# Unit 29155 Unit 29155 is a covert unit of the [[GRU]], Russia's military intelligence service. It specializes in operations abroad that a state would want to deny: sabotage, poisonings, a coup attempt and, since about 2020, destructive cyberattacks. It has been publicly known since 2019, when the New York Times and [[Bellingcat]] tied its officers to a string of incidents across Europe. Its cover designation is the 161st Specialist Training Centre. [[Andrey Averyanov]], now a GRU deputy director, commanded it from 2013. The unit belongs in this vault for two reasons. Its record is the hard edge of Russian [[Hybrid Warfare]] against the countries the American right argues about — Ukraine, the NATO allies, the UK. And the same military-intelligence chain has been reported funding the fake-news operations that reach American politics through [[Storm-1516]]. ## Operations attributed to the unit | Year | Operation | Attribution | |---|---|---| | 2014 | Explosions at the Vrbětice ammunition depots in the Czech Republic; two workers killed | Czech government publicly blamed Russia and Unit 29155 on April 17, 2021; Russian diplomats expelled. Averyanov was later placed on the Czech wanted list | | 2015 | Poisoning of Bulgarian arms dealer Emilian Gebrev, his son and a manager (all survived) | Bulgaria charged three Russians in absentia in January 2020; Bellingcat tied the team to Unit 29155 | | 2016 | Attempted coup in Montenegro on the eve of its NATO accession | Attributed to the unit in open-source and press investigations | | 2018 | Novichok poisoning of Sergei and Yulia Skripal in Salisbury; Dawn Sturgess died after later exposure | UK attribution; see [[Skripal Poisoning]] and [[Novichok]]. The Dawn Sturgess Inquiry (December 4, 2025) found that [[Vladimir Putin]] "authorised the mission" and bears "moral responsibility" for her death | | Jan 13, 2022 | WhisperGate wiper attack on Ukrainian government systems, weeks before the full-scale invasion | U.S. indictment, September 5, 2024 | **Havana Syndrome (contested).** A joint investigation by The Insider, 60 Minutes and Der Spiegel (published around April 1, 2024) placed Unit 29155 officers near several "anomalous health incident" sites. A March 2023 assessment by seven U.S. intelligence agencies had judged a foreign adversary "very unlikely" to be responsible. The vault carries this as an open dispute, not a finding. ## The cyber turn On September 5, 2024 the Justice Department charged five GRU officers — Col. Yuriy Denisov, described as commanding officer of the unit's cyber operations, and Lts. Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov and Nikolay Korchagin — plus a civilian, Amin Stigal, with conspiring to hack Ukrainian government systems in the WhisperGate attack. The State Department's Rewards for Justice program offered up to $10 million. The same day, the U.S., UK and eight partners (the Netherlands, Czech Republic, Germany, Estonia, Latvia, Ukraine, Canada and Australia) published a joint advisory describing the unit's cyber activity since at least 2020. Microsoft tracks this cyber arm as Cadet Blizzard; other firms call it Ember Bear. ## The influence-operation link The Washington Post reported in October 2024 on documents, obtained by a European intelligence service, showing that GRU officer Yury Khoroshenky paid [[Mark Dougan]] from April 2022. Two European security officials told the Post Khoroshenky serves in Unit 29155. Dougan's fake local-news network is the main distribution channel for [[Storm-1516]]. France's VIGINUM agency named Khoroshenky as the central figure in Storm-1516 in May 2025. Governments have so far sanctioned Dougan and the [[Center for Geopolitical Expertise]] as GRU-linked (the U.S. in December 2024, the EU in 2025), but have not named the unit itself as Storm-1516's sponsor. That specific link rests on the Post's sources and a Ukrainian intelligence assessment reported by Bloomberg. ## Sanctions - **European Union, December 16, 2024:** listed Unit 29155 in its first package of hybrid-threat sanctions. - **United Kingdom, July 18, 2025:** sanctioned Units 29155, 26165 and 74455 and 18 officers, including Denisov, Borovkov and Korchagin. - **European Union, December 15, 2025:** listed Borovkov, Denisenko and Goloshubov. ## Connection to the KB Ecosystem - **[[GRU]]**: the parent service. The vault's GRU page covers the 2016 hacking units (26165 and 74455). This page covers the sabotage-and-influence arm. - **[[Storm-1516]]** / **[[Mark Dougan]]**: the bridge from sabotage to fake news aimed at U.S. elections. - **[[Africa Corps]]** / **[[Andrey Averyanov]]**: the unit's former commander is believed to run Russia's post-Wagner military force in Africa. - **[[Skripal Poisoning]]** / **[[Novichok]]**: the operation that made the unit famous. ## See Also - [[GRU]] - [[Storm-1516]] - [[Andrey Averyanov]] - [[Skripal Poisoning]] - [[Hybrid Warfare]] - [[Russian Influence]] - [[Center for Geopolitical Expertise]]