Loading signal...
Signal
Submitted
Apr 28, 2026, 19:29 UTC
Russian GRU Unit 29155, notorious for assassinations and sabotage, also operated a cyber hacking team conducting large-scale cyberattacks against Ukraine and NATO nations, as revealed by The Insider's investigation and confirmed by a 2024 US indictment.
Russian military intelligence’s elite special operations unit, GRU Unit 29155, is widely known for assassinations and sabotage activities including the Salisbury poisonings and arms depot explosions in Europe. The Insider’s year-long investigation reveals for the first time that Unit 29155 also maintained a cyber hacking team active since 2012. In August 2024, six members of this hacking team were indicted in the US for conducting the 'WhisperGate' malware campaign targeting Ukraine’s critical infrastructure, emergency services, and agriculture prior to Russia’s 2022 invasion. The hackers posted private data of Ukrainians and illegally accessed NATO nations’ computer networks, including a significant breach of Poland’s transportation sector vital for weapon supply. The cyber unit ran false-flag operations impersonating groups such as Ukraine’s Right Sector and 'Anonymous Poland' to sow discord between Ukraine, Poland, and Western allies. They also attempted to discredit open-source investigative outlet Bellingcat via doxing and fake attributions. Unit 29155 hackers actively spread disinformation about Western biolabs and funded opposition groups. The team recruited external actors like Bulgarian journalist Dilyana Gaytandzhieva to publish hacked diplomatic data aimed at stirring international tensions, notably involving Azerbaijani weapons shipments and regional conflicts. Key figures include Timur 'Tim' Stigal, linked to cybercrime and fraud indictments in the US, who headed the hacking unit; his son Amin Stigal was also indicted but may be misidentified. The unit's cyber operations exemplify Russia’s hybrid warfare strategy combining covert cyber sabotage with disinformation to support military objectives in Ukraine and abroad. This revelation extends the understanding of Russia’s integrated use of lethal covert ops and cyberattacks ahead of and during wartime.
Confidence: High
The article explicitly identifies Russian GRU Unit 29155 hacking teams conducting hostile cyber operations against Ukraine and NATO countries, supported by a US indictment naming specific individuals and malware campaigns.
Source URL
https://theins.press/en/inv/281731
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "152782d5-ec26-48f4-bf9e-b04f9053fc1b",
"url": "https://theins.press/en/inv/281731",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Russian Federation",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"GRU",
"Unit 29155",
"WhisperGate",
"cyberattacks",
"Ukraine",
"NATO",
"Russian hybrid warfare",
"False-flag operations",
"Disinformation",
"Malware",
"Data theft",
"Poland",
"Bellingcat",
"Dilyana Gaytandzhieva",
"Eastern Europe",
"2022 Russia-Ukraine war",
"Espionage"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Hidden Bear: The GRU hackers of Russia’s most notorious kill squad",
"description": "Russian GRU Unit 29155, the Kremlin’s notorious black ops kill and sabotage squad implicated in multiple assassinations and sabotage attacks across Europe, operated a clandestine hacking team for at least a decade. This team conducted cyberattacks designated as 'WhisperGate,' aiming to digitally destabilize Ukraine in the lead-up to Russia's full-scale invasion in 2022 by deploying malware that wiped data from Ukrainian critical infrastructure and emergency sectors. The unit also hacked systems in 26 NATO countries, notably breaching Polish transportation networks critical for Western weapon flows to Kyiv. Their operations included false-flag cyberattacks impersonating Ukrainian ultranationalist and hacktivist groups to inflame tensions among allies. The Insider’s investigation, based on leaked emails, server logs, and social media data, identifies key operatives including Timur Stigal ('Key'), who coordinated cybercrime and espionage campaigns, and recruited other hackers. Stigal’s team disseminated false information, hacked Western targets like Bellingcat, and engaged external collaborators such as Bulgarian journalist Dilyana Gaytandzhieva to leak hacked diplomatic data related to Azerbaijani arms shipments linked to Syrian conflicts. The unit’s cyber activities exemplify Russia's broader hybrid warfare approach, blending lethal covert operations with cyber sabotage and strategic disinformation to support Kremlin geopolitical objectives.",
"summary_short": "Russian GRU Unit 29155, notorious for assassinations and sabotage, also operated a cyber hacking team conducting large-scale cyberattacks against Ukraine and NATO nations, as revealed by The Insider's investigation and confirmed by a 2024 US indictment.",
