Cyber Threat Actor: GRU Unit 26165

The threat actor is known by the aliases GRU Unit 26165, Military Unit 26165 and GRU Unit 74455, and is publicly identified as a component of the Russian Main Intelligence Directorate (GRU). Operating from Russia, the unit has been charged by the United States Department of Justice for conducting international hacking and related influence operations. Its activities are characterized as state‑sponsored cyber espionage aimed at gathering sensitive information and supporting disinformation campaigns that advance Russian governmental interests.

The unit primarily targets organizations of strategic value to the Russian government, including international anti‑doping bodies, major sports federations such as FIFA, and aerospace and defense companies like Westinghouse Electric Company. These targets are selected to obtain confidential medical records, therapeutic use exemptions, anti‑doping strategies, and proprietary technical data that can be used to undermine perceived threats to Russian state interests. The strategic objectives observed in the attributed incidents are espionage for intelligence collection and influence operations designed to distort public narratives and discredit investigations into Russia’s state‑sponsored doping program.

In its operations the actor repeatedly uses spearphishing emails to harvest credentials, creates fraudulent domains that mimic legitimate organizations, and conducts network reconnaissance before moving laterally within victim environments. It also exploits wireless networks, notably compromising hotel Wi‑Fi connections during conferences and employing close‑access Wi‑Fi tactics at global events to gain initial access. After obtaining valid credentials, the unit deploys no publicly named malware family but relies on legitimate tools and stolen access to exfiltrate data, which is then weaponized through the false hacktivist persona “Fancy Bears’ Hack Team” to leak altered information and engage directly with journalists to amplify disinformation. Representative campaigns include the 2016 intrusion into the Canadian Centre for Ethics in Sport, the 2014 espionage against Westinghouse Electric Company, and the 2014‑2015 effort targeting FIFA and other anti‑doping agencies that resulted in the public release of manipulated medical records under the Fancy Bears banner.