CheckFirst used OSINT and military medal analysis to map the structure and facilities of Russia's secretive GRU Information Operations Troops, revealing previously unclear infrastructure and aiding understanding of Russian covert information and cyber operations.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

On 9 February 2026, Check First published an investigative report authored by Floréane M. that sheds light on the infrastructure of Russia's military intelligence service's Information Operations Troops (VIO), also known as the GRU. Building on prior work examining the FSB's 16th Centre, the report combines traditional OSINT methods with phaleristics—the academic study of medals and military decorations—to analyze 118 photographs of insignia, patches, and pennants produced in honor of the GRU. This methodology provided an unprecedented view of the units comprising the VIO. Although the VIO has been publicly known since 2014, its structure remained unclear until now. The study aims to refine and update understanding of Russian intelligence operations, particularly amid the ongoing conflict with Ukraine and increasing Russian cyber and information warfare against European countries. The report also emphasizes that while offering a new point of view, it does not resolve all questions about the VIO's internal structure or operational details. Further investigations related to the GRU and other Russian intelligence agencies are planned. The report is part of Check First's broader efforts to combat disinformation and foreign influence manipulation.

Classification

Confidence: High

The signal reveals detailed infrastructure of a Russian military intelligence unit (GRU Information Operations Troops) actively engaged in covert information and cyber operations as part of ongoing aggressive hybrid warfare actions against Ukraine and European countries.

Source URL

https://checkfirst.network/unveiling-grus-information-operations-troops-with-osint-and-medals/

Open source

Provenance

Publisher: hwt_web_submit
Submitted: Feb 11, 2026, 10:48 UTC
Last updated: Nov 9, 2026, 06:58 UTC
Event time: Feb 9, 2026, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "bdee9a0c-1d08-4c30-8f77-e5524db013c1",
  "url": "https://checkfirst.network/unveiling-grus-information-operations-troops-with-osint-and-medals/",
  "source": "hwt_web_submit",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Russian Federation",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "russia",
    "disinformation",
    "hybrid warfare",
    "gru",
    "signals intelligence",
    "information operations",
    "osint",
    "phaleristics",
    "military intelligence",
    "offensive cyber operations",
    "covert action"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "CheckFirst conducted an OSINT and phaleristics investigation revealing the infrastructure of Russia's GRU Information Operations Troops (VIO). Using analysis of 118 photographs of military insignia, patches, and pennants honoring the GRU, researchers partially reconstructed the VIO's chain of command and identified most known facilities across Russian territory. The study builds on previous research on the FSB’s 16th Centre and improves understanding of Russian intelligence units involved in covert information and cyber operations, which are active amidst Russia's war against Ukraine and other European targets. The research highlights gaps in detailed unit structure, personnel numbers, and direct observable actions, with ongoing investigations planned.",
  "summary_short": "CheckFirst used OSINT and military medal analysis to map the structure and facilities of Russia's secretive GRU Information Operations Troops, revealing previously unclear infrastructure and aiding understanding of Russian covert information and cyber operations.",
  "summary_extended": "On 9 February 2026, Check First published an investigative report authored by Floréane M. that sheds light on the infrastructure of Russia's military intelligence service's Information Operations Troops (VIO), also known as the GRU. Building on prior work examining the FSB's 16th Centre, the report combines traditional OSINT methods with phaleristics—the academic study of medals and military decorations—to analyze 118 photographs of insignia, patches, and pennants produced in honor of the GRU. This methodology provided an unprecedented view of the units comprising the VIO. Although the VIO has been publicly known since 2014, its structure remained unclear until now. The study aims to refine and update understanding of Russian intelligence operations, particularly amid the ongoing conflict with Ukraine and increasing Russian cyber and information warfare against European countries. The report also emphasizes that while offering a new point of view, it does not resolve all questions about the VIO's internal structure or operational details. Further investigations related to the GRU and other Russian intelligence agencies are planned. The report is part of Check First's broader efforts to combat disinformation and foreign influence manipulation.",
  "actor_primary": "GRU Information Operations Troops",
  "target_primary": null,
  "location_text": "Russian Federation",
  "location_region": null,
  "location_coordinates_lat": 61.52401,
  "location_coordinates_lon": 105.318756,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The signal reveals detailed infrastructure of a Russian military intelligence unit (GRU Information Operations Troops) actively engaged in covert information and cyber operations as part of ongoing aggressive hybrid warfare actions against Ukraine and European countries.",
  "event_time_utc": "2026-02-09T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-11T10:48:00.034Z",
  "updated_at": "2026-11-09T06:58:21.434Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Feb 9, 2026, 00:00 UTC

