Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Defence
  • /
  • UK and allies uncover Russian military unit carrying out cyber attacks and digital sabotage

Defence Security

UK and allies uncover Russian military unit carrying out cyber attacks and digital sabotage

The UK and international allies have exposed a unit of Russia’s military intelligence service for a campaign of malicious cyber activity and digital sabotage for the first time, targeting government and critical infrastructure organisations around the world.

Above: The National Cyber Security Centre (NCSC), Nova South, London.
Image by Simona Flamigni / copyright Shutterstock

In a new joint advisory, the National Cyber Security Centre (NCSC) – a part of GCHQ – and agencies in the United States, the Netherlands, Czech Republic, Germany, Estonia, Latvia, Canada, Australia and Ukraine have revealed the tactics and techniques used by Unit 29155 of the Russian GRU to carry out cyber operations globally.

Advertisement
ODU RT

Unit 29155 is assessed to have targeted organisations to collect information for espionage purposes, caused reputational harm by the theft and leaking of sensitive information, defaced victim websites and undertaken systematic sabotage caused by the destruction of data.

It is the first time the UK has publicly exposed Unit 29155, also designated as 161st Specialist Training Centre, as being responsible for carrying out malicious cyber activity, which it has undertaken since at least 2020.

Since 2022, the group’s overall aim seems to have been to target and disrupt efforts to provide aid to Ukraine. Today, the UK and allies can confirm that it was Unit 29155 specifically that was responsible for deploying the Whispergate malware against multiple victims across Ukraine prior to Russia’s invasion in 2022.

To prevent these malicious activities impacting UK organisations, the NCSC strongly advises network defenders to follow the recommended actions set out in the advisory to bolster their cyber resilience.

Paul Chichester, NCSC Director of Operations, said: “The exposure of Unit 29155 as a capable cyber actor illustrates the importance that Russian military intelligence places on using cyberspace to pursue its illegal war in Ukraine and other state priorities.

“The UK, alongside our partners, is committed to calling out Russian malicious cyber activity and will continue to do so.

“The NCSC strongly encourages organisations to follow the mitigation advice and guidance included in the advisory to help defend their networks.”

Advertisement
Amentum rectangle

The advisory says the Unit, which is assessed to be made up of junior active-duty GRU officers, also relies on non-GRU actors, including known cyber criminals and enablers to conduct their operations. The group differs to more established GRU-related cyber groups Unit 26165 (Fancy Bear) and Unit 74455 (Sandworm).

The NCSC has previously exposed details about malware operations used by cyber actors from Russia’s military intelligence to target the Ukrainian military and also called for organisations to take action following Russia’s attack on Ukraine.

In May 2022, the UK and allies attributed the use of Whispergate malware in Ukraine to Russia’s military intelligence service but this new advisory goes further by attributing its deployment specifically to Unit 29155.

The advisory also includes further analysis of the malware that was deployed to help network defenders identify malicious infrastructure.

The advisory has been co-sealed by the National Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the US National Security Agency (NSA), the US Department of the Treasury, the US Department of State (Rewards for Justice), the US Cyber Command Cyber National Mission Force (CNMF), the Netherlands Defence Intelligence and Security Service (MIVD), the Czech Military Intelligence (VZ), the Czech Republic Security Information Service (BIS), the German Federal Office for the Protection of the Constitution (BfV), the Estonian Internal Security Service (KAPO), the Latvian State Security Service (VDD), the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment Canada (CSE) and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).

The advisory can be read on the CISA website.

All on board with Babcock

Defence Events

All on board with Babcock

12 September 2025

Babcock recently hit the highway as it started a nationwide tour of the UK in a specially kitted out bus, where it is connecting with colleagues and highlighting the positive impact it is having on communities the length and breadth of Britain, as it ramps up recruitment.

GA-ASI and AeroVironment launch Switchblade 600 from MQ-9A UAS

Defence

GA-ASI and AeroVironment launch Switchblade 600 from MQ-9A UAS

11 September 2025

General Atomics Aeronautical Systems, Inc. (GA-ASI) and AeroVironment collaborated on the first ever air launch of a Switchblade 600 loitering munition (LM) from a GA-ASI Block 5 MQ-9A unmanned aircraft system (UAS).

Serco to continue support for US Navy submarines

Defence

Serco to continue support for US Navy submarines

11 September 2025

Serco has won a new indefinite-delivery/indefinite-quantity (IDIQ) contract to continue supporting the US Navy’s Submarine High Data Rate (SubHDR) antenna systems.

LTPA enhanced to unlock SME access and boost innovation

Defence

LTPA enhanced to unlock SME access and boost innovation

11 September 2025

QinetiQ and the Ministry of Defence (MoD) have agreed changes to the Long Term Partnering Agreement (LTPA) that will make it easier and cheaper for small and medium sized enterprises (SMEs) to use test and evaluation (T&E) capabilities across the UK.

Advertisement
Amentum rectangle
BAE Systems opens engineering facility in Minneapolis

Defence

BAE Systems opens engineering facility in Minneapolis

11 September 2025

BAE Systems has officially opened a 247,000-square-foot engineering and product development facility in Maple Grove, Minnesota, serving as a critical innovation hub focused on engineering and product development for the US military and its allies.

Ukrainian defence industry to gain support via ADS membership offer

Defence Events

Ukrainian defence industry to gain support via ADS membership offer

11 September 2025

In a world first, ADS is offering defence companies headquartered in Ukraine the opportunity to gain unparalled support through becoming members of the UK trade association for aerospace, defence, security and space.

Advertisement
Siemens rectangle