UK exposes and sanctions GRU Units 29155, 26165, and 74455 for cyber-attacks targeting Ukraine, NATO allies, and UK, including destructive malware and espionage operations supporting Russian military objectives.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

On 18 July 2025, the UK Foreign, Commonwealth & Development Office published a detailed profile of Russian GRU military intelligence cyber and hybrid threat operations. The GRU cyber units 29155, 26165, and 74455 have conducted extensive cyber operations targeting Ukraine, European allies, NATO members, and the UK. Unit 29155 specializes in disruptive and destructive attacks such as the WhisperGate malware deployed against Ukrainian government systems preceding the 2022 invasion, and previously associated with covert operations like the 2014 Czech ammunition depot explosions and the 2018 Salisbury Skripal poisoning attempt. Unit 26165 is sophisticated in cyber espionage and hack-and-leak campaigns targeting government entities including French, German, US, and EU institutions, with notable operations like the 2016 DNC hack and 2017 French presidential campaign email leaks. Unit 74455 focuses on destructive operations targeting critical infrastructure, including multiple attacks crippling Ukraine’s electricity grid in 2015-2016, the NotPetya global cyberattack of 2017, and recent attacks on Ukrainian telecommunications amid ongoing conflict. The UK has sanctioned dozens of GRU officers across these units and condemned their hybrid warfare tactics that integrate cyber operations with kinetic military strikes, causing widespread civilian and infrastructure damage. The report also describes GRU-linked influence activities in Africa via the African Initiative information operation and traces cyber interference in chemical weapons investigations linked to the Skripal poisoning case. The intelligence underscores the risk of redirection of these veteran cyber capabilities against NATO allies and calls for vigilance against Russian cyber threats.

Classification

Confidence: High

The source is an official UK government publication explicitly detailing hostile Russian GRU cyber and hybrid warfare operations targeting Ukraine, NATO members, and the UK, supported with concrete examples, attributions, and sanctions. There is no description of defensive preparations but thorough evidence of aggressor activity.

Source URL

https://gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations

Open source

Provenance

Publisher: hwt_web_submit
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 22:58 UTC
Event time: Jul 18, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "9106003a-2693-425d-b47e-57509cac1829",
  "url": "https://gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations",
  "source": "hwt_web_submit",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "GRU",
    "offensive cyber operations",
    "Russian military intelligence",
    "Ukraine",
    "NATO",
    "malware",
    "WhisperGate",
    "X-Agent",
    "NotPetya",
    "African Initiative",
    "hybrid warfare",
    "cyber sabotage",
    "Skripal poisoning",
    "sanctions"
  ],
  "nodes": [],
  "countries": [
    "United Kingdom"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The UK government detailed the operations of Russian GRU military intelligence cyber units 29155, 26165, and 74455, attributing a wide range of destructive, espionage, and hybrid cyber operations against Ukraine, NATO allies, European partners, and the UK. Key activities include the deployment of malware such as WhisperGate and X-Agent targeting Ukrainian government and military infrastructure, reconnaissance on civilian shelters in Mariupol and Kharkiv prior to Russian artillery strikes, cyber espionage targeting European political entities and foreign assistance to Ukraine, and widespread destructive attacks on critical national infrastructure including Ukraine's electricity grid. The UK has sanctioned multiple GRU units and officers for these cyber operations and highlighted their integration into Russia's hybrid warfare tactics. Additionally, GRU-linked entities conducted influence operations in Africa through the African Initiative agency. The report also highlights the attempted assassination of Yulia and Sergei Skripal by GRU Unit 29155, linking cyber operations by Units 26165 and 74455 to interfering with chemical weapons investigations.",
  "summary_short": "UK exposes and sanctions GRU Units 29155, 26165, and 74455 for cyber-attacks targeting Ukraine, NATO allies, and UK, including destructive malware and espionage operations supporting Russian military objectives.",
  "summary_extended": "On 18 July 2025, the UK Foreign, Commonwealth & Development Office published a detailed profile of Russian GRU military intelligence cyber and hybrid threat operations. The GRU cyber units 29155, 26165, and 74455 have conducted extensive cyber operations targeting Ukraine, European allies, NATO members, and the UK. Unit 29155 specializes in disruptive and destructive attacks such as the WhisperGate malware deployed against Ukrainian government systems preceding the 2022 invasion, and previously associated with covert operations like the 2014 Czech ammunition depot explosions and the 2018 Salisbury Skripal poisoning attempt. Unit 26165 is sophisticated in cyber espionage and hack-and-leak campaigns targeting government entities including French, German, US, and EU institutions, with notable operations like the 2016 DNC hack and 2017 French presidential campaign email leaks. Unit 74455 focuses on destructive operations targeting critical infrastructure, including multiple attacks crippling Ukraine’s electricity grid in 2015-2016, the NotPetya global cyberattack of 2017, and recent attacks on Ukrainian telecommunications amid ongoing conflict. The UK has sanctioned dozens of GRU officers across these units and condemned their hybrid warfare tactics that integrate cyber operations with kinetic military strikes, causing widespread civilian and infrastructure damage. The report also describes GRU-linked influence activities in Africa via the African Initiative information operation and traces cyber interference in chemical weapons investigations linked to the Skripal poisoning case. The intelligence underscores the risk of redirection of these veteran cyber capabilities against NATO allies and calls for vigilance against Russian cyber threats.",
  "actor_primary": "Unit 29155",
  "target_primary": null,
  "location_text": "Mariupol Theatre; Kharkiv 'Cold Mountain' metro; Ukraine's electricity grid; Kyivstar telecommunications network",
  "location_region": null,
  "location_coordinates_lat": 55.378051,
  "location_coordinates_lon": -3.435973,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The source is an official UK government publication explicitly detailing hostile Russian GRU cyber and hybrid warfare operations targeting Ukraine, NATO members, and the UK, supported with concrete examples, attributions, and sanctions. There is no description of defensive preparations but thorough evidence of aggressor activity.",
  "event_time_utc": "2025-07-18T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-01T00:14:40.159Z",
  "updated_at": "2026-11-08T22:58:33.796Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jul 18, 2025, 00:00 UTC

