From 16 to 18 June 2026, Ukrainian law enforcement, prosecution, cybersecurity and critical infrastructure representatives enhanced their practical skills in investigating cybercrime and handling electronic evidence during the III Cybercrime cooperation exercise held in Vinnytsia, Ukraine.

Through a realistic, hands-on simulation, participants strengthened their ability to respond to complex cyber incidents affecting critical infrastructure. Working in multidisciplinary teams, participants investigated a simulated cyber incident. The scenario required participants to identify and analyse digital traces, investigate phishing infrastructure, examine forensic artefacts, process subscriber information requests, follow cryptocurrency payment trails and coordinate investigative actions across multiple jurisdictions.

The exercise also focused on international cooperation. Participants exercised the preparation of requests to service providers, hosting companies and virtual asset service providers and applied digital forensic and OSINT techniques to support cross-border investigative cooperation.

At the conclusion of the exercise, teams presented their findings, reconstructed the attack chain and proposed measures to strengthen cybersecurity and resilience of critical infrastructure. The activity provided a valuable platform for enhancing cooperation between law enforcement authorities, prosecutors, cybersecurity practitioners and private sector stakeholders.

The exercise was organized by the CyberUA and CyberEast+ projects in partnership with the National Security and Defence Council of Ukraine, as part of the Council of Europe’s continued support to Ukraine in strengthening capacities to investigate cybercrime, handle electronic evidence, and improve cooperation between competent authorities and private sector partners in line with international standards.