Loading threat actor…
GRU Unit 29155 is a Russian military intelligence unit associated with sabotage, clandestine operations, and destructive cyber activity. Its cyber component is tracked as Cadet Blizzard and Ember Bear. Western governments have linked the unit to cyber operations against Ukraine, NATO countries, and European critical infrastructure, including the WhisperGate campaign against Ukrainian targets. The unit has also been associated with Russian hybrid operations and with recruiting cyber specialists through relationships with external cybercriminal actors and Russian educational institutions. Public reporting has linked Unit 29155 activity to use of SocGholish as an initial-access mechanism and RomCom tooling against organizations with Ukrainian affiliations. Andrey Averyanov is a senior GRU officer who previously commanded the unit.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families attributed to this actor across reporting.
3 indicators attributed to this actor. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.