ThreatNexus
Nation-state APT intelligence
Dossiers Open app
RussiaAttributedGRU Unit 26165EspionageActive 2004 – 2026

Fancy Bear

Also known asForest Blizzard · STRONTIUM · Sofacy · Sednit · BlueDelta · Pawn Storm · FROZENLAKE · Fighting Ursa · Group 74 · Tsar Team · Swallowtail · SIG40 · TG-4127 · Snakemackerel · Iron Twilight · ATK 5 · T-APT-12 · ITG05 · TAG-0700 · UAC-0028 · Grey-Cloud · GruesomeLarch · TA422 · Blue Athena · Threat Group-4127 · APT-C-20 · UAC-0001 · Storm-2754

18ATT&CK techniques16Malware & tools17Exploited CVEs14Campaigns6Sectors
Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes
Share

Summary

GRU 85th GTsSS, military unit 26165 — Russia's most prolific espionage actor against NATO governments, militaries, defence and logistics firms, election bodies and media. Current tradecraft (2024–2026): long-term monitoring of Ukrainian military personnel and drone makers with paired Covenant + BeardShell implants delivered over Signal/WhatsApp (ESET, CERT-UA; BeardShell moved C2 to Drime in Feb 2026); Jan 2026 exploitation of CVE-2026-21509 (Office OLE security-feature bypass) in Operation Neusploit before Microsoft's disclosure, against Ukraine, Slovakia, Romania and Turkish/Polish logistics; PRISMEX against the Ukrainian defence supply chain; FrostArmada SOHO-router DNS hijacking for Microsoft 365 AiTM (disrupted Apr 2026). AA25-141A (May 2025) documents the campaign against Western logistics/IT companies and IP cameras (Roundcube, Outlook CVE-2023-23397 and WinRAR exploits). Assessed, not confirmed: LAMEHUG LLM-driven malware (CERT-UA, moderate confidence), Operation RoundPress webmail XSS (ESET, medium), Operation MacroMaze (LAB52) and the UAC-0063/TAG-110 HATVIBE cluster (CERT-UA, medium). History: Nearest Neighbor Wi-Fi pivot (Feb 2022–Nov 2024, CVE-2022-38028), 2016 DNC/DCCC hack, WADA and TV5Monde.

Attribution

AttributedGovernment attribution: GRU Unit 26165

Named by a government: indictment, sanctions designation, joint advisory or official statement.

Sources
  • US Department of Justice (Government, 2018-10-04)
    Indictment of GRU officers of Military Unit 26165 (WADA, OPCW and other intrusions)
  • US Department of Justice (Government, 2018-07-13)
    Indictment of 12 GRU officers for the 2016 US election intrusions
  • MITRE ATT&CK (MITRE ATT&CK, 2026-10)
    Attributed to GRU 85th Main Special Service Center, military unit 26165

Campaigns 14

CampaignPeriodTargetsSectorsSource
HOOKEDGE intrusions at a naval shipbuilder, a military aircraft-engine maker and a law enforcement agency in two NATO states2026-07 – 2026-09NATODefense, Shipbuilding, Aerospace, Law EnforcementSymantec Threat Hunter Team (2026-10-20) — countries not named
Operation Neusploit2026-01Ukraine, Slovakia, Romania, EUGovernment, MilitaryZscaler ThreatLabz (2026-02-02); CERT-UA#19542
HOOKEDGE initial-access waves against government, diplomatic and defence targets in Romania, Spain and TürkiyeASSESSED2025-09 – 2026-04Romania, Spain, TurkeyGovernment, Diplomatic, DefenseRecorded Future Insikt Group (2026-08-27) — BlueDelta, moderate confidence
Operation MacroMazeASSESSED2025-09 – 2026-01Western Europe, Central Europe, SpainGovernmentLAB52 (2026-02-13)
PRISMEX — Ukrainian defense supply chain2025-09 – 2026-01Ukraine, Czech Republic, Poland, Romania, Slovakia, Slovenia, TurkeyDefense, Government, Transportation, Humanitarian Aid, MeteorologyTrend Micro (2026-03-26)
LAMEHUG — LLM-driven malware against Ukrainian executive bodiesASSESSED2025-07UkraineGovernment, DefenseCERT-UA#16039 (2025-07-17)
FrostArmada — SOHO router DNS hijacking (Storm-2754 sub-group)2025-05 – 2026-04Global, Afghanistan, Africa, EU, USAGovernment, Foreign Affairs, Law Enforcement, IT, Telecommunications, EnergyLumen Black Lotus Labs / Microsoft / FBI-DOJ Operation Masquerade / NCSC (2026-04-07) — disrupted Apr 2026
NotDoor — Outlook backdoor against NATO-country companies2025NATOMultipleLAB52 (2025-09-03)
UAC-0063 — HATVIBE + CHERRYSPY against Ukrainian research institutes and the Armenian defence ministryASSESSED2024-06 – 2024-07Ukraine, ArmeniaResearch, Government, DefenseCERT-UA#10356 (2024-07-21)
Covenant + BeardShell long-term espionage against Ukrainian military personnel and drone makers (Signal/WhatsApp lures)2024-03 – ongoingUkraineMilitary, Government, Defense Industrial BaseESET Research (2026-03-10; APT report 2026-05-28); CERT-UA (2025-06-21)
Operation RoundPressASSESSED2023-09 – 2024-12Ukraine, Bulgaria, Romania, Greece, Africa, South AmericaGovernment, DefenseESET (2025-05-15)
Nearest Neighbor Attack2022-02 – 2024-11USAUnspecifiedMITRE ATT&CK C0051; Volexity (2024-11-22) — "Organization A", targeted for staff with expertise on and projects involving Ukraine; sector not disclosed
GRU 26165 targeting of Western logistics and technology companies (incl. IP cameras at border crossings)2022 – 2025-05NATO, Ukraine, Poland, Germany, USALogistics, Transportation, Technology, DefenseNSA/FBI/CISA/NCSC et al. AA25-141A (2025-05-21)
DNC / DCCC Hack2016-03 – 2016-11USAPoliticalUS DOJ indictment of 12 GRU officers (2018-07-13)