"summary_extended": "Russian military intelligence’s elite special operations unit, GRU Unit 29155, is widely known for assassinations and sabotage activities including the Salisbury poisonings and arms depot explosions in Europe. The Insider’s year-long investigation reveals for the first time that Unit 29155 also maintained a cyber hacking team active since 2012. In August 2024, six members of this hacking team were indicted in the US for conducting the 'WhisperGate' malware campaign targeting Ukraine’s critical infrastructure, emergency services, and agriculture prior to Russia’s 2022 invasion. The hackers posted private data of Ukrainians and illegally accessed NATO nations’ computer networks, including a significant breach of Poland’s transportation sector vital for weapon supply. The cyber unit ran false-flag operations impersonating groups such as Ukraine’s Right Sector and 'Anonymous Poland' to sow discord between Ukraine, Poland, and Western allies. They also attempted to discredit open-source investigative outlet Bellingcat via doxing and fake attributions. Unit 29155 hackers actively spread disinformation about Western biolabs and funded opposition groups. The team recruited external actors like Bulgarian journalist Dilyana Gaytandzhieva to publish hacked diplomatic data aimed at stirring international tensions, notably involving Azerbaijani weapons shipments and regional conflicts. Key figures include Timur 'Tim' Stigal, linked to cybercrime and fraud indictments in the US, who headed the hacking unit; his son Amin Stigal was also indicted but may be misidentified. The unit's cyber operations exemplify Russia’s hybrid warfare strategy combining covert cyber sabotage with disinformation to support military objectives in Ukraine and abroad. This revelation extends the understanding of Russia’s integrated use of lethal covert ops and cyberattacks ahead of and during wartime.",
"actor_primary": "Timur Stigal",
"target_primary": null,
"location_text": "Ukraine, Poland",
"location_region": null,
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly identifies Russian GRU Unit 29155 hacking teams conducting hostile cyber operations against Ukraine and NATO countries, supported by a US indictment naming specific individuals and malware campaigns.",
"event_time_utc": "2024-08-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T19:29:00.239Z",
"updated_at": "2026-11-10T02:44:22.357Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Aug 1, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Ukraine, Poland
Primary actor
Timur Stigal
Country
Russian Federation
Countries
Russian Federation
Tags
GRU, Unit 29155, WhisperGate, cyberattacks, Ukraine, NATO, Russian hybrid warfare, False-flag operations, Disinformation, Malware, Data theft, Poland, Bellingcat, Dilyana Gaytandzhieva, Eastern Europe, 2022 Russia-Ukraine war, Espionage
Nodes
Node 1: Borders, Node 2: 5th Column
Signal
Submitted
Apr 28, 2026, 19:29 UTC
Russian GRU Unit 29155, notorious for assassinations and sabotage, also operated a cyber hacking team conducting large-scale cyberattacks against Ukraine and NATO nations, as revealed by The Insider's investigation and confirmed by a 2024 US indictment.
Russian military intelligence’s elite special operations unit, GRU Unit 29155, is widely known for assassinations and sabotage activities including the Salisbury poisonings and arms depot explosions in Europe. The Insider’s year-long investigation reveals for the first time that Unit 29155 also maintained a cyber hacking team active since 2012. In August 2024, six members of this hacking team were indicted in the US for conducting the 'WhisperGate' malware campaign targeting Ukraine’s critical infrastructure, emergency services, and agriculture prior to Russia’s 2022 invasion. The hackers posted private data of Ukrainians and illegally accessed NATO nations’ computer networks, including a significant breach of Poland’s transportation sector vital for weapon supply. The cyber unit ran false-flag operations impersonating groups such as Ukraine’s Right Sector and 'Anonymous Poland' to sow discord between Ukraine, Poland, and Western allies. They also attempted to discredit open-source investigative outlet Bellingcat via doxing and fake attributions. Unit 29155 hackers actively spread disinformation about Western biolabs and funded opposition groups. The team recruited external actors like Bulgarian journalist Dilyana Gaytandzhieva to publish hacked diplomatic data aimed at stirring international tensions, notably involving Azerbaijani weapons shipments and regional conflicts. Key figures include Timur 'Tim' Stigal, linked to cybercrime and fraud indictments in the US, who headed the hacking unit; his son Amin Stigal was also indicted but may be misidentified. The unit's cyber operations exemplify Russia’s hybrid warfare strategy combining covert cyber sabotage with disinformation to support military objectives in Ukraine and abroad. This revelation extends the understanding of Russia’s integrated use of lethal covert ops and cyberattacks ahead of and during wartime.
Confidence: High
The article explicitly identifies Russian GRU Unit 29155 hacking teams conducting hostile cyber operations against Ukraine and NATO countries, supported by a US indictment naming specific individuals and malware campaigns.
