GRU (GU): Russian military intelligence

Status

According to the Crypto Museum, the GU is the military intelligence service of the General Staff of the Armed Forces of the Russian Federation; in 2010 the GRU was renamed the GU and its special forces units were removed from it, but the name GRU remained in common use. Its chief reports to the Minister of Defence and the Chief of the General Staff, not directly to the President, as the FSB and the SVR do.²

The Russian Foreign Intelligence Law assigns the intelligence body of the Ministry of Defence the military, military-political, military-technical, military-economic and environmental spheres (Art. 11).⁴

Salisbury (2018)

On 5 September 2018 Prime Minister Theresa May told the House of Commons that the Crown Prosecution Service had charged two Russian nationals, who according to the police were travelling under the aliases Alexander Petrov and Ruslan Boshirov, with conspiracy to murder Sergei Skripal, the attempted murder of him, his daughter Yulia and Detective Sergeant Nick Bailey, and the use and possession of the nerve agent Novichok. The government had established that both men were officers of the GRU.³

According to the Prime Minister, the GRU is “a highly disciplined organisation” with a well-established chain of command, so this was not a rogue operation; it was almost certainly also approved outside the GRU, at a senior level of the state. The same two men are the prime suspects in the Amesbury poisoning, in which Dawn Sturgess died; the government regarded her and Charlie Rowley as victims of the reckless disposal of the agent.³

The OPCW in The Hague (2018)

On 13 April 2018 Dutch military intelligence (MIVD), supported by the AIVD and British services, disrupted an operation by a GRU team targeting the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in The Hague. The four officers, who held diplomatic passports, were expelled from the Netherlands.^5,6

According to the Dutch Ministry of Defence presentation and a UK government statement of 4 October 2018, the officers belonged to Unit 26165; at the time the OPCW was verifying the UK’s analysis of the Novichok used in Salisbury.^6,7

By Decision 2020/1127 the Council of the EU sanctioned four GU/GRU officers for the attempted cyber attack on the OPCW, and the GTsST unit (field post number 74455) for, among other things, NotPetya.¹

The Bundestag (2015) and the US elections (2016)

By Decision 2020/1537 of 22 October 2020 the Council of the EU sanctioned the 85th Main Centre for Special Services (GTsSS) of the GU/GRU, i.e. military unit 26165, together with the GU/GRU chief Igor Kostyukov and GTsSS officer Dmitry Badin, for the cyber attack on the Bundestag in April and May 2015, which disrupted its systems for several days and led to the theft of data.⁸

On 13 July 2018 a federal grand jury in the District of Columbia indicted twelve GRU officers from Units 26165 and 74455 over intrusions into the networks of Democratic Party committees and Hillary Clinton’s campaign and the release of the material. The indictment does not allege that any vote counts were changed; the defendants are presumed innocent.⁹

As early as 29 December 2016 the United States had sanctioned the GRU and the FSB, as well as the GRU chief Igor Korobov and his deputies.^10,11

The Olympic Games

The UK government attributed to the GRU’s GTsST unit (74455) the Olympic Destroyer malware attack on the 2018 Winter Games in Pyeongchang (in which the attackers posed as hackers from other countries) and reconnaissance against the organisers of the Tokyo Games (see Sandworm, false flag).¹²