Uptime Hamster: 107d 23h 34mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza Unit 29155

Unit 29155

0 incidentes 0 paises 0 sectores apt RU Ultimo: -
Ver en IntelTracker → APTTrail →
Unit 29155 is a Russian military intelligence unit within the GRU that has operated secretly since at least 2008, becoming publicly known in 2019. It emerged with a focus on physical sabotage and assassinations but expanded its tradecraft to include offensive cyber operations starting in 2020. The group's primary motivation is to advance Russia's hybrid warfare objectives globally, destabilize European countries, and conduct espionage, sabotage, and reputational harm, notably disrupting aid to Ukraine. What sets this group apart is its demonstrated ability to closely coordinate physical covert actions, such as assassinations and sabotage, with its cyber operations, utilizing "cleanskin" tradecraft by recruiting individuals without obvious state security associations. The unit is also known as the 161st Specialist Training Center (TsPS), with its cyber wing sometimes referred to as Cadet Blizzard, Ember Bear, Bleeding Bear, DEV-0586, Frozenvista, UNC2589, and UAC-0056.

Actores similares

unit-8200actor · 1Unit 8200apt · 0
Motivacion
Sabotage and destruction, Information theft and espionage
Malware asociado
WhisperGate, P.A.S. Webshell, Saint Bot
Tecnicas MITRE
T1078.001, T1552.001, T1090, T1583.003, T1585, T1562
CVEs relacionadas
CVE-2025-49706, CVE-2025-49704, CVE-2023-38831, CVE-2023-23397, CVE-2018-0171
Tipo
apt
Pais origen
RU
Motivacion
Sabotage and destruction, Information theft and espionage
Impacto
103
Actualizado
Mon, 02 Ju

Paises objetivo (OSINT)

AfghanistanArmeniaAustraliaAzerbaijanBulgariaCanadaSwitzerlandChinaCzech RepublicGermany

Sectores objetivo (OSINT)

Energy & Utilities Transportation&WarehousingInformation ServicesFinanceHealthCare & Social AssistancePublic AdministrationPublishing ServicesTelecommunicationsInsuranceSpace & Defense