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 18

Reconnaissance2T1596Search Open Technical DatabasesT1591Gather Victim Org Information
Resource Development2T1584.008Network DevicesT1588.007Artificial Intelligence
Initial Access3T1566.001Spearphishing AttachmentT1190Exploit Public-Facing ApplicationT1669Wi-Fi Networks
Execution1T1059.001PowerShell
Persistence1T1098.002Additional Email Delegate Permissions
Privilege Escalation1T1546.015Component Object Model Hijacking
Stealth2T1055Process InjectionT1027.003Steganography
Credential Access2T1003.001LSASS MemoryT1557Adversary-in-the-Middle
Exfiltration2T1048Exfiltration Over Alternative ProtocolT1567.002Exfiltration to Cloud Storage
Command and Control2T1071.001Web ProtocolsT1102.002Bidirectional Communication

Malware and tools 16

NameDescriptionPlatform
LAMEHUGAI-Powered LLM MalwareWindows
NotDoorOutlook VBA BackdoorWindows
CovenantGruntModified Covenant ImplantWindows
X-Agent (CHOPSTICK)RATWindows/Linux
GooseEggExploit LauncherWindows
ZebrocyDownloaderWindows
KomplexRATmacOS
LoJaxUEFI RootkitWindows
HEADLACEBackdoorWindows
MASEPIEPython BackdoorCross-platform
OCEANMAPIMAP-based BackdoorWindows
PRISMEXSteganographic dropper/loader + Covenant Grunt stagerWindows
AUTHENTIC ANTICSOutlook credential & OAuth token stealerWindows
BEARDSHELLBackdoor (C++; cloud-storage C2: Icedrive → Drime)Windows
SLIMAGENTScreenshot and keystroke collector (XAgent lineage)Windows
HOOKEDGEBatch-script backdoor (webhook.site C2; HEADLACE lineage)Windows

Exploited vulnerabilities 17

CVECVSSDetail
CVE-2020-126419.8Roundcube Webmail — argument injection / remote code execution (KEV 2023-06-22)
CVE-2021-440269.8Roundcube Webmail — SQL injection (KEV 2023-06-22)
CVE-2023-233979.8Microsoft Outlook (KEV 2023-03-14)
CVE-2026-215138.8Microsoft MSHTML Framework — protection mechanism failure (KEV 2026-02-10)
CVE-2015-17017.8Windows Win32k — privilege escalation (KEV 2022-03-03)
CVE-2015-23877.8Windows Adobe Type Manager font driver (ATMFD) — privilege escalation (KEV 2022-03-03)
CVE-2017-02627.8Microsoft Office — EPS (Encapsulated PostScript) RCE (KEV 2022-02-10)
CVE-2017-02637.8Windows Win32k — privilege escalation (KEV 2022-02-10)
CVE-2022-380287.8Windows Print Spooler (KEV 2024-04-23)
CVE-2023-388317.8WinRAR RCE (KEV 2023-08-24)
CVE-2026-215097.8Microsoft Office — OLE security feature bypass (KEV 2026-01-26)
CVE-2023-502246.5TP-Link TL-WR841N — authentication bypass exposing stored credentials (KEV 2025-09-03)
CVE-2020-357306.1Roundcube Webmail — cross-site scripting (KEV 2023-06-22)
CVE-2023-437706.1Roundcube XSS (RoundPress) (KEV 2024-02-12)
CVE-2024-111826.1MDaemon XSS Zero-Day (KEV 2025-05-19)
CVE-2015-49025.3Oracle Java SE — Click-to-Play security bypass (KEV 2022-03-03)
CVE-2014-4076n/aWindows TCP/IP (tcpip.sys) — privilege escalation (not in KEV)

Highest CVSS first.

Infrastructure patterns

  • Lookalike domains imitating NATO, OSCE and other organisations (MITRE ATT&CK, 2026)
  • DNS hijacking on compromised MikroTik and TP-Link routers sends sign-in traffic to AitM servers (Lumen, 2026)
  • Cloud storage as C2: Icedrive for BeardShell, Filen for Covenant (ESET, 2026; Zscaler, 2026)

Reporting and advisories 16