Name

Identifying information

Reasons

Date of listing

▼M4

1.

GAO Qiang

Date of birth: 4 October 1983

Place of birth: Shandong Province, China

Address: Room 1102, Guanfu Mansion, 46 Xinkai Road, Hedong District, Tianjin, China

Nationality: Chinese

Gender: male

Gao Qiang is involved in ‘Operation Cloud Hopper’, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

‘Operation Cloud Hopper’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as ‘APT10’ (‘Advanced Persistent Threat 10’) (a.k.a. ‘Red Apollo’, ‘CVNX’, ‘Stone Panda’, ‘MenuPass’ and ‘Potassium’) carried out ‘Operation Cloud Hopper’.

Gao Qiang can be linked to APT10, including through his association with APT10 command and control infrastructure. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating ‘Operation Cloud Hopper’, employed Gao Qiang. He has links with Zhang Shilong, who is also designated in connection with ‘Operation Cloud Hopper’. Gao Qiang is therefore associated with both Huaying Haitai and Zhang Shilong.

30.7.2020

2.

ZHANG Shilong

Date of birth: 10 September 1981

Place of birth: China

Address: Hedong, Yuyang Road No 121, Tianjin, China

Nationality: Chinese

Gender: male

Zhang Shilong is involved in ‘Operation Cloud Hopper’, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

‘Operation Cloud Hopper’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as ‘APT10’ (‘Advanced Persistent Threat 10’) (a.k.a. ‘Red Apollo’, ‘CVNX’, ‘Stone Panda’, ‘MenuPass’ and ‘Potassium’) carried out ‘Operation Cloud Hopper’.

Zhang Shilong can be linked to APT10, including through the malware he developed and tested in connection with the cyber-attacks carried out by APT10. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating ‘Operation Cloud Hopper’, employed Zhang Shilong. He has links with Gao Qiang, who is also designated in connection with ‘Operation Cloud Hopper’. Zhang Shilong is therefore associated with both Huaying Haitai and Gao Qiang.

30.7.2020

▼M9

3.

Alexey Valeryevich MININ

Алексей Валерьевич МИНИН

Date of birth: 27.5.1972

Place of birth: Perm Oblast, Russian SFSR (now Russian Federation)

Passport number: 120017582

Issued by: Ministry of Foreign Affairs of the Russian Federation

Validity: from 17.4.2017 until 17.4.2022

Location: Moscow, Russian Federation

Nationality: Russian

Gender: male

Alexey Minin took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands and in cyber-attacks with a significant effect against third States.

As a human intelligence support officer of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Alexey Minin was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.

A grand jury in the Western District of Pennsylvania (United States of America) has indicted Alexey Minin, as an officer of the Russian Main Intelligence Directorate (GRU), for computer hacking, wire fraud, aggravated identity theft and money laundering.

30.7.2020

4.

Aleksei Sergeyvich MORENETS

Алексей Сергеевич МОРЕНЕЦ

Date of birth: 31.7.1977

Place of birth: Murmanskaya Oblast, Russian SFSR (now Russian Federation)

Passport number: 100135556

Issued by: Ministry of Foreign Affairs of the Russian Federation

Validity: from 17.4.2017 until 17.4.2022

Location: Moscow, Russian Federation

Nationality: Russian

Gender: male

Aleksei Morenets took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands and in cyber-attacks with a significant effect against third States.

As a cyber-operator for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Aleksei Morenets was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.

A grand jury in the Western District of Pennsylvania (United States of America) has indicted Aleksei Morenets, as assigned to Military Unit 26165, for computer hacking, wire fraud, aggravated identity theft and money laundering.

30.7.2020

5.

Evgenii Mikhaylovich SEREBRIAKOV

Евгений Михайлович СЕРЕБРЯКОВ

Date of birth: 26.7.1981

Place of birth: Kursk, Russian SFSR (now Russian Federation)

Passport number: 100135555

Issued by: Ministry of Foreign Affairs of the Russian Federation

Validity: from 17.4.2017 until 17.4.2022

Location: Moscow, Russian Federation

Nationality: Russian

Gender: male

Evgenii Serebriakov took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands and in cyber-attacks with a significant effect against third States.

