Loading threat actor…
Unit 26165 is a cyber operations unit of Russia’s military intelligence service, the GRU, responsible for the threat actor tracked as APT28. It conducts state-sponsored cyberespionage against government institutions, international organizations and civilian targets, including organizations involved in chemical-weapons verification, aviation-disaster investigations and sporting integrity. Its operations include deploying officers abroad to conduct close-access cyberattacks, including under diplomatic cover. Dutch authorities, working with the United Kingdom, disrupted a Unit 26165 operation against the Organisation for the Prohibition of Chemical Weapons in The Hague in April 2018. An officer involved also participated in operations targeting Malaysian institutions associated with the MH17 investigation, including the Attorney General’s office and Royal Malaysian Police. Related activity targeted officials attending a World Anti-Doping Agency conference in Switzerland. A Canadian Centre for Ethics in Sport official’s laptop was compromised with APT28 malware, followed by broader compromise of the organization’s systems; APT28 also compromised infrastructure belonging to the International Olympic Committee. Unit 26165 uses compromised network infrastructure to conceal malicious traffic. In February 2024, the FBI dismantled a botnet of compromised Ubiquiti EdgeOS routers operated by the unit to proxy malicious traffic against the United States and allied nations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.