Source URL
https://theins.press/en/inv/281731
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "152782d5-ec26-48f4-bf9e-b04f9053fc1b",
"url": "https://theins.press/en/inv/281731",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Russian Federation",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"GRU",
"Unit 29155",
"WhisperGate",
"cyberattacks",
"Ukraine",
"NATO",
"Russian hybrid warfare",
"False-flag operations",
"Disinformation",
"Malware",
"Data theft",
"Poland",
"Bellingcat",
"Dilyana Gaytandzhieva",
"Eastern Europe",
"2022 Russia-Ukraine war",
"Espionage"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Hidden Bear: The GRU hackers of Russia’s most notorious kill squad",
"description": "Russian GRU Unit 29155, the Kremlin’s notorious black ops kill and sabotage squad implicated in multiple assassinations and sabotage attacks across Europe, operated a clandestine hacking team for at least a decade. This team conducted cyberattacks designated as 'WhisperGate,' aiming to digitally destabilize Ukraine in the lead-up to Russia's full-scale invasion in 2022 by deploying malware that wiped data from Ukrainian critical infrastructure and emergency sectors. The unit also hacked systems in 26 NATO countries, notably breaching Polish transportation networks critical for Western weapon flows to Kyiv. Their operations included false-flag cyberattacks impersonating Ukrainian ultranationalist and hacktivist groups to inflame tensions among allies. The Insider’s investigation, based on leaked emails, server logs, and social media data, identifies key operatives including Timur Stigal ('Key'), who coordinated cybercrime and espionage campaigns, and recruited other hackers. Stigal’s team disseminated false information, hacked Western targets like Bellingcat, and engaged external collaborators such as Bulgarian journalist Dilyana Gaytandzhieva to leak hacked diplomatic data related to Azerbaijani arms shipments linked to Syrian conflicts. The unit’s cyber activities exemplify Russia's broader hybrid warfare approach, blending lethal covert operations with cyber sabotage and strategic disinformation to support Kremlin geopolitical objectives.",
"summary_short": "Russian GRU Unit 29155, notorious for assassinations and sabotage, also operated a cyber hacking team conducting large-scale cyberattacks against Ukraine and NATO nations, as revealed by The Insider's investigation and confirmed by a 2024 US indictment.",
"summary_extended": "Russian military intelligence’s elite special operations unit, GRU Unit 29155, is widely known for assassinations and sabotage activities including the Salisbury poisonings and arms depot explosions in Europe. The Insider’s year-long investigation reveals for the first time that Unit 29155 also maintained a cyber hacking team active since 2012. In August 2024, six members of this hacking team were indicted in the US for conducting the 'WhisperGate' malware campaign targeting Ukraine’s critical infrastructure, emergency services, and agriculture prior to Russia’s 2022 invasion. The hackers posted private data of Ukrainians and illegally accessed NATO nations’ computer networks, including a significant breach of Poland’s transportation sector vital for weapon supply. The cyber unit ran false-flag operations impersonating groups such as Ukraine’s Right Sector and 'Anonymous Poland' to sow discord between Ukraine, Poland, and Western allies. They also attempted to discredit open-source investigative outlet Bellingcat via doxing and fake attributions. Unit 29155 hackers actively spread disinformation about Western biolabs and funded opposition groups. The team recruited external actors like Bulgarian journalist Dilyana Gaytandzhieva to publish hacked diplomatic data aimed at stirring international tensions, notably involving Azerbaijani weapons shipments and regional conflicts. Key figures include Timur 'Tim' Stigal, linked to cybercrime and fraud indictments in the US, who headed the hacking unit; his son Amin Stigal was also indicted but may be misidentified. The unit's cyber operations exemplify Russia’s hybrid warfare strategy combining covert cyber sabotage with disinformation to support military objectives in Ukraine and abroad. This revelation extends the understanding of Russia’s integrated use of lethal covert ops and cyberattacks ahead of and during wartime.",
"actor_primary": "Timur Stigal",
"target_primary": null,
"location_text": "Ukraine, Poland",
"location_region": null,
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Approximate",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly identifies Russian GRU Unit 29155 hacking teams conducting hostile cyber operations against Ukraine and NATO countries, supported by a US indictment naming specific individuals and malware campaigns.",
"event_time_utc": "2024-08-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T19:29:00.239Z",
"updated_at": "2026-11-10T02:44:22.357Z",
"reliability_band": "strong",
"location_precision_band": "approximate",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
B
Info credibility
3
Event time
Aug 1, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Ukraine, Poland
Primary actor
Timur Stigal
Country
Russian Federation
Countries
Russian Federation
Tags
GRU, Unit 29155, WhisperGate, cyberattacks, Ukraine, NATO, Russian hybrid warfare, False-flag operations, Disinformation, Malware, Data theft, Poland, Bellingcat, Dilyana Gaytandzhieva, Eastern Europe, 2022 Russia-Ukraine war, Espionage
Nodes
Node 1: Borders, Node 2: 5th Column