Loading signal...
Signal
Submitted
Feb 1, 2026, 00:14 UTC
On 5 September 2024, Estonia officially attributed the 2020 cyberattacks against its institutions to Russia’s military intelligence (GRU), marking the first time Estonia publicly named the perpetrator state.
On 5 September 2024, Estonia attributed the 2020 cyberattacks against three Estonian ministries and national IT infrastructure to Unit 29155 of Russia's military intelligence (GRU). This is the first public attribution by Estonia directly naming Russia as the perpetrator state. The Prosecutor's Office has sought the arrest of three GRU officers internationally based on an arrest warrant issued by the Harju County Court. Estonia's security agencies also supported a related US investigation into more extensive cyberattacks. Foreign Minister Margus Tsahkna condemned the malicious cyber activity as premeditated and aimed at damaging national systems and security. Estonia emphasized its commitment to cooperate with international partners to reinforce cybersecurity and uphold international law in cyberspace. Tanel Sepp, Director General of the Cyber Diplomacy Department, highlighted the difficulty of attribution in cyberspace but stressed the clarity and importance of this action. The attribution followed a national and international investigation involving ten countries. The joint press statement was issued by Estonia's Prosecutor's Office, Internal Security Service, and Police and Border Guard Board, supplemented by a US Department of Justice statement charging five Russian GRU officers and one civilian in related cyber operations.
Confidence: High
The event clearly describes Estonia's official attribution of hostile Russian military intelligence cyberattacks against Estonian government ministries and infrastructure, naming specific GRU units and personnel. The event includes legal actions against perpetrators and cooperation with international partners, evidencing clear aggressor activity by Russia.
Source URL
https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "64035e4b-dddf-477c-b988-ab0012542de1",
"url": "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks",
"source": "csv-import",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Estonia",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Estonia",
"Russia",
"GRU",
"Unit 29155",
"cyberattacks",
"Cyber attribution",
"Prosecutor's Office",
"International arrest warrant",
"offensive cyber operations",
"foreign ministers",
"Tanel Sepp",
"US Department of Justice",
"Cooperation"
],
"nodes": [],
"countries": [
"Estonia"
],
"where_text": "Cyberspace",
"headline": "Estonia names Russia’s military intelligence in a first-ever attribution of cyberattacks",
"description": "Estonia publicly attributed the 2020 cyberattacks that targeted three Estonian ministries and national IT infrastructure to the Russian military intelligence unit 29155 (GRU) on 5 September 2024. The Prosecutor's Office has issued an international arrest warrant for three GRU officers involved in these attacks. Estonia's security services also cooperated with a US investigation into related cyberattacks. Foreign Minister Margus Tsahkna condemned Russia’s cyber activities as malicious and premeditated attacks against Estonia's national security and emphasized holding Russia accountable. Estonia reaffirmed its commitment to international cooperation and the rule of law in cyberspace. The attribution followed a combined national and international investigation involving 10 countries. Tanel Sepp of the Cyber Diplomacy Department emphasized the operational message that cyberspace is not lawless and highlighted ongoing cooperation with partners to identify perpetrators.",
"summary_short": "On 5 September 2024, Estonia officially attributed the 2020 cyberattacks against its institutions to Russia’s military intelligence (GRU), marking the first time Estonia publicly named the perpetrator state.",
"summary_extended": "On 5 September 2024, Estonia attributed the 2020 cyberattacks against three Estonian ministries and national IT infrastructure to Unit 29155 of Russia's military intelligence (GRU). This is the first public attribution by Estonia directly naming Russia as the perpetrator state. The Prosecutor's Office has sought the arrest of three GRU officers internationally based on an arrest warrant issued by the Harju County Court. Estonia's security agencies also supported a related US investigation into more extensive cyberattacks. Foreign Minister Margus Tsahkna condemned the malicious cyber activity as premeditated and aimed at damaging national systems and security. Estonia emphasized its commitment to cooperate with international partners to reinforce cybersecurity and uphold international law in cyberspace. Tanel Sepp, Director General of the Cyber Diplomacy Department, highlighted the difficulty of attribution in cyberspace but stressed the clarity and importance of this action. The attribution followed a national and international investigation involving ten countries. The joint press statement was issued by Estonia's Prosecutor's Office, Internal Security Service, and Police and Border Guard Board, supplemented by a US Department of Justice statement charging five Russian GRU officers and one civilian in related cyber operations.",
"actor_primary": "Unit 29155 of Russia’s military intelligence (GRU)",
"target_primary": null,
"location_text": "Estonia",
"location_region": null,
"location_coordinates_lat": 58.595272,
"location_coordinates_lon": 25.013607,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event clearly describes Estonia's official attribution of hostile Russian military intelligence cyberattacks against Estonian government ministries and infrastructure, naming specific GRU units and personnel. The event includes legal actions against perpetrators and cooperation with international partners, evidencing clear aggressor activity by Russia.",
"event_time_utc": "2024-09-05T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-02-01T00:14:34.879Z",
"updated_at": "2026-11-08T23:47:39.347Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Sep 5, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Estonia
Primary actor
Unit 29155 of Russia’s military intelligence (GRU)
Country
Estonia
Countries
Estonia
Tags
Estonia, Russia, GRU, Unit 29155, cyberattacks, Cyber attribution, Prosecutor's Office, International arrest warrant, offensive cyber operations, foreign ministers, Tanel Sepp, US Department of Justice, Cooperation
Signal
Submitted
Feb 1, 2026, 00:14 UTC
On 5 September 2024, Estonia officially attributed the 2020 cyberattacks against its institutions to Russia’s military intelligence (GRU), marking the first time Estonia publicly named the perpetrator state.
On 5 September 2024, Estonia attributed the 2020 cyberattacks against three Estonian ministries and national IT infrastructure to Unit 29155 of Russia's military intelligence (GRU). This is the first public attribution by Estonia directly naming Russia as the perpetrator state. The Prosecutor's Office has sought the arrest of three GRU officers internationally based on an arrest warrant issued by the Harju County Court. Estonia's security agencies also supported a related US investigation into more extensive cyberattacks. Foreign Minister Margus Tsahkna condemned the malicious cyber activity as premeditated and aimed at damaging national systems and security. Estonia emphasized its commitment to cooperate with international partners to reinforce cybersecurity and uphold international law in cyberspace. Tanel Sepp, Director General of the Cyber Diplomacy Department, highlighted the difficulty of attribution in cyberspace but stressed the clarity and importance of this action. The attribution followed a national and international investigation involving ten countries. The joint press statement was issued by Estonia's Prosecutor's Office, Internal Security Service, and Police and Border Guard Board, supplemented by a US Department of Justice statement charging five Russian GRU officers and one civilian in related cyber operations.
Confidence: High
The event clearly describes Estonia's official attribution of hostile Russian military intelligence cyberattacks against Estonian government ministries and infrastructure, naming specific GRU units and personnel. The event includes legal actions against perpetrators and cooperation with international partners, evidencing clear aggressor activity by Russia.
Source URL
https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "64035e4b-dddf-477c-b988-ab0012542de1",
"url": "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks",
"source": "csv-import",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Estonia",
"source_reliability": "C",
"info_credibility": "3",
"tags": [
"Estonia",
"Russia",
"GRU",
"Unit 29155",
"cyberattacks",
"Cyber attribution",
"Prosecutor's Office",
"International arrest warrant",
"offensive cyber operations",
"foreign ministers",
"Tanel Sepp",
"US Department of Justice",
"Cooperation"
],
"nodes": [],
"countries": [
"Estonia"
],
"where_text": "Cyberspace",
"headline": "Estonia names Russia’s military intelligence in a first-ever attribution of cyberattacks",
"description": "Estonia publicly attributed the 2020 cyberattacks that targeted three Estonian ministries and national IT infrastructure to the Russian military intelligence unit 29155 (GRU) on 5 September 2024. The Prosecutor's Office has issued an international arrest warrant for three GRU officers involved in these attacks. Estonia's security services also cooperated with a US investigation into related cyberattacks. Foreign Minister Margus Tsahkna condemned Russia’s cyber activities as malicious and premeditated attacks against Estonia's national security and emphasized holding Russia accountable. Estonia reaffirmed its commitment to international cooperation and the rule of law in cyberspace. The attribution followed a combined national and international investigation involving 10 countries. Tanel Sepp of the Cyber Diplomacy Department emphasized the operational message that cyberspace is not lawless and highlighted ongoing cooperation with partners to identify perpetrators.",
"summary_short": "On 5 September 2024, Estonia officially attributed the 2020 cyberattacks against its institutions to Russia’s military intelligence (GRU), marking the first time Estonia publicly named the perpetrator state.",
"summary_extended": "On 5 September 2024, Estonia attributed the 2020 cyberattacks against three Estonian ministries and national IT infrastructure to Unit 29155 of Russia's military intelligence (GRU). This is the first public attribution by Estonia directly naming Russia as the perpetrator state. The Prosecutor's Office has sought the arrest of three GRU officers internationally based on an arrest warrant issued by the Harju County Court. Estonia's security agencies also supported a related US investigation into more extensive cyberattacks. Foreign Minister Margus Tsahkna condemned the malicious cyber activity as premeditated and aimed at damaging national systems and security. Estonia emphasized its commitment to cooperate with international partners to reinforce cybersecurity and uphold international law in cyberspace. Tanel Sepp, Director General of the Cyber Diplomacy Department, highlighted the difficulty of attribution in cyberspace but stressed the clarity and importance of this action. The attribution followed a national and international investigation involving ten countries. The joint press statement was issued by Estonia's Prosecutor's Office, Internal Security Service, and Police and Border Guard Board, supplemented by a US Department of Justice statement charging five Russian GRU officers and one civilian in related cyber operations.",
"actor_primary": "Unit 29155 of Russia’s military intelligence (GRU)",
"target_primary": null,
"location_text": "Estonia",
"location_region": null,
"location_coordinates_lat": 58.595272,
"location_coordinates_lon": 25.013607,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The event clearly describes Estonia's official attribution of hostile Russian military intelligence cyberattacks against Estonian government ministries and infrastructure, naming specific GRU units and personnel. The event includes legal actions against perpetrators and cooperation with international partners, evidencing clear aggressor activity by Russia.",
"event_time_utc": "2024-09-05T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-02-01T00:14:34.879Z",
"updated_at": "2026-11-08T23:47:39.347Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
C
Info credibility
3
Event time
Sep 5, 2024, 00:00 UTC
Event time confidence
pm24h
Location
Estonia
Primary actor
Unit 29155 of Russia’s military intelligence (GRU)
Country
Estonia
Countries
Estonia
Tags
Estonia, Russia, GRU, Unit 29155, cyberattacks, Cyber attribution, Prosecutor's Office, International arrest warrant, offensive cyber operations, foreign ministers, Tanel Sepp, US Department of Justice, Cooperation