German intelligence accuses Russia’s GRU of cyberattacks on NATO, EU states

BFV says infamous GRU Unit 29155 is running a cyber-group targeting critical infrastructure globally.

Russia’s GRU military intelligence service has been carrying out cyberattacks against NATO and European Union countries, Germany’s domestic intelligence agency (BfV) has warned.

The BfV said in a statement released on Monday that a cyber-warfare group belonging to the infamous GRU Unit 29155 is engaged in malicious activities targeting critical infrastructure globally, including in the United States.

The statement, titled a Joint Cybersecurity Advisory, was issued by the BfV alongside the Federal Bureau of Investigation (FBI), the US Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and other international partners.

It warned that cyber-actors affiliated with the GRU’s 161st Specialist Training Center (Unit 29155) “are held responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm”.

Unit 29155 is associated with foreign assassinations and other activities aimed at destabilising Western countries. The unit is suspected of leading several high-profile operations across Europe.

BfV said that alongside international partners, it remains “committed to protecting freedom and democracy from foreign interference, cyber attacks and malicious actors”.

The warning comes at a time of heightened anxiety. Western states have reported numerous suspected Russian hacking and espionage activities since Moscow’s invasion of Ukraine in February 2022.

Earlier this year, Germany accused Russia of a slew of cyberattacks on the governing Social Democrats, as well as targeting its logistics, defence, aerospace and IT sectors.

In May, a former German soldier was sentenced to three and a half years in jail for sharing secret military information with Russia.

In its warning, the BFV said the group, also known as Cadet Blizzard or Ember Bear, conducts activities for the purpose of espionage and sabotage that often involve defacing websites and publishing stolen data.

Among the activities in which Unit 29155 is suspected is the poisoning of former Russian double agent Sergei Skripal and his daughter Yulia in the United Kingdom in 2018.