Loading story…
Swedish prosecutors ended their investigation into the 2017 intrusion at the Swedish Sports Confederation after concluding that legal constraints prevented charges against the suspected operators, who were identified as acting on behalf of the Russian state. The Swedish Prosecution Authority, drawing on findings from the Swedish Security Service and foreign intelligence partners, attributed the breach to Russia's GRU and specifically its 85th Main Special Service Center, also known as Unit 26165. Investigators said the attackers stole Swedish athletes' medical records during an intrusion that ran from December 2017 to May 2018.
The case was tied to a broader Russian anti-doping influence campaign that targeted sports organizations including WADA, USADA, and FIFA, with stolen data later published online to undermine Western athletes and sports bodies. The attribution aligns with U.S. Justice Department charges against six GRU officers over a global hacking and destructive malware campaign, which included operations linked to the same Russian military intelligence apparatus and its cyber activities against international sporting and anti-doping institutions.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
The U.S. Department of Justice filed charges against GRU intelligence service members over related hacking activity tied to the broader campaign targeting sports and anti-doping organizations. The Swedish article cites this as having occurred in October 2018.
Swedish prosecutors said Russia's GRU, specifically its 85th Center (Unit 26165), intruded into the Swedish Sports Confederation between December 2017 and May 2018. The attackers stole Swedish athletes' medical records as part of a broader anti-doping influence campaign.
Swedish authorities dropped their investigation into the intrusion, saying legal constraints prevented prosecutors from charging operators acting on behalf of a foreign power. At the same time, the Swedish Prosecution Authority formally blamed the Russian government and GRU Unit 26165 for the breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Western governments, investigators, and private-sector researchers have linked **Russia’s GRU**, including **Unit 26165** and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as **Fancy Bear**—to the 2018 attempted compromise of the **OPCW** in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of **Yulia Skripal** using **`X-Agent`** malware. CrowdStrike previously attributed the intrusion into the **Democratic National Committee** to Russian actors associated with the same broader threat cluster. U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on **Ukrainian critical infrastructure**, **France’s Macron campaign**, the **2018 Winter Olympics**, **NotPetya** victims, and reconnaissance that supported missile strikes on **Mariupol**, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to **Unit 74455** and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Aug 15, 2026
US prosecutors and allied governments publicly identified Russian military intelligence officers from the **GRU** for a series of high-profile cyber operations, linking the same apparatus to election interference, destructive malware, and espionage campaigns. A Mueller indictment detailed how GRU operators allegedly hacked Democratic Party networks, stole documents, and staged their release through online personas and infrastructure designed to obscure Russian involvement. Separately, the US Justice Department charged additional GRU officers over attacks tied to Ukraine, including the **NotPetya** malware outbreak and intrusions associated with power grid disruptions, underscoring the unit’s role in both covert influence operations and disruptive cyberattacks. European authorities also exposed a failed close-access GRU operation against the **Organisation for the Prohibition of Chemical Weapons (OPCW)** in The Hague. Dutch officials said four Russian operatives arrived with Wi‑Fi interception equipment, cash, phones, and receipts that connected them to GRU facilities in Moscow, and later expelled them after reportedly receiving a British intelligence tip. Investigators and media reports tied members of that team to broader targeting of the Skripal investigation, **MH17** investigators, and the **World Anti-Doping Agency**, reinforcing a picture of a global GRU campaign marked by aggressive targeting and, in some cases, operational mistakes that helped attribute the activity.
Jun 29, 2026
Germany formally blamed Russia for the 2015 cyberattack on the Bundestag, identifying Russian national **Dmitry Badin** as a suspected operative of the GRU’s Unit 26165, also known as **APT28** or **Fancy Bear**. Federal prosecutors obtained an international arrest warrant accusing him of intelligence activity and data espionage, while Berlin summoned the Russian ambassador and said it had hard evidence tying Moscow to the intrusion. Investigators said the breach began with spearphishing emails disguised as United Nations messages about the Ukraine conflict, leading to malware infections inside the parliamentary network. The attackers allegedly escalated privileges, used tools including `Mimikatz`, and exfiltrated at least **16 GB** of data, including large volumes of lawmakers’ emails, before the operation was stopped. Germany also pushed for **EU-wide sanctions** under the bloc’s cyber sanctions regime, making the case one of Europe’s most prominent state-linked cyber attribution actions.
Aug 15, 2026