Event time confidence

pm24h

Location

Mariupol Theatre; Kharkiv 'Cold Mountain' metro; Ukraine's electricity grid; Kyivstar telecommunications network

Primary actor

Unit 29155

Country

United Kingdom

Countries

United Kingdom

Tags

GRU, offensive cyber operations, Russian military intelligence, Ukraine, NATO, malware, WhisperGate, X-Agent, NotPetya, African Initiative, hybrid warfare, cyber sabotage, Skripal poisoning, sanctions

Loading signal...

{ "id": "9106003a-2693-425d-b47e-57509cac1829", "url": "https://gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations/profile-gru-cyber-and-hybrid-threat-operations", "source": "hwt_web_submit", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "United Kingdom", "source_reliability": "B", "info_credibility": "3", "tags": [ "GRU", "offensive cyber operations", "Russian military intelligence", "Ukraine", "NATO", "malware", "WhisperGate", "X-Agent", "NotPetya", "African Initiative", "hybrid warfare", "cyber sabotage", "Skripal poisoning", "sanctions" ], "nodes": [], "countries": [ "United Kingdom" ], "where_text": "Cyberspace", "headline": null, "description": "The UK government detailed the operations of Russian GRU military intelligence cyber units 29155, 26165, and 74455, attributing a wide range of destructive, espionage, and hybrid cyber operations against Ukraine, NATO allies, European partners, and the UK. Key activities include the deployment of malware such as WhisperGate and X-Agent targeting Ukrainian government and military infrastructure, reconnaissance on civilian shelters in Mariupol and Kharkiv prior to Russian artillery strikes, cyber espionage targeting European political entities and foreign assistance to Ukraine, and widespread destructive attacks on critical national infrastructure including Ukraine's electricity grid. The UK has sanctioned multiple GRU units and officers for these cyber operations and highlighted their integration into Russia's hybrid warfare tactics. Additionally, GRU-linked entities conducted influence operations in Africa through the African Initiative agency. The report also highlights the attempted assassination of Yulia and Sergei Skripal by GRU Unit 29155, linking cyber operations by Units 26165 and 74455 to interfering with chemical weapons investigations.", "summary_short": "UK exposes and sanctions GRU Units 29155, 26165, and 74455 for cyber-attacks targeting Ukraine, NATO allies, and UK, including destructive malware and espionage operations supporting Russian military objectives.", "summary_extended": "On 18 July 2025, the UK Foreign, Commonwealth & Development Office published a detailed profile of Russian GRU military intelligence cyber and hybrid threat operations. The GRU cyber units 29155, 26165, and 74455 have conducted extensive cyber operations targeting Ukraine, European allies, NATO members, and the UK. Unit 29155 specializes in disruptive and destructive attacks such as the WhisperGate malware deployed against Ukrainian government systems preceding the 2022 invasion, and previously associated with covert operations like the 2014 Czech ammunition depot explosions and the 2018 Salisbury Skripal poisoning attempt. Unit 26165 is sophisticated in cyber espionage and hack-and-leak campaigns targeting government entities including French, German, US, and EU institutions, with notable operations like the 2016 DNC hack and 2017 French presidential campaign email leaks. Unit 74455 focuses on destructive operations targeting critical infrastructure, including multiple attacks crippling Ukraine’s electricity grid in 2015-2016, the NotPetya global cyberattack of 2017, and recent attacks on Ukrainian telecommunications amid ongoing conflict. The UK has sanctioned dozens of GRU officers across these units and condemned their hybrid warfare tactics that integrate cyber operations with kinetic military strikes, causing widespread civilian and infrastructure damage. The report also describes GRU-linked influence activities in Africa via the African Initiative information operation and traces cyber interference in chemical weapons investigations linked to the Skripal poisoning case. The intelligence underscores the risk of redirection of these veteran cyber capabilities against NATO allies and calls for vigilance against Russian cyber threats.", "actor_primary": "Unit 29155", "target_primary": null, "location_text": "Mariupol Theatre; Kharkiv 'Cold Mountain' metro; Ukraine's electricity grid; Kyivstar telecommunications network", "location_region": null, "location_coordinates_lat": 55.378051, "location_coordinates_lon": -3.435973, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The source is an official UK government publication explicitly detailing hostile Russian GRU cyber and hybrid warfare operations targeting Ukraine, NATO members, and the UK, supported with concrete examples, attributions, and sanctions. There is no description of defensive preparations but thorough evidence of aggressor activity.", "event_time_utc": "2025-07-18T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-01T00:14:40.159Z", "updated_at": "2026-11-08T22:58:33.796Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }