GRU

The GRU (Glavnoye Razvedyvatelnoye Upravleniye, Russia's Main Intelligence Directorate) is Russia's foreign military intelligence agency, responsible for strategic intelligence collection, cyber operations and active measures abroad. In cyber operations, the GRU is most publicly associated with Unit 26165 (APT28/Fancy Bear), responsible for the 2016 US election interference and the April 2026 SOHO-router DNS-hijacking campaign targeting Microsoft 365 credentials. A second GRU unit, Unit 74455 (Sandworm), is responsible for the most destructive cyber operations on record including the 2017 NotPetya malware outbreak.

The GRU was created in 1918. It operates across signals intelligence (SIGINT), human intelligence (HUMINT), and cyber operations. Its cyber directorate works in parallel with the FSB's cyber arm (Star Blizzard, Cozy Bear/APT29) and the SVR, Russia's foreign intelligence service. The GRU's distinguishing characteristic is operational aggressiveness: its units have been attributed with the most disruptive state cyber actions, including election interference, Olympic doping-agency hacks, and destructive attacks on Ukrainian critical infrastructure.

The April 2026 NCSC advisory placing Unit 26165 inside a SOHO-router credential-harvesting campaign against M365 users is notable for its operational detail. The GRU's targeting has evolved from high-profile national-security targets (government, elections) toward sustained, lower-noise intelligence collection against the commercial workforce, particularly remote workers whose home-network security posture is well below enterprise baseline.