Unit 29155
Unit 29155 is a unit of რუსეთის military intelligence service, the GRU, described in the content as a Russian military intelligence sabotage and assassination group. The content also attributes cyber activity to the group, including cyberespionage operations and the WhisperGate attacks targeting Ukraine. A 2024 joint advisory cited in the content linked Raspberry Robin to Russia’s GRU and the 161st Specialist Training Center (Unit 29155). The content further states that France’s Viginum said the disinformation operation Storm-1516 had been publicly attributed to Unit 29155, and assessed Storm-1516 as a significant foreign digital interference threat affecting public debate in France and across Europe. Reported targeting and effects mentioned in the content include Ukraine, as well as influence activity aimed at European audiences and narratives intended to discredit Ukraine, its allies, and supporting Western leaders. Alias mentioned in the content: unit_29155. Sub-group or linked operation mentioned in the content: Storm-1516.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian military intelligence unit publicly linked to the Storm-1516 disinformation operation.
Russian military intelligence-linked unit referenced as connected (via Raspberry Robin) to follow-on activity enabled by SocGholish-provided access; described in the content as part of state-sponsored operations targeting critical infrastructure.
Russian military intelligence unit associated (in the cited discussion) with hacking activity in support of sabotage/assassination operations.
Referenced as a Russian military intelligence-linked group associated with sabotage/assassination; no cyber TTP details provided in the text.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.