Loading story…
Western governments, investigators, and private-sector researchers have linked Russia’s GRU, including Unit 26165 and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as Fancy Bear—to the 2018 attempted compromise of the OPCW in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of Yulia Skripal using X-Agent malware. CrowdStrike previously attributed the intrusion into the Democratic National Committee to Russian actors associated with the same broader threat cluster.
U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on Ukrainian critical infrastructure, France’s Macron campaign, the 2018 Winter Olympics, NotPetya victims, and reconnaissance that supported missile strikes on Mariupol, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to Unit 74455 and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
On July 18, 2025, the UK announced sanctions against three GRU units and 18 Russian military intelligence officers for a long-running campaign of malicious cyber and hybrid activity. The action also sanctioned three leaders of African Initiative, which the UK described as a Russia-funded information operation platform in West Africa.
The UK government said GRU Unit 26165 conducted online reconnaissance in 2022 that helped target missile strikes against Mariupol, including the strike that destroyed the Mariupol Theatre. The UK said the theatre attack killed hundreds of civilians, including children.
Bellingcat reported on October 22, 2020 that leaked Moscow vehicle registration data linked several indicted GRU hackers to known GRU addresses, including Svobody 21V and Khoroshevskoe 76B. The analysis identified 49 people registered to variants of the Svobody 21 address, suggesting a broader pool of GRU-associated personnel.
On October 15, 2020, a federal grand jury in the Western District of Pennsylvania returned an indictment against six Russian military intelligence officers for destructive malware operations and other disruptive cyberattacks worldwide. The alleged targets included Ukrainian critical infrastructure, France's political campaign, Georgia, NotPetya victims, the Winter Olympics, and investigations into nerve agent attacks attributed to Russia.
On 2018-10-04, the UK's National Cyber Security Centre publicly attributed attacks on WADA, the DNC, Ukrainian critical infrastructure, and the OPCW to the GRU, identifying it with APT28 and stating high confidence. Canada the same day blamed the GRU for attacks on WADA and the Canadian Centre for Ethics in Sport and supported the Dutch attribution over the OPCW operation.
On October 4, 2018, a federal grand jury in the Western District of Pennsylvania indicted seven alleged GRU officers for a conspiracy spanning about December 2014 through at least May 2018. The charges covered hacking, wire fraud, aggravated identity theft, and money laundering tied to intrusions against anti-doping organizations, athletes, Westinghouse Electric Company, and the OPCW, as well as leak-and-amplification activity through the Fancy Bears persona.
On October 4, 2018, the Netherlands publicly disclosed the disrupted OPCW operation and identified the four operatives. A US Department of Justice indictment issued the same day linked Aleksei Morenets and Evgenii Serebriakov to GRU Unit 26165.
On July 13, 2018, a U.S. grand jury charged 12 Russian citizens described as GRU employees with interfering in the 2016 U.S. presidential election through cyberattacks on Democratic Party figures and the publication of stolen information. The indictment identified officers from GRU units 26165 and 74455 and tied them to personas including Guccifer 2.0 and DCLeaks.
On April 10, 2018, four Russian nationals arrived at Amsterdam Schiphol Airport carrying diplomatic passports and were met by a member of the Russian embassy in The Hague. They carried technical equipment and conducted surveillance of OPCW headquarters as part of an apparent effort to hack the organization’s systems.
Dutch intelligence intercepted the four Russian operatives targeting the OPCW in The Hague and sent them back to Moscow. The apparent objective was to compromise OPCW systems and disrupt investigations related to the Skripal poisoning.
The article states that GRU Unit 26165 was also linked to hacking World Athletics in 2017.
According to the DOJ indictment cited in the content, Aleksei Morenets and Evgenii Serebriakov traveled to Rio de Janeiro and Lausanne in 2016 to target Wi‑Fi networks used by people with access to USADA, WADA, and the Canadian Center for Ethics in Sport.
The content states that GRU Unit 26165 had previously been known for remote intrusions, including the 2016 Democratic National Committee breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
gov.uk
Open sourceatlanticcouncil.org
Open sourcebellingcat.com
Open sourcecyberscoop.com
Open sourcejustice.gov
Open sourcerferl.org
Open sourcejustice.gov
Open sourcecrowdstrike.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
US prosecutors and allied governments publicly identified Russian military intelligence officers from the **GRU** for a series of high-profile cyber operations, linking the same apparatus to election interference, destructive malware, and espionage campaigns. A Mueller indictment detailed how GRU operators allegedly hacked Democratic Party networks, stole documents, and staged their release through online personas and infrastructure designed to obscure Russian involvement. Separately, the US Justice Department charged additional GRU officers over attacks tied to Ukraine, including the **NotPetya** malware outbreak and intrusions associated with power grid disruptions, underscoring the unit’s role in both covert influence operations and disruptive cyberattacks. European authorities also exposed a failed close-access GRU operation against the **Organisation for the Prohibition of Chemical Weapons (OPCW)** in The Hague. Dutch officials said four Russian operatives arrived with Wi‑Fi interception equipment, cash, phones, and receipts that connected them to GRU facilities in Moscow, and later expelled them after reportedly receiving a British intelligence tip. Investigators and media reports tied members of that team to broader targeting of the Skripal investigation, **MH17** investigators, and the **World Anti-Doping Agency**, reinforcing a picture of a global GRU campaign marked by aggressive targeting and, in some cases, operational mistakes that helped attribute the activity.
Jun 29, 2026
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to **Conti**, **TrickBot**, **Wizard Spider**, **LockBit**, **EvilCorp**, **BlackBasta**, the **Lumma** infostealer, and the pro-Russian **Cyber Army of Russia Reborn**. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of **GRU Unit 29155**. The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to **Unit 29155**, while the EU action also cites links to the **WhisperGate** campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Jul 20, 2026