Loading threat actor…
Unit 29155 is a sub-unit of Russia’s Main Directorate of the General Staff (GRU), also identified as the 161st Specialist Training Centre. It has long been associated with covert action and sabotage and has more recently been publicly linked to offensive cyber operations conducted since at least 2020. Public attributions describe the unit as distinct from other GRU cyber elements such as Unit 26165 and Unit 74455, while operating in support of Russian state objectives, particularly those connected to the war against Ukraine. Unit 29155 has been linked to cyber activity spanning espionage, sabotage, reputational harm, website defacement, destructive data attacks, and information theft followed by leaking of stolen material. Since early 2022, its cyber operations have been assessed as focusing in part on disrupting efforts to provide aid to Ukraine. The unit was specifically attributed with deploying WhisperGate against multiple Ukrainian organizations before Russia’s full-scale invasion in 2022. Victimology attributed to Unit 29155 includes government institutions and critical infrastructure organizations worldwide. Reported targeted sectors include government, energy, finance, transport, and healthcare. Confirmed country-specific targeting in the supplied facts includes Ukrainian organizations and Estonian government institutions. The unit has also been publicly tied to broader influence and foreign digital interference activity through Storm-1516, which French authorities said had been publicly attributed to Unit 29155. Beyond cyber operations, Unit 29155 has been linked in public reporting to clandestine sabotage and assassination activity, including the 2015 poisoning attempt against Emilian Gebrev in Bulgaria and the 2018 Skripal poisoning in the United Kingdom. Reporting cited in the supplied facts also alleges coordination between Unit 29155 and Russian defense-linked scientific institutes in connection with continued Novichok-related research and weaponization. Authorities have stated that Unit 29155 uses non-GRU actors, including cybercriminals and other enablers, to support operations. Separate reporting referenced links between Raspberry Robin activity and Unit 29155, indicating the unit may leverage intermediary criminal or semi-criminal access ecosystems as part of its tradecraft. Overall, Unit 29155 represents a Russian state sabotage and espionage capability that combines covert action, destructive cyber operations, and information effects in support of geopolitical objectives.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian military intelligence unit linked to cyberattacks, espionage, sabotage, and attacks on critical infrastructure, including operations against Estonian government institutions.
Parallel Russian military cyber-sabotage capability conducting espionage, sabotage, and disruption related to Ukraine and support to Ukraine.
Russian military intelligence unit publicly linked to the Storm-1516 disinformation operation.
Russian military intelligence-linked unit referenced as connected (via Raspberry Robin) to follow-on activity enabled by SocGholish-provided access; described in the content as part of state-sponsored operations targeting critical infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.