GRU Unit 26165
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 3 incidents
- Sources
- 0 sources
- First seen
- 2014-11-20
- Last seen
- 2016-09-19
- Updated
- 2026-10-14 00:41
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor is a Russian GRU unit known as GRU Unit 26165 (also referenced as Military Unit 26165 and GRU Unit 74455). It has conducted cyber espionage and influence operations targeting international anti‑doping organizations, sports governing bodies such as FIFA, and companies of strategic interest including Westinghouse Electric Company. The actor’s typical tactics involve spearphishing emails, the creation of fraudulent domains mimicking target organizations, and close‑access or hotel Wi‑Fi network compromises to steal credentials and infiltrate systems. Stolen data, including medical records and therapeutic use exemptions, has been weaponized through false hacktivist personas like the “Fancy Bears’ Hack Team” to leak altered information and discredit anti‑doping investigations. Attribution to the Russian GRU is established in publicly released U.S. charges. Notable operations include the 2016 compromise of the Canadian Centre for Ethics in Sport during an anti‑doping conference and the 2014 campaigns against Westinghouse and various anti‑doping entities that combined network reconnaissance, credential theft, and coordinated media outreach to support Russian state interests.
Incidents
Attributed incidents are available to members.
3 incidentsSources
Sources available to members: 0 sources.