# GRU Main Intelligence Directorate (Glavnoye Razvedyvatelnoye Upravleniye) of the Russian [[Armed Forces Hub]] General Staff. [[Russia]]'s military intelligence service, distinct from the FSB (domestic security) and SVR (foreign intelligence). The GRU conducted the technical hacking operations at the core of Russia's 2016 election interference campaign, as documented by the [[Mueller Investigation]]. ## The 2016 Hacking Operation On July 13, 2018, [[Robert Mueller]] indicted 12 GRU officers by name for their roles in hacking the DNC, DCCC, and Clinton campaign. The indictment identified two specific units: ### Unit 26165 — The Hackers GRU Unit 26165, based at 20 Komsomolskiy Prospekt in Moscow, conducted the spearphishing attacks that gained access to Democratic computer networks: - Sent targeted phishing emails to more than 300 individuals affiliated with the Clinton campaign, DNC, and DCCC beginning in March 2016 - Gained access to the DNC network by April 2016 and the DCCC network shortly after - Installed custom malware (X-Agent) for persistent access and data exfiltration - Stole thousands of emails from Clinton campaign chairman John Podesta using a phishing link in March 2016 - Monitored DNC communications in real-time, including the DNC's own response to the breach ### Unit 74455 — The Publishers GRU Unit 74455, based at 22 Kirova Street in Moscow (known as "the Tower"), managed the release and amplification of stolen materials: - Created the **[[Guccifer 2.0]]** persona — presented as a lone Romanian hacker, actually operated by GRU officers — to distribute stolen materials directly to journalists and political operatives - Created **[[DCLeaks]].com** as another distribution channel, presenting it as an American hacktivist site - Transferred the bulk of stolen materials to [[WikiLeaks]] for publication, giving the releases the credibility of an established transparency organization - [[Roger Stone]] communicated directly with the Guccifer 2.0 persona during the campaign ### Timeline of Key Releases - **June 2016**: Guccifer 2.0 begins publishing DNC documents - **July 22, 2016**: WikiLeaks publishes 19,252 DNC emails (three days before Democratic Convention) - **October 7, 2016**: WikiLeaks begins publishing Podesta emails (within one hour of Access Hollywood tape) - **Through November 2016**: Continued drip-feed releases ## Beyond Hacking: The Broader GRU Operation The GRU's 2016 activities extended beyond the Clinton/DNC hack: - **State election infrastructure**: GRU officers targeted state boards of elections and voting software companies in at least 21 states - **Coordination with social media operations**: While the [[Internet Research Agency]] ran the social media influence campaign, GRU operations provided the stolen content that gave troll accounts authentic material to amplify - **Direct engagement with Americans**: Guccifer 2.0 communicated with US political figures and journalists, including [[Roger Stone]], who later lied to Congress about these contacts ## The GRU Officers Indicted The 12 indicted officers were identified by name, rank, and unit assignment. None have been arrested — they remain in Russia, beyond US jurisdiction. The indictments served primarily as a public attribution of the operations, not a realistic prosecution. ## Post-2016 GRU cyber operations have continued beyond the 2016 election, including the NotPetya cyberattack (2017), targeting the 2018 Olympics, and ongoing operations related to the Ukraine conflict. The unit responsible for the 2016 election interference (particularly Unit 74455, known as "Sandworm") has been identified by cybersecurity researchers as one of the most capable and destructive state-sponsored hacking groups in the world. ### Unit 29155 — Sabotage, Poisoning and Influence A third GRU unit, [[Unit 29155]], runs the service's deniable operations abroad: the 2014 Vrbětice depot explosions in the Czech Republic, the 2015 Gebrev poisonings in Bulgaria, the 2016 Montenegro coup plot, the 2018 [[Skripal Poisoning]] and, since about 2020, destructive cyberattacks such as WhisperGate against Ukraine (U.S. indictment, September 2024). Documents reported by the Washington Post in 2024 also tie a Unit 29155 officer to funding [[Mark Dougan]]'s fake-news network, the distribution arm of [[Storm-1516]]. ## Significance The GRU is the operational engine behind Russia's 2016 election interference. While the [[Internet Research Agency]] ran the social media influence campaign and [[RT]] provided the media platform, the GRU produced the most politically consequential material: the actual stolen emails from the DNC and Clinton campaign. The Mueller indictment of 12 GRU officers by name represents the most granular public attribution of a state-sponsored cyber operation in US history.