# Russian State Hacking Groups The intrusion units run by Russia's intelligence and military services — the operational hands behind the cyber side of Russian statecraft, from election interference to infrastructure sabotage. Three groups dominate the public record, and together with a fourth, FSB-run unit they map the division of labor across the Russian security state: - **Fancy Bear (APT28)** — Military intelligence, the **GRU** (Unit 26165). The noisy, disruptive arm: the [[DNC Hack]] and the 2016 [[Hack-and-Leak Operation]], the WADA anti-doping leaks, the TV5Monde and Bundestag intrusions, and persistent targeting of political campaigns and journalists. Aligned with the [[Active Measures]] tradition of active interference. - **Cozy Bear (APT29)** — Foreign intelligence, the **SVR**. The quiet, patient espionage arm: long-term, stealthy collection inside governments and tech firms. Responsible for the 2020 SolarWinds [[Supply-Chain Attack]] and an earlier, separate breach of the DNC. - **Sandworm (Unit 74455)** — GRU's sabotage and destruction specialists. Authors of the attacks on Ukraine's power grid (2015–16), the **NotPetya** [[Wiper Malware]] that caused over $10 billion in global damage (2017), Olympic Destroyer (2018), and the wiper wave around Russia's 2022 invasion of Ukraine. - **Energetic Bear / Dragonfly (MITRE G0035)** — Domestic security, the **FSB** (Center 16, Military Unit 71330). The infrastructure-reconnaissance arm, active since at least 2010, also tracked as Berserk Bear, Crouching Yeti, Iron Liberty, DYMALLOY and **Ghost Blizzard**. In March 2022 the Justice Department unsealed charges against three Center 16 officers (Pavel Akulov, Mikhail Gavrilov, Marat Tyukov) and a Defense Ministry institute employee over a 2012–2018 campaign that targeted about 3,300 computers at more than 500 energy companies in about 135 countries, seeking techniques "designed to enable future physical damage." *(Added 2026-09-29; MITRE tracks the related "Dragonfly 2.0" activity separately as G0074.)* ## The attribution-and-naming problem These groups are hard to talk about partly because **every vendor names them differently**, producing a fog of aliases for the same unit. Fancy Bear is also Sofacy, Strontium, and (in Microsoft's weather-themed scheme) **Forest Blizzard**; Cozy Bear is The Dukes, Nobelium, and **Midnight Blizzard**; Sandworm is Voodoo Bear, Telebots, and **Seashell Blizzard**. CrowdStrike uses animals (Russia = "Bear," China = "Panda"), Microsoft uses weather ("Blizzard" for Russia, "Typhoon" for China — see [[Chinese State Hacking Groups]]), and Mandiant uses APT numbers. The naming chaos matters: it lets the same actor appear in headlines under a half-dozen labels, and it underlines that "attribution" is a probabilistic intelligence judgment, not a courtroom certainty — which is precisely the ambiguity that state cyber operations exploit. ## The criminal gray zone Beyond the formal units, Russia tolerates a permissive harbor for Russian-speaking ransomware gangs (REvil, Conti, DarkSide; see [[Ransomware-as-a-Service]]), which are coded to avoid domestic targets and are reined in only when politically convenient. The line between state hackers and "patriotic" criminals is deliberately blurry — a feature, not a bug, of the deniability architecture. ## Right-wing-KB relevance These groups are the operators behind events this knowledge base treats as turning points — the 2016 election interference, SolarWinds, NotPetya — and they show how a single state distributes cyber power across distinct missions: **influence** (Fancy Bear), **espionage** (Cozy Bear), and **sabotage** (Sandworm). Tracking them also clarifies a recurring rhetorical move in domestic politics: because attribution is probabilistic, bad-faith actors can dismiss well-evidenced findings as "unproven," exploiting the genuine uncertainty of the field to launder denial. ## Distinct from neighbors - **[[Chinese State Hacking Groups]]** — China's APTs ("Typhoon"/"Panda") lean toward economic espionage and infrastructure pre-positioning; Russia's lean toward disruption and influence. - **[[Internet Research Agency]]** — Russia's *social-media troll farm* (Prigozhin-funded), a propaganda operation, not a hacking unit; complementary to Fancy Bear in 2016. - **Ransomware gangs** — profit-driven criminals tolerated by the state, distinct from the intelligence units themselves. ## See Also - [[Chinese State Hacking Groups]] - [[Hack-and-Leak Operation]] - [[Supply-Chain Attack]] - [[Wiper Malware]] - [[DNC Hack]] - [[Active Measures]] - [[Information Warfare Hub]] - [[Cybersecurity Lexicon]]