TG-UID-8895205236-KILL-POLICE | MTProto user_id=8895205236 (no @username, fresh 889... series) · t.me/truexakyiv/96829 (04 Nov 2026 19:06:07 UTC) | Direct inciter of lethal violence against police officers and arson of police vehicles during the Sviatoshyn road blockade in Kyiv ('Kill the cops and burn their cars', Arts. 345, 348 Criminal Code of Ukraine): operates without a @username, rendering it invisible to URL-based reporting in 'StopRussia | MRIYA / BRAMA' Live Auto-Check: Because the account has no public @username, the crowdsourced URL reporting pipeline of 'StopRussia | MRIYA / BRAMA' cannot ingest it as a target, while numeric Bot API / MTProto blocking by user_id=8895205236 has not been deployed. |
STILL ACTIVE · 0 UID BLOCKS |
| TG-UID-5832863517-ASSAULT-POLICE | MTProto user_id=5832863517 ('Volodymyr Borshchivskyi', no @username) · t.me/truexakyiv/96829?comment=4067541 (04 Nov 2026 17:53:37 UTC) | Direct call to physically assault National Police officers during the Akademika Palladina Ave road blockade ('Send the police there and beat them up. What does transport have to do with it') Live Auto-Check: Comment t.me/truexakyiv/96829?comment=4067541 and account user_id=5832863517 remain unblocked as of 07 Nov 2026. |
STILL ACTIVE IN @TRUEXAKYIV THREAD |
| TG-UID-8940324745-KHARKIVSKYI | MTProto user_id=8940324745 ('Kharkivskyi', no @username, fresh 894... series) · t.me/petropavlivskabor/33746 & 33845 | Echelon-2 cross-district relay (02 Nov 2026 14:47 UTC and 04 Nov 2026 18:51 UTC): injected Petropavlivska Borshchahivka riot footage into local chats 1 min 59 sec after Russian military propaganda channel 'Voenkory Russkoy Vesny' (@RVvoenkor/126470) Live Auto-Check: Message t.me/petropavlivskabor/33845 and account user_id=8940324745 remain active as of 07 Nov 2026. |
100% ALIVE IN BORSHCHAHIVKA CHAT |
| TG-TORPEDO-CLUSTER-10-HANDLES-6-ZEROES | 10 named torpedoes (@k_restonosets [309834386], @ya_bavovna [387320983], @lana3070 [6738879038], @morozov_pavlo [587218075], @zeend77 [538103615], @AviCrossman [616631997], @Sten76 [263464813], @homaaaaq [8173254881], @Yarovoy1 [514518300], @deputatik3 [1643760407]) + 5 no-username zero-accounts (UID 7831259310, 7911407278, 5125543281, 5747492517, 1977347334) | Remaining 10 named torpedo accounts and 5 fresh no-username accounts that coordinated the Petropavlivska Borshchahivka assault (02 Nov 2026) and regime-overthrow calls during the Kyiv blackout protests (04 Nov 2026) Live Auto-Check: Live t.me/<username> and MTProto verification as of 07 Nov 2026 07:51 UTC confirmed that 14 out of 14 named accounts (100%) remain online and unblocked. Open machine-readable JSON stop-feed: https://operbaza.org/feeds/telegram-nomadic-torpedoes.json |
14 OF 14 (100%) ALIVE ON 07 NOV 2026 |