As a cyber-operator for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Evgenii Serebriakov was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.

Since spring 2022, Evgenii Serebriakov is leading ‘Sandworm’ (a.k.a. ‘Sandworm Team’, ‘BlackEnergy Group’, ‘Voodoo Bear’, ‘Quedagh’, ‘Olympic Destroyer’ and ‘Telebots’), an actor and hacking group affiliated with Unit 74455 of the Russian Main Intelligence Directorate. Sandworm has carried out cyber-attacks on Ukraine, including Ukrainian government agencies, following Russia’s war of aggression against Ukraine.

30.7.2020

6.

Oleg Mikhaylovich SOTNIKOV

Олег Михайлович СОТНИКОВ

Date of birth: 24.8.1972

Place of birth: Ulyanovsk, Russian SFSR (now Russian Federation)

Passport number: 120018866

Issued by: Ministry of Foreign Affairs of the Russian Federation

Validity: from 17.4.2017 until 17.4.2022

Location: Moscow, Russian Federation

Nationality: Russian

Gender: male

Oleg Sotnikov took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands and in cyber-attacks with a significant effect against third States.

As a human intelligence support officer of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Oleg Sotnikov was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (Militaire Inlichtingen- en Veiligheidsdienst) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.

A grand jury in the Western District of Pennsylvania has indicted Oleg Sotnikov, as an officer of the Russian Main Intelligence Directorate (GRU), for computer hacking, wire fraud, aggravated identity theft and money laundering.

30.7.2020

7.

Dmitry Sergeyevich BADIN

Дмитрий Сергеевич БАДИН

Date of birth: 15.11.1990

Place of birth: Kursk, Russian SFSR (now Russian Federation)

Nationality: Russian

Gender: male

Dmitry Badin took part in a cyber-attack with a significant effect against the German federal parliament (Deutscher Bundestag) and in cyber-attacks with a significant effect against third States.

As a military intelligence officer of the 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Dmitry Badin was part of a team of Russian military intelligence officers who conducted a cyber-attack against the German federal parliament in April and May 2015. That cyber-attack targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and the email accounts of several MPs, as well as of former Chancellor Angela Merkel, were affected.

A grand jury in the Western District of Pennsylvania (United States of America) has indicted Dmitry Badin, as assigned to Military Unit 26165, for computer hacking, wire fraud, aggravated identity theft and money laundering.

22.10.2020

8.

Igor Olegovich KOSTYUKOV

Игорь Олегович КОСТЮКОВ

Date of birth: 21.2.1961

Nationality: Russian

Gender: male

Igor Kostyukov is the current Head of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), where he previously served as First Deputy Head. One of the units under his command is the 85th Main Centre for Special Services (GTsSS) (a.k.a. ‘Military Unit 26165’, ‘APT28’, ‘Fancy Bear’, ‘Sofacy Group’, ‘Pawn Storm’ and ‘Strontium’).

In this capacity, Igor Kostyukov is responsible for cyber-attacks carried out by the GTsSS, including those with a significant effect constituting an external threat to the Union or its Member States.

In particular, military intelligence officers of the GTsSS took part in the cyber-attack against the German federal parliament (Deutscher Bundestag) in April and May 2015 and the attempted cyber-attack aimed at hacking into the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands in April 2018.

The cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and email accounts of several MPs, as well as of former Chancellor Angela Merkel, were affected.

22.10.2020

▼M10

9.

Ruslan Aleksandrovich PERETYATKO

Руслан Александрович ПЕРЕТЯТЬКО

Date of birth: 3.8.1985

Nationality: Russian

Gender: Male

Ruslan Peretyatko took part in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

►C2  Ruslan Peretyatko is part of the “Callisto group” of Russian intelligence officers conducting cyber operations against EU Member States and third states. ◄

Callisto Group (a.k.a. ‘Seaborgium’, ‘Star Blizzard’, ‘ColdRiver’, ‘TA446’) has launched multi-year phishing campaigns used to steal account credentials and data. Furthermore, the Callisto group is responsible for campaigns targeting individuals and critical state functions, including in the areas of defence and external relations.

