GRU Cyber Operations Targeting Ukraine and NATO Allies

GRU Cyber Operations Targeting Ukraine and NATO Allies

First seen 25 Aug 2026, 15:50 UTC www.gov.uk 76.0

Article Content

Browse articles
ThreatCluster

The UK government has published a report detailing the cyber and hybrid threat operations of the Russian GRU, specifically focusing on Unit 29155. This unit has been linked to various cyber-attacks against Ukraine, NATO, and other entities, employing tactics such as wiper malware like 'Whispergate'. The report highlights that Unit 29155's cyber division is composed of young recruits under experienced handlers, known for their disruptive operations. Notable incidents include the targeting of over 70 Ukrainian government systems prior to the invasion of Ukraine. The UK is collaborating with allies to counter these threats and support Ukraine in its ongoing conflict against Russia. The report indicates a persistent and coordinated effort by the GRU to use cyber capabilities as part of a broader hybrid warfare strategy.

Key Points: • GRU Unit 29155 conducts cyber operations against Ukraine and NATO. • The unit employs disruptive malware like 'Whispergate' in attacks. • The UK is working with allies to counter GRU's hybrid threats.

Timeline

2014-10-16
Vrbétice ammunition warehouse explosions
GRU Unit 29155 linked to explosions in Czechia, indicating their operational history.
www.gov.uk
2018-03-04
Skripal poisoning incident
GRU Unit 29155 involved in the attempted murder of Yulia and Sergei Skripal in Salisbury.
www.gov.uk
2021-12-01
Whispergate malware deployment
Unit 29155 deployed 'Whispergate' malware on over 70 Ukrainian government systems.
www.gov.uk
2022-02-24
Full-scale invasion of Ukraine
Russia launched a full-scale invasion of Ukraine, escalating cyber operations against various targets.
www.gov.uk
2026-08-25
UK report on GRU operations published
The UK government released a report detailing GRU's cyber and hybrid threat operations.
www.gov.uk