Profile: GRU cyber and hybrid threat operations - GOV.UK

">

Cookies on GOV.UK

We use some essential cookies to make this website work.<br>We’d like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services.<br>We also use cookies set by other sites to help us deliver content from their services.

You have accepted additional cookies. You can change your cookie settings at any time.

You have rejected additional cookies. You can change your cookie settings at any time.

Accept additional cookies

Reject additional cookies

View cookies

Hide cookie message

Skip to main content

Foreign, Commonwealth<br>& Development Office

Home Office

Cabinet Office

NCSC

Print this page

© Crown copyright 2026

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations

Headlines

To date, the United Kingdom has:

sanctioned 3 Russian Military Intelligence (GRU) Units (29155, 26165, 74455) and dozens of military intelligence officers.

highlighted the role and involvement of GRU leadership and senior officers in operations including Andrey Averyanov, Ivan Kasyanenko, Vyacheslav Stafeyev, Vladimir Lipchenko, Yuriy Sizov, Denis Smolyaninov, Ivan Senin, Dmitriy Mikhaylov, Yuriy Shikolenko, Viktor Netyksho, Boris Antonov, Aleksey Morenets, Sergey Morgachev and Yevgeniy Serebriakov

closely collaborated with the Federal Bureau of Investigation (FBI) and condemned and called out GRU malicious cyber activity with NATO allies and the European Union (EU) its Member States.

sanctioned Aleksey Lukashev, Ivan Yermakov and GRU Unit 26165 for historic cross-border targeting of email accounts belonging to Yulia Skripal with X-Agent malware in 2013.

highlighted GRU Unit 26165’s role in conducting online reconnaissance on civilian shelters in Mariupol and Kharkiv on 15 March 2022. Russian Armed Forces conducted artillery strikes on Mariupol Theatre on 16 March 2022, killing non-combatants sheltering there, including children

sanctioned The GRU’s 161st Specialist Training Centre [TsPS] (“Unit 29155”) for the first time in its entirety for cyber operations targeting Ukraine

called out the breadth of Russia’s malicious cyber activity targeting Ukraine prior to, during and since Russia’s full-scale invasion on 24 February 2022 – including destructive cyber operations like Viasat (2022) and Whispergate (2022), as well as Unit 26165’s cyber espionage campaign which targeted foreign assistance to Ukraine

highlighted how the Russian Intelligence Services (RIS), in particular the FSB and GRU have tasked, and in some cases funded, Russian cybercriminals. The GRU specifically have funded the development of new technologies to support cyber and hybrid threat operations against European partners and NATO allies, threatening Euro Atlantic security

Sanctioned the Russian interference agency African Initiative, along with 3 of its leaders. African Initiative uses Russian intelligence officers, and Russian funding, to deliver influence operations in Africa.

GRU’s established structures conducting cyber operations

GRU Units 29155, 26165 and 74455 are 3 entities with known cyber capabilities. Units 26165 and 74455 represent an advanced, comprehensive cyber capability which Russia deploys for the achievement of military and foreign policy objectives. Unit 29155 also separately carries out operations against these targets.

These units have the following titles:

Unit 29155, also known as the 161st Specialist Training Center (TsPS), which has a cyber wing known in open source as Cadet Blizzard

Unit 26165, also known as the 85th Main Special Service Center (GTsSS), or APT28

Unit 74455, also known as the Main Center for Special Technologies (GTsST), APT44 or Sandworm

Unit 29155 (“161st TsPS”) and its associated structures

Following Russia’s full-scale invasion of Ukraine, it has been reported that the Special Activity Service (“SSD”) was established to absorb GRU Unit 29155 and to conduct operations against the West using Russia’s full hybrid toolkit, including sabotage, assassinations and cyber attacks. According to public reporting, Ivan Sergeyevich Kasyanenko has held the position of Deputy Chief of The Special Activity Service (also known as the Department of Special Tasks or SSD). It has been reported that Kasyanenko works closely with SSD’s Chief Andrey Averyanov.

Wider GRU Unit 29155 operations include the Vrbétice...