GTsST

A unit of GRU, Russian military intelligence, which the Council of the EU has found responsible for cyber attacks with a significant effect, including NotPetya.

According to Council Decision 2020/1127, the GTsST is also responsible for the attack on the Ukrainian power grid and plays an active role in the activities of the Sandworm group.¹

In a statement of 19 October 2020 the UK government attributed to the GTsST, also identified by its field post number 74455, a series of attacks on the Olympic Games: in 2018, an attack on the Winter Games in Pyeongchang using the Olympic Destroyer malware, which was designed to wipe data and disable computers and networks (the NCSC assessed the intent as sabotage), and, before the Tokyo Games were postponed, reconnaissance against the organisers, logistics companies and sponsors. The NCSC gave its assessment with high confidence (95%+).²

By Decision 2020/1127 the Council of the EU placed the GTsST under restrictive measures (see EU sanctions for cyber attacks).¹

More in the operation card: NotPetya.