GRU Unit 26165

GRU Unit 26165, officially designated the 85th Main Special Service Centre of Russia's military intelligence directorate (GRU), is assessed by NCSC, CISA, and the US Intelligence Community as the organisational entity operating the APT28 threat actor (also known as Fancy Bear, Forest Blizzard, and STRONTIUM). In April 2026 NCSC published advisory PSA260407 attributing to Unit 26165 a campaign targeting SOHO routers, specifically TP-Link WR841N and MikroTik models, to redirect DNS resolution for Microsoft 365 login endpoints and harvest OAuth tokens from remote workers. The unit was also referenced in analysis of the June 2026 triple-CVE Ubiquiti UniFi chain as a likely beneficiary of home-network infrastructure compromises given its established SOHO-router collection methodology.

Unit 26165 was publicly named in the US DOJ indictments of 12 GRU officers in July 2018, covering the 2016 US election interference operation including the DNC and Podesta email exfiltrations. It has since been attributed to the 2017 Macron campaign breach, the 2018 WADA hack, the 2019-2020 energy-sector targeting campaigns, and sustained 2022-2023 attacks against Ukrainian government networks and defence supply chains. Its signature is credential theft via phishing, edge-device exploitation, and DNS manipulation rather than destructive malware, which it leaves to Unit 74455 (Sandworm). This same credential-harvesting signature connects its Ukraine-facing operations to its campaigns against Western governments and NATO members.

The April 2026 SOHO-router campaign represents a structural evolution: by compromising consumer routers, Unit 26165 intercepts Microsoft 365 authentication traffic before it crosses any enterprise-monitored perimeter, making detection through standard Security Operations Centre (SOC) tooling essentially impossible. The tactic is consistent with its broader doctrine of ambient, low-noise collection rather than destructive action, and it extends a methodology first documented against Ukrainian targets in 2022 into the home networks of remote workers across NATO member states.