Therefore, Ruslan Peretyatko is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

10.

Andrey Stanislavovich KORINETS

Андрей Станиславович КОРИНЕЦ

Date of birth: 18.5.1987

Place of birth: City of Syktyvkar, Russia

Nationality: Russian

Gender: Male

Andrey Stanislavovich Korinets took part in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

Andrey Stanislavovich Korinets is an officer of ‘Center 18’ of the Federal Security Service (FSB) of the Russian Federation. ►C2  Andrey Stanislavovich Korinets is part of the “Callisto group” of Russian intelligence officers conducting cyber operations against EU Member States and third states. ◄

Callisto Group (a.k.a. ‘Seaborgium’, ‘Star Blizzard’, ‘ColdRiver’, ‘TA446’) has launched multi-year phishing campaigns used to steal account credentials and data. Furthermore, the Callisto group is responsible for campaigns targeting individuals and critical state functions, including in the areas of defence and external relations.

Therefore, Andrey Stanislavovich Korinets is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

11.

Oleksandr SKLIANKO

Александр СКЛЯНКО (Russian spelling)

Олександр СКЛЯНКО (Ukrainian spelling)

Date of birth: 5.8.1973

Passport: EC 867868, issued on 27.11.1998 (Ukraine)

Gender: male

Oleksandr Sklianko took part in cyberattacks with a significant effect against EU Member States, as well as cyberattacks with a significant effect against third states.

Oleksandr Sklianko is part of the ‘Armageddon’ hacker group supported by the Federal Security Service (FSB) of the Russian Federation that carried out various cyberattacks with a significant effect on the government of Ukraine and on EU Member States and their government officials, including by using phishing emails and malware campaigns.

Therefore, Oleksandr Sklianko is involved in cyberattacks with a significant effect against third states, as well as in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

12.

Mykola CHERNYKH

Николай ЧЕРНЫХ (Russian spelling)

Микола ЧЕРНИХ (Ukrainian spelling)

Date of birth: 12.10.1978

Passport: EC 922162, issued on 20.01.1999 (Ukraine)

Gender: male

Mykola Chernykh took part in cyberattacks with a significant effect against EU Member States, as well as cyberattacks with a significant effect against third states.

Mykola Chernykh is part of the ‘Armageddon’ hacker group supported by the Federal Security Service (FSB) of the Russian Federation that carried out various cyberattacks with a significant effect on the government of Ukraine and on EU Member States and their government officials, including by using phishing emails and malware campaigns.

As a former employee of the Security Service of Ukraine, he is charged in Ukraine with treason and unauthorised interference in the operation of electronic computing machines and automated systems.

Therefore, Mykola Chernykh is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

13.

Mikhail Mikhailovich TSAREV

Михаил Михайлович ЦАРЕВ

Date of birth: 20.4.1989

Place of birth: Serpukhov, Russian Federation

Nationality: Russian

Address: Serpukhov

Gender: male

Mikhail Mikhailovich Tsarev took part in cyberattacks with a significant effect, which constitute an external threat to EU Member States.

Mikhail Mikhailovich Tsarev, also known by the online monikers ‘Mango’, ‘Alexander Grachev’, ‘Super Misha’, ‘Ivanov Mixail’, ‘Misha Krutysha’, and ‘Nikita Andreevich Tsarev’ is a key-player in the deployment of the ‘Conti’ and ‘Trickbot’ malware programs and is involved in the Russia-based threat group ‘Wizard Spider’.

The Conti and Trickbot malware programs were created and developed by Wizard Spider. Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking. The group has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, ‘Ryuk’ and TrickBot, are responsible for substantial economic damage in the European Union.

Mikhail Mikhailovich Tsarev is therefore involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

14.

Maksim Sergeevich GALOCHKIN

Максим Сергеевич ГАЛОЧКИН

Date of birth: 19.5.1982

Place of birth: Abakan, Russian Federation

Nationality: Russian

Gender: male

Maksim Galochkin took part in cyberattacks with a significant effect, which constitute an external threat to EU Member States.

