A notorious Russian military unit, Unit 29155, has been accused of conducting extensive cyber-attacks on Ukraine’s allies, disrupting aid efforts and targeting critical infrastructure across several countries. According to a joint briefing by Western intelligence agencies, the attacks were orchestrated by the same group linked to high-profile espionage and sabotage operations, including the 2018 poisonings of a former Russian double agent and his daughter in Salisbury, UK.
Unit 29155, which has expanded into cyber operations since 2020, has been implicated in a series of cyber-attacks against companies in the financial, transport, energy, and health sectors across EU and NATO member states, as well as in Asia and Latin America. The cyber division, also known by aliases such as Cadet Blizzard and Ember Bear, has been specifically linked to the WhisperGate campaign, which targeted Ukrainian government agencies in January 2022. The attacks have since evolved to focus on scouting and disrupting aid deliveries to Kyiv.
The announcement comes as European nations intensify efforts to counter increasing Russian espionage activities following the invasion of Ukraine. Experts, including Keir Giles from Chatham House, highlight that the scope of these attacks is broader than initially understood, affecting a wide range of government and civilian agencies across Western Europe and NATO.
Western intelligence agencies from the UK, US, Netherlands, Czech Republic, Germany, Estonia, Latvia, Canada, and Australia have all signed a declaration condemning these actions. They warn that Russia's cyber activities appear to be laying the groundwork for potential overt attacks on NATO, particularly targeting logistics and rail networks across Europe. As tensions rise, the international community continues to bolster defenses against ongoing and future cyber threats from Russia.