GRU Unit 29155

Unit 29155 is a Russian military intelligence (GRU) unit associated with foreign assassinations and other activities apparently aimed at destabilizing European countries.^[1] The unit is thought to have operated in secret since at least 2008, though its existence only became publicly known in 2019.^[1][2]

The Unit is commanded by Maj. Gen. Andrei Vladimirovich Averyanov [d] and based at the headquarters of the 161st Special Purpose Specialist Training Center in eastern Moscow.^[1][2] Its membership has included veterans from Russian wars in Afghanistan, Chechnya, and Ukraine, identified as Denis Sergeev (aka Sergei Fedotov), Alexander Mishkin (aka Alexander Petrov), Anatoliy Chepiga (aka Ruslan Boshirov, a Hero of the Russian Federation, Russia's highest honor), Sergey Lyutenkov (aka Sergey Pavlov), Eduard Shishmakov (aka Eduard Shirokov), Vladimir Moiseev (aka Vladimir Popov), Ivan Terentyev (aka Ivan Lebedev), Nikolay Ezhov (aka Nikolay Kononikhin), Alexey Kalinin (aka Alexei Nikitin), and Danil Kapralov (aka Danil Stepanov).^[1][3][4]

Le Monde reported in December 2019, citing French intelligence contacts, that 15 agents connected with Unit 29155 visited the Haute-Savoie region of the French Alps between 2014 and 2018 including Alexander Petrov and Ruslan Boshirov who are believed to be responsible for the Skripal poisoning.^[5][6] High-ranking GRU officer Denis Vyacheslavovich Sergeev (alias Sergei Fedotov) has been identified by British authorities as the commander of the team that poisoned Sergei Skripal,^[7][2] a former Russian military officer and double agent for the British intelligence agencies, and his daughter Yulia Skripal. Anatoliy Chepiga, one of the suspected Skripal attackers, was photographed at Averyanov's daughter's wedding in 2017.^[8]

The unit's operations were described as sloppy by security officials since none of the operations to which it has been linked were successful.^[9][1] Several actions had to be broken off without success, such as the attempted coup in Montenegro in 2016, which was staged before the country joined NATO. In several cases, enough evidence was left behind to enable the perpetrators to be identified. Security experts^[who?] wondered whether this method was chosen to signal that all opponents of the Russian regime were possible targets, no matter their location. Eerik-Niiles Kross, a former intelligence chief in Estonia, says this type of intelligence operation has become part of psychological warfare.^[1]

In August 2024, the Federal Bureau of Investigation (FBI) posted a $10,000,000 reward for information leading to the locations of Vladislav Yevgenyevich Borovkov, Denis Igorevich Denisenko, Yuriy Fedorovich Denisov, Dmitriy Yuryevich Goloshubov, Nikolay Aleksandrovich Korchagin, and Amin Timovich Stigal.^[10][11]

Unit 29155 was linked — by the investigative Bellingcat website using OSINT (open-source intelligence) — to the attempted assassinations of Bulgarian arms dealer Emilian Gebrev in April 2015 and the former GRU Colonel Sergei Skripal in March 2018, both possibly overseen by the same agent.^[12] According to Ben Macintyre in the London Times in December 2019, the unit is believed to be responsible for a destabilisation campaign in Moldova and a failed pro-Serbian coup plot in Montenegro in 2016 including an attempt to assassinate the Prime Minister Milo Đukanović and occupy the parliament building by force.^[13][14] Russia has denied all accusations.^[15]

The men mentioned by Czech police in relation to 2014 Vrbětice ammunition warehouses explosions were the same men identified by Bellingcat in the Skripal poisoning case.^[16]

