GRU Unit 26165

GRU Unit 26165 is a cyber-operations unit of the 85th Main Special Service Center of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (commonly abbreviated GRU, formerly GU). It is widely identified by Western governments and private threat-intelligence firms with the activity clusters known as APT28, Fancy Bear, Sofacy, Sednit, and STRONTIUM.

The unit has been publicly attributed to several high-profile intrusion campaigns. In the July 2018 indictment by U.S. Special Counsel Robert Mueller (United States v. Netyksho et al.), seven officers of Unit 26165 were charged with hacking the Democratic National Committee, the Democratic Congressional Campaign Committee, and the Clinton presidential campaign during the 2016 U.S. election cycle. The same indictment described the unit's use of spearphishing, the X-Agent and X-Tunnel malware families, and bitcoin-funded infrastructure.

In October 2018, the Netherlands' Military Intelligence and Security Service (MIVD) publicly disclosed that it had disrupted an on-site close-access operation by Unit 26165 officers in The Hague targeting the Organisation for the Prohibition of Chemical Weapons (OPCW). The OPCW was at the time investigating the Salisbury Novichok poisoning and chemical attacks in Syria. The U.S. Department of Justice unsealed a parallel indictment of the same officers the same day.

Unit 26165 has also been linked by Western agencies to intrusions against:

• The World Anti-Doping Agency (WADA) and the Court of Arbitration for Sport, following Russia's doping suspension
• The German Bundestag (2015) and parliamentary networks elsewhere in Europe
• NATO, OSCE, and various foreign ministries and defense contractors
• A multi-year password-spraying campaign disclosed jointly by the NSA, CISA, FBI, and UK NCSC in July 2021

The unit is reported to be headquartered at Komsomolskiy Prospekt 20 in Moscow. It is frequently distinguished from GRU Unit 74455 (Sandworm), which focuses on more destructive operations such as NotPetya and attacks on Ukrainian electrical infrastructure.