NCSC and allies call out Russia’s Unit 29155 over cyber warfare

The National Cyber Security Centre (NCSC) in the UK, along with intelligence agencies in the Five Eyes alliance and partner countries such as Czechia, Estonia, Germany, Latvia, and Ukraine, have collaborated to identify Unit 29155, a Russian military cyber unit responsible for ongoing malicious activities over the past four years.

Unit 29155, part of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), has been involved in multiple computer network intrusions, using tools like the Whispergate malware in cyber warfare operations, particularly against Ukraine.

Whispergate, similar to NotPetya, was deployed in Ukraine before Russia’s illegal invasion in February 2022. While it initially appears to function as ransomware, its true purpose is to delete systems’ master boot records.

The attribution of Whispergate to a specific advanced persistent threat (APT) operation, specifically Unit 29155, highlights the significance Russian military intelligence places on utilizing cyberspace for unlawful activities.

Unit 29155, also known as the 161st Specialist Training Centre or by various names like Cadet Blizzard, Ember Bear, Frozenvista, UNC2589, and AUC-0056, consists of junior GRU personnel and third-party contractors, including cyber criminals. It differs from other GRU-backed APTs such as Unit 26165 (Fancy Bear) and Unit 74455 (Sandworm).

The NCSC stated that Unit 29155 targets victims to gather espionage information, deface websites, steal and leak sensitive data, and disrupt daily operations.