GRU Unit 26165

GRU Unit 26165, designated the 85th Main Special Service Centre of Russia's military intelligence directorate, is the organisational entity assessed by NCSC, CISA, and the US Intelligence Community as operating the APT28 threat actor. In April 2026 NCSC published advisory PSA260407, attributing to Unit 26165 a campaign targeting SOHO routers, specifically TP-Link WR841N and MikroTik models, to redirect DNS resolution for Microsoft 365 login endpoints and harvest OAuth tokens.

Unit 26165 was publicly named in the US DOJ indictments of 12 GRU officers in July 2018, covering the 2016 US election interference operation. The unit has since been attributed to the 2017 Macron campaign breach, the 2018 WADA hack, the 2019-2020 energy-sector targeting campaigns and, in 2022-2023, sustained attacks against Ukrainian government networks and defence supply chains. Its signature is credential theft via phishing, edge-device exploitation and DNS manipulation rather than destructive malware, which it leaves to Unit 74455 (Sandworm).

The April 2026 campaign represents an evolution toward ambient, low-noise collection inside remote-worker home networks. By compromising consumer routers, Unit 26165 intercepts M365 authentication traffic before it crosses any enterprise-monitored perimeter, making detection through standard Security Operations Centre (SOC) tooling essentially impossible.