Maksim Galochkin is also known by the online monikers ‘Benalen’, ‘Bentley’, ‘Volhvb’, ‘volhvb’, ‘manuel’, ‘Max17’ and ‘Crypt’. Galochkin is a key player in the deployment of the ‘Conti’ and ‘Trickbot’ malware programs and is involved in the Russia-based threat group ‘Wizard Spider’. He has led a group of testers, with responsibilities for the development, supervision, and implementation of tests for the TrickBot malware program, created and deployed by Wizard Spider.

Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking. The group has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, ‘Ryuk’ and TrickBot, are responsible for substantial economic damage in the European Union.

Maksim Galochkin is therefore involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

▼M11

15.

Nikolay Alexandrovich KORCHAGIN

Николай Александрович Корчагин

Date of birth: 16.9.1997

Nationality: Russian

Gender: male

Associated entity: Main Directorate of the General Staff of the Armed Forces of the Russian Federation

Nikolay Korchagin is involved in and responsible for cyber-attacks with a significant effect by conducting intelligence activities directed against Estonia and gaining access to a computer system illegally.

Nikolay Korchagin is an officer of military unit 29155 of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). In that role, he is involved in and responsible for cyber-attacks against computer systems with the aim of collecting data from the data systems of multiple institutions, which independently or in combination, give an overview of the cyber security policy of Estonia, the cyber capabilities of the state, sensitive personal data and other sensitive data, with the aim of using the data to threaten the security of Estonia. The attacks therefore concern the storage of classified information. The attacks concerned allies and partners of Estonia.

Therefore, Nikolay Korchagin is involved in and responsible for cyber-attacks with a significant effect which constitute an external threat to a Member State.

27.1.2025

16.

Vitaly SHEVCHENKO

Виталий Шевченко

Date of birth: 1.9.1997

Nationality: Russian

Gender: male

Associated entity: Main Directorate of the General Staff of the Armed Forces of the Russian Federation

Vitaly Shevchenko is involved in and responsible for cyber-attacks with a significant effect by conducting intelligence activities directed against Estonia and gaining access to a computer system illegally.

Vitaly Shevchenko is an officer of military unit 29155 of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). In that role, he is involved in and responsible for cyber-attacks against computer systems with the aim of collecting data from the data systems of multiple institutions, which independently or in combination, give an overview of the cyber security policy of Estonia, the cyber capabilities of the state, sensitive personal data and other sensitive data, with the aim of using the data to threaten the security of Estonia. The attacks therefore concern the storage of classified information. The attacks concerned allies and partners of Estonia.

Therefore, Vitaly Shevchenko is involved in and responsible for cyber-attacks with a significant effect which constitute an external threat to a Member State.

27.1.2025

17.

Yuriy Fedorovich DENISOV

Юрий Федорович Денисов

Date of birth: 17.6.1980

Nationality: Russian

Gender: male

Associated entity: Main Directorate of the General Staff of the Armed Forces of the Russian Federation

Yuriy Denisov is involved in and responsible for cyber-attacks with a significant effect by conducting intelligence activities directed against Estonia and gaining access to a computer system illegally.

Yuriy Denisov is an officer of military unit 29155 of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). In that role, he is involved in and responsible for cyber-attacks against computer systems with the aim of collecting data from the data systems of multiple institutions, which independently or in combination, give an overview of the cyber security policy of Estonia, the cyber capabilities of the state, sensitive personal data and other sensitive data, with the aim of using the data to threaten the security of Estonia. The attacks therefore concern the storage of classified information. The attacks concerned allies and partners of Estonia.

Therefore, Yuriy Denisov is involved in and responsible for cyber-attacks with a significant effect which constitute an external threat to a Member State.

27.1.2025

▼M2

Name

Identifying information

Reasons

Date of listing

1.

