The Main Directorate of the General Staff of the Armed Forces of the Russian Federation (Russian: Гла́вное управле́ние Генера́льного шта́ба Вооружённых Сил Росси́йской Федера́ции), abbreviated G.U., formerly the Main Intelligence Directorate (Russian: Гла́вное разве́дывательное управле́ние, tr. Glavnoye razvedyvatel'noye upravleniye, IPA: [ˈɡlavnəjə rɐzˈvʲɛdɨvətʲɪlʲnəjə ʊprɐˈvlʲenʲɪjə]) and still commonly known by its previous abbreviation GRU (Russian: ГРУ, IPA: [ɡeeˈru]), is the foreign military intelligence agency of the General Staff of the Armed Forces of the Russian Federation (formerly the USSR′s General Staff). Unlike Russia′s other security and intelligence agencies, such as the SVR, the FSB, and the FSO, whose heads report directly to the president of Russia, Director of GRU is subordinate to the Russian military command, i.e. the minister of defence and the Chief of the General Staff. Until 2010, and again from 2013, the GRU combined a military intelligence service and special forces.
The Directorate is reputedly Russia's largest foreign intelligence agency. According to unverified statements by GRU defector Stanislav Lunev, in 1997 the agency deployed six times as many agents in foreign countries as the SVR, the successor of the KGB's foreign operations directorate (PGU KGB). It also commanded 25,000 Spetsnaz troops in 1997.
|G.U. Generalnogo Shtaba|
|Glavnoje Razvedyvatel'noje Upravlenije|
ГРУ ГШ ВС РФ
Главное Разведывательное Управление
|Formed||7 May 1992|
|Jurisdiction||President of Russia|
|Headquarters||Grizodubovoy str. 3, Moscow|
|Parent agency||Ministry of Defense|
|Website||Ministry of Defense Website|
The first Russian body for military intelligence was established in 1810 by the War minister Michael Andreas Barclay de Tolly who suggested to the emperor the creation of a permanent body for Strategic military intelligence. In January 1810, The Expedition for Secret Affairs under the War Ministry was formed. Two years later it was renamed the Special Bureau.
In 1815, the bureau became the First Department under the General Chief of Staff. In 1836 the intelligence functions were transferred to the Second Department under the General Chief of Staff. After many name changes through the years, in April 1906 the Military intelligence was carried out by the Fifth Department under the General Chief of Staff of the War Ministry.
Its first predecessor in Soviet Russia was created on 21 October 1918 on the initiative of Leon Trotsky, who was then the civilian leader of the Red Army; it was originally known as the Registration Agency (Registrupravlenie, or RU). Simon Aralov was its first head. In his history of the early years of the GRU, Raymond W. Leonard writes:
As originally established, the Registration Department was not directly subordinate to the General Staff (at the time called the Red Army Field Staff – Polevoi Shtab). Administratively, it was the Third Department of the Field Staff's Operations Directorate. In July 1920, the RU was made the second of four main departments in the Operations Directorate. Until 1921, it was usually called the Registrupr (Registration Department). That year, following the Soviet–Polish War, it was elevated in status to become the Second (Intelligence) Directorate of the Red Army Staff, and was thereafter known as the Razvedupr. This probably resulted from its new primary peacetime responsibilities as the main source of foreign intelligence for the Soviet leadership. As part of a major re-organization of the Red Army, sometime in 1925 or 1926 the RU (then Razvedyvatelnoe Upravlenye) became the Fourth (Intelligence) Directorate of the Red Army Staff, and was thereafter also known simply as the "Fourth Department." Throughout most of the interwar period, the men and women who worked for Red Army Intelligence called it either the Fourth Department, the Intelligence Service, the Razvedupr, or the RU. […] As a result of the re-organization [in 1926], carried out in part to break up Trotsky's hold on the army, the Fourth Department seems to have been placed directly under the control of the State Defense Council (Gosudarstvennaia komissiia oborony, or GKO), the successor of the RVSR. Thereafter its analysis and reports went directly to the GKO and the Politburo, apparently even bypassing the Red Army Staff.
The GRU was given the task of handling all military intelligence, particularly the collection of intelligence of military or political significance from sources outside the Soviet Union. The GRU operated residencies all over the world, along with the SIGINT (signals intelligence) station in Lourdes, Cuba, and throughout the former Soviet-bloc countries, especially in Lithuania, Latvia, and Estonia.
The first head of the 4th Directorate was Janis Berzin, a Latvian Communist and former member of the Cheka, who remained in the post until 28 November 1937, when he was arrested and subsequently executed during the Great Purge.
The GRU was known in the Soviet government for its fierce independence from the rival "internal intelligence organizations", such as the NKVD and KGB. Nonetheless, the Cheka infiltrated the GRU in 1919. That worsened a fierce rivalry between the two agencies, which were both engaged in espionage and was even more intense than the rivalry between the Federal Bureau of Investigation and Central Intelligence Agency in the US.
The existence of the GRU was not publicized during the Soviet era, but documents concerning it became available in the West in the late 1920s, and it was mentioned in the 1931 memoirs of the first OGPU defector, Georges Agabekov, and described in detail in the 1939 autobiography (I Was Stalin's Agent) by Walter Krivitsky, the most senior Red Army intelligence officer ever to defect. It became widely known in Russia, and the West outside the narrow confines of the intelligence community, during perestroika, in part thanks to the writings of "Viktor Suvorov" (Vladimir Rezun), a GRU officer who defected to Great Britain in 1978, and wrote about his experiences in the Soviet military and intelligence services. According to Suvorov, even the General Secretary of the Communist Party of the Soviet