Event time confidence

pm24h

Location

Russian Federation

Primary actor

GRU Information Operations Troops

Country

Russian Federation

Tags

russia, disinformation, hybrid warfare, gru, signals intelligence, information operations, osint, phaleristics, military intelligence, offensive cyber operations, covert action

Loading signal...

{ "id": "bdee9a0c-1d08-4c30-8f77-e5524db013c1", "url": "https://checkfirst.network/unveiling-grus-information-operations-troops-with-osint-and-medals/", "source": "hwt_web_submit", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Russian Federation", "source_reliability": "C", "info_credibility": "3", "tags": [ "russia", "disinformation", "hybrid warfare", "gru", "signals intelligence", "information operations", "osint", "phaleristics", "military intelligence", "offensive cyber operations", "covert action" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "CheckFirst conducted an OSINT and phaleristics investigation revealing the infrastructure of Russia's GRU Information Operations Troops (VIO). Using analysis of 118 photographs of military insignia, patches, and pennants honoring the GRU, researchers partially reconstructed the VIO's chain of command and identified most known facilities across Russian territory. The study builds on previous research on the FSB’s 16th Centre and improves understanding of Russian intelligence units involved in covert information and cyber operations, which are active amidst Russia's war against Ukraine and other European targets. The research highlights gaps in detailed unit structure, personnel numbers, and direct observable actions, with ongoing investigations planned.", "summary_short": "CheckFirst used OSINT and military medal analysis to map the structure and facilities of Russia's secretive GRU Information Operations Troops, revealing previously unclear infrastructure and aiding understanding of Russian covert information and cyber operations.", "summary_extended": "On 9 February 2026, Check First published an investigative report authored by Floréane M. that sheds light on the infrastructure of Russia's military intelligence service's Information Operations Troops (VIO), also known as the GRU. Building on prior work examining the FSB's 16th Centre, the report combines traditional OSINT methods with phaleristics—the academic study of medals and military decorations—to analyze 118 photographs of insignia, patches, and pennants produced in honor of the GRU. This methodology provided an unprecedented view of the units comprising the VIO. Although the VIO has been publicly known since 2014, its structure remained unclear until now. The study aims to refine and update understanding of Russian intelligence operations, particularly amid the ongoing conflict with Ukraine and increasing Russian cyber and information warfare against European countries. The report also emphasizes that while offering a new point of view, it does not resolve all questions about the VIO's internal structure or operational details. Further investigations related to the GRU and other Russian intelligence agencies are planned. The report is part of Check First's broader efforts to combat disinformation and foreign influence manipulation.", "actor_primary": "GRU Information Operations Troops", "target_primary": null, "location_text": "Russian Federation", "location_region": null, "location_coordinates_lat": 61.52401, "location_coordinates_lon": 105.318756, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The signal reveals detailed infrastructure of a Russian military intelligence unit (GRU Information Operations Troops) actively engaged in covert information and cyber operations as part of ongoing aggressive hybrid warfare actions against Ukraine and European countries.", "event_time_utc": "2026-02-09T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-11T10:48:00.034Z", "updated_at": "2026-11-09T06:58:21.434Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }