Pierluigi Paganini
January 28, 2025
The European Union announced sanctions for three members (Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov) of Unit 29155 of Russia’s military intelligence service (GRU) for their involvement in cyberattacks against Estonia in 2020.
“The Council today adopted additional restrictive measures against three Russian individuals responsible for a series of cyberattacks carried out against the Republic of Estonia in 2020. The individuals listed are officers of the General Staff of the Armed Forces of the Russian Federation (GRU) Unit 29155.” reads the statement published by the European Union. “The cyber-attacks granted attackers unauthorized access to classified information and sensitive data stored within several government ministries, —including Economic Affairs and Communications, Social Affairs, and Foreign Affairs—leading to the theft of thousands of confidential documents.”
Nikolay Korchagin, an officer of Russia’s GRU Unit 29155, was involved in unauthorized access to multiple institutions’ computer systems to collect sensitive information. This data included Estonia’s cybersecurity strategies, state cyber capabilities, and classified personal and institutional information. The objective of these attacks was to undermine Estonia’s security and pose a threat to its national interests.
These actions underscore the growing use of cyber warfare as a strategic tool to challenge state security and sovereignty.
Vitaly Shevchenko, a second officer of Russia’s GRU Unit 29155, conducted significant cyberattacks against Estonia, illegally accessing systems to collect sensitive data, including cybersecurity policies, state capabilities, and classified information. These attacks aimed to threaten Estonia’s security and targeted its allies, posing an external threat to the EU.
Yuriy Denisov, the third member of Russia’s GRU Unit 29155 that was sanctioned, is also responsible for cyberattacks against Estonia, aiming to steal sensitive data on cybersecurity and state capabilities.
“In 2020, cyber-attacks with a significant effect were carried out against Estonia. Cyber-attacks targeting the computer systems of multiple institutions were conducted with the aim of using the data to threaten the security of Estonia. Those cyber-attacks concerned the storage of classified information.” reads the statement published by the European Union.
The state-sponsored hackers stole sensitive documents, including business secrets, health records, and other critical information compromising the security of the targeted institutions.
“With today’s listings, the EU horizontal cyber sanctions regime now applies to 17 individuals and 4 entities. It includes an asset freeze and a travel ban, and the prohibition for EU persons and entities to make funds available to those listed.” continues the announcement.
The U.S. State Department has also announced a reward of up to $10 million for information five Unit 29155’s officers, Vladislav Borovkov, Denis Igorevich Denisenko, Yuriy Denisov, Dmitry Yuryevich Goloshubov, and Nikolay Aleksandrovich Korchagin.
In September 2024, the FBI, CISA, and NSA linked threat actors from Russia’s GRU Unit 29155 to global cyber operations since at least 2020. These operations include espionage, sabotage, and reputational damage. The United States and its allies state that GRU is behind global critical infrastructure attacks.
Starting January 13, 2022, the group employed the WhisperGate wiper in attacks against Ukrainian organizations. The government expert pointed out that Unit 29155 operates independently from other GRU-affiliated groups like Unit 26165 and Unit 74455.
Russia’s GRU Unit 29155 is also responsible for attempted coups, influence operations, and assassination attempts across Europe. Since 2020, the unit has expanded into offensive cyber operations aimed at espionage, reputational harm, and data destruction. The FBI believes the unit’s cyber actors are junior GRU officers gaining experience under senior leadership. They also rely on non-GRU actors, including cybercriminals, to carry out their operations.
“FBI assesses the Unit 29155 cyber actors to be junior active-duty GRU officers under the direction of experienced Unit 29155 leadership. These individuals appear to be gaining cyber experience and enhancing their technical skills through conducting cyber operations and intrusions.” reads the joint advisory. “Additionally, FBI assesses Unit 29155 cyber actors rely on non-GRU actors, including known cyber-criminals and enablers to conduct their operations.”
GRU Unit 29155 has been conducting cyber operations against NATO members, European countries, Latin America, and Central Asia. The threat actors targeted critical infrastructure sectors such as government, finance, transportation, energy, and healthcare. Their activities include website defacement, infrastructure scanning, data exfiltration, and leaking stolen data. Since 2022, the unit focused on disrupting aid efforts for Ukraine.
“To date, the FBI has observed more than 14,000 instances of domain scanning across at least 26 NATO members and several additional European Union (EU) countries. Unit 29155 cyber actors have defaced victim websites and used public website domains to post exfiltrated victim information.” continues the report. “Whether through offensive operations or scanning activity, Unit 29155 cyber actors are known to target critical infrastructure and key resource sectors, including the government services, financial services, transportation systems, energy, and healthcare sectors of NATO members, the EU, Central American, and Asian countries.”
GRU Unit 29155 targeted government and critical infrastructure by exploiting IP ranges using publicly available tools for scanning and vulnerability exploitation. The group only relies on common red-teaming techniques and tools like Raspberry Robin and SaintBot, often overlapping with other cyber actors, making it harder to attribute its activities. The nation-state actor attempted to exploit flaws in internet-facing systems, including Dahua IP cameras, to gain initial access. Using Shodan, they identify IoT devices and leverage default credentials to execute remote commands and exfiltrate data, including images and plaintext credentials.
Since 2020, Unit 29155 actors used virtual private servers (VPSs) to host tools, conduct reconnaissance, exploit victim systems, and exfiltrate data. Once successfully exploited a system, the attackers deployed a Meterpreter payload and established communication through reverse TCP connections to their infrastructure. These reverse TCP sessions are initiated via specific ports, facilitating further control and data extraction from the compromised systems.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GRU Unit 29155)