Tianjin Huaying Haitai Science and Technology Development Co. Ltd (Huaying Haitai)

a.k.a.: Haitai Technology Development Co. Ltd

Location: Tianjin, China

Huaying Haitai provided financial, technical or material support for and facilitated ‘Operation Cloud Hopper’, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

‘Operation Cloud Hopper’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as ‘APT10’ (‘Advanced Persistent Threat 10’) (a.k.a. ‘Red Apollo’, ‘CVNX’, ‘Stone Panda’, ‘MenuPass’ and ‘Potassium’) carried out ‘Operation Cloud Hopper’.

Huaying Haitai can be linked to APT10. Moreover, Huaying Haitai employed Gao Qiang and Zhang Shilong, who are both designated in connection with ‘Operation Cloud Hopper’. Huaying Haitai is therefore associated with Gao Qiang and Zhang Shilong.

30.7.2020

2.

Chosun Expo

a.k.a.: Chosen Expo; Korea Export Joint Venture

Location: DPRK

Chosun Expo provided financial, technical or material support for and facilitated a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘WannaCry’ and cyber-attacks against the Polish Financial Supervision Authority and Sony Pictures Entertainment, as well as cyber-theft from the Bangladesh Bank and attempted cyber-theft from the Vietnam Tien Phong Bank.

‘WannaCry’ disrupted information systems around the world by targeting information systems with ransomware and blocking access to data. It affected information systems of companies in the Union, including information systems relating to services necessary for the maintenance of essential services and economic activities within Member States.

The actor publicly known as ‘APT38’ (‘Advanced Persistent Threat 38’) or the ‘Lazarus Group’ carried out ‘WannaCry’.

Chosun Expo can be linked to APT38/the Lazarus Group, including through the accounts used for the cyber-attacks.

30.7.2020

▼M9

3.

Main Centre for Special Technologies (GTsST) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU)

Address: 22 Kirova Street, Moscow, Russian Federation

The Main Centre for Special Technologies (GTsST) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), also known by its field post number 74455, is involved in cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and in cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘NotPetya’ or ‘EternalPetya’ in June 2017 and the cyber-attacks directed at a Ukrainian power grid in the winter of 2015 and 2016.

‘NotPetya’ or ‘EternalPetya’ rendered data inaccessible in a number of companies in the Union, wider Europe and worldwide, by targeting computers with ransomware and blocking access to data, resulting amongst others in significant economic loss. The cyber-attack on a Ukrainian power grid resulted in parts of it being switched off during winter.

The actor publicly known as ‘Sandworm’ (a.k.a. ‘Sandworm Team’, ‘BlackEnergy Group’, ‘Voodoo Bear’, ‘Quedagh’, ‘Olympic Destroyer’ and ‘Telebots’), which is also behind the attack on the Ukrainian power grid, carried out ‘NotPetya’ or ‘EternalPetya’. Sandworm has carried out cyber-attacks against Ukraine, including Ukrainian government agencies and Ukrainian critical infrastructure, following Russia’s war of aggression against Ukraine. Those cyber-attacks include spear-phishing campaigns, malware and ransomware attacks.

The Main Centre for Special Technologies of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation has an active role in the cyber-activities undertaken by Sandworm and can be linked to Sandworm.

30.7.2020

4.

85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU)

Address: Komsomol’skiy Prospekt, 20, Moscow, 119146, Russian Federation

The 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU) (a.k.a. ‘Military Unit 26165’, ‘APT28’, ‘Fancy Bear’, ‘Sofacy Group’, ‘Pawn Storm’ and ‘Strontium’) is involved in cyber-attacks with a significant effect constituting an external threat to the Union or its Member States and in cyber-attacks with a significant effect against third States.

In particular, military intelligence officers of the GTsSS took part in the cyber-attack against the German federal parliament (Deutscher Bundestag) in April and May 2015 and the attempted cyber-attack aimed at hacking into the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands in April 2018.

The cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and email accounts of several MPs, as well as of former Chancellor Angela Merkel, were affected.

Following Russia’s war of aggression against Ukraine, cyber-attacks by the GTsSS (spear-phishing and malware-based attacks) were carried out against Ukraine.

22.10.2020