Cyber Threat Actor: Oleg Mikhaylovich Sotnikov

Oleg Mikhaylovich Sotnikov, known also by the alias associated with the GRU, is a threat actor based in Russia. Public attribution links him to the Russian Main Intelligence Directorate (GRU), the country's military intelligence service. He operates as part of a state‑sponsored cyber unit that conducts espionage and influence operations against targets of strategic interest to Moscow. His activities are carried out under the direction of the GRU and are consistent with the broader pattern of Russian state cyber campaigns.

His targeting has focused on international anti‑doping organizations and sports governing bodies, exemplified by the compromise of FIFA and related anti‑doping agencies. The strategic objective of these operations is to gather confidential medical records, therapeutic use exemptions and anti‑doping strategies, and then to weaponize the stolen data in disinformation campaigns aimed at undermining investigations into Russia's state‑sponsored doping program. Observed tactics include spearphishing messages designed to harvest credentials, close‑access Wi‑Fi compromises during major sporting events, and the creation of false hacktivist personas such as 'Fancy Bears' Hack Team' to leak altered data. Additionally, the actor has engaged in direct outreach to journalists to amplify fabricated narratives about athlete drug use, thereby extending the impact of the cyber intrusion into the information sphere.

The 2014‑11‑20 operation against anti‑doping entities stands as a representative example of his tradecraft, illustrating how cyber espionage is coupled with coordinated influence efforts. In that campaign, stolen information was modified and released under a fabricated hacker identity to shape public discourse and distract from allegations of state‑sponsored doping. This case demonstrates the actor's reliance on social engineering, wireless intrusion and media manipulation to achieve strategic goals set by the GRU.