In a February 2026 publication, CheckFirst builds upon prior research to shed light on the elusive GRU Information Operations Troops (VIO) through the innovative use of phaleristics — the study of military decorations including insignia, patches, and pennants. The analysis of 118 such artifacts allowed researchers to identify at least fifteen specialized units within the VIO, split across encryption, cryptanalysis, computer network operations, and psychological operations. The VIO units, consolidated under Military Unit 55111 since around 2014, include known hacking groups such as APT28 (Unit 26165) and Sandworm (Unit 74455), alongside lesser-known units like 20766 and 48707. While satellite geolocation proved difficult due to lack of distinct infrastructure, corroborative OSINT from leaked data, Russian investigative journalism, social media, and other open sources helped approximate the units' sites across Russia. The report clarifies that these units likely evolved through structural reforms since the early 2000s and cautions that designations or missions may have changed. The formation of the VIO was officially acknowledged by Russian state media TASS in May 2014, motivated by concerns over cyber threats following Edward Snowden’s revelations. This research highlights a novel methodological approach to decode intelligence structures and improves understanding of Russia's hybrid warfare capabilities emanating from their intelligence apparatus. The report emphasizes the importance of protecting sensitive open-source contributors from potential Russian security reprisals.

In a February 2026 publication, CheckFirst builds upon prior research to shed light on the elusive GRU Information Operations Troops (VIO) through the innovative use of phaleristics — the study of military decorations including insignia, patches, and pennants. The analysis of 118 such artifacts allowed researchers to identify at least fifteen specialized units within the VIO, split across encryption, cryptanalysis, computer network operations, and psychological operations. The VIO units, consolidated under Military Unit 55111 since around 2014, include known hacking groups such as APT28 (Unit 26165) and Sandworm (Unit 74455), alongside lesser-known units like 20766 and 48707. While satellite geolocation proved difficult due to lack of distinct infrastructure, corroborative OSINT from leaked data, Russian investigative journalism, social media, and other open sources helped approximate the units' sites across Russia. The report clarifies that these units likely evolved through structural reforms since the early 2000s and cautions that designations or missions may have changed. The formation of the VIO was officially acknowledged by Russian state media TASS in May 2014, motivated by concerns over cyber threats following Edward Snowden’s revelations. This research highlights a novel methodological approach to decode intelligence structures and improves understanding of Russia's hybrid warfare capabilities emanating from their intelligence apparatus. The report emphasizes the importance of protecting sensitive open-source contributors from potential Russian security reprisals.