Andrej Babiš, the prime minister of Czechia, announced on 17 April 2021 that Unit 29155 was behind the 2014 Vrbětice ammunition warehouses explosions, which resulted in the death of two Czech citizens and damage exceeding CZK 1 billion.^[17] Czech police was seeking information from the public on two suspects: Alexander Mishkin (aka Alexander Petrov), Anatoliy Chepiga (aka Ruslan Boshirov).^[18] On April, 29 2024 Police of the Czech Republic announced the completion of the investigation of explosions, stating that it considered it proven that the explosions were carried out by GRU.^[19] In May 2024, the commander of Unit 29155, Averyanov, was declared wanted by the Czech Police.^[20][21]

In 2020, a CIA assessment reported that Unit 29155 operated a Russian bounty program that offered cash rewards to Taliban-linked militants to kill U.S. and other coalition soldiers in Afghanistan.^[22][23] The assessment said several US military personnel died as a result of a bounty program.^[24] According to the New York Times, on 1 July, the National Intelligence Council produced a document in which various intelligence agencies assessed the credibility of the existence of a bounty program based on the available evidence, gleaned in part from interrogations of captured Islamist militants by Afghanistan's government.^[25] Anonymous officials who had seen the memo said that the "C.I.A. and the National Counterterrorism Center had assessed with medium confidence—meaning credibly sourced and plausible, but falling short of near certainty"—that bounties had been offered. Other parts of the intelligence community, including the National Security Agency, said they "did not have information to support that conclusion at the same level", and so had lower confidence in the conclusion.^[26] Both Russia and the Taliban have denied the existence of a program.^[22][27] In July 2020, Defense Secretary Mark Esper said that General Kenneth McKenzie and General Scott Miller, the top U.S. military commander in Afghanistan, did not think "the reports were credible as they dug into them."^[28] General Kenneth McKenzie, the commander of U.S. Central Command, said that he found no "causative link" between reported bounties to actual U.S. military deaths.^[28] In April 2021, the U.S. government reported that the U.S. intelligence community only had "low to moderate confidence" in the bounty program allegations.^[29][30]

In April 2024, 60 Minutes, Der Spiegel and The Insider published a ″joint investigation″ which alleges that Unit 29155 is connected to cases of "Havana syndrome", where U.S. employees or their family members have experienced symptoms in the range from pain and ringing in the ears to cognitive dysfunction.^[31] Among the core findings of the yearlong collaboration of Roman Dobrokhotov, Christo Grozev and Michael Weiss were that senior members of the unit received awards and political promotions for work related to the development of non-lethal acoustic weapons; and that members of the unit have been geolocated to places around the world just before or at the time of reported incidents.^[31] The Kremlin Press Secretary dismissed the report as "nothing more than baseless, unfounded accusations by the media."^[32] In response to the report, the White House Press Secretary continued to back a March 2023 report by the National Intelligence Council that an enemy adversary was unlikely.^[33]

Beginning in 2020 to support Russia's efforts in the Russo-Ukrainian War, many cyber attacks on Ukraine and the countries of NATO allegedly were conducted by GRU 161st Specialist Training Center (Unit 29155), which is responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020, that often used multiple families of destructive wiper malware including "WhisperGate." The United States Justice Department indicted six individuals associated with GRU Unit 29155 who were the five GRU officers Vladislav Borovkov (Russian: Владислав Боровков), Denis Igorevich Denisenko (Russian: Денис Игоревич Денисенко), Yuriy Denisov (Russian: Юрий Денисов), Dmitry Yuryevich Goloshubov (Russian: Дмитрий Юрьевич Голошубов), and Nikolay Aleksandrovich Korchagin (Russian: Николай Александрович Корчагин) and one civilian Amin Timovich Stigal (Russian: Амин Тимович Стигаль; born 10 January 2002, Grozny). Also, the United States Department of State Diplomatic Security Service Rewards for Justice offers up to $10 million for information about these six individuals associated with GRU Unit 29155.^{[34][35][36][37][38][39][40][41][42][43][44][a]}

• Advanced persistent threat or APT
• PLA Unit 61398, "APT 1"
• PLA Unit 61486
• Russian interference in the 2016 Brexit referendum
• Poison laboratory of the Soviet secret services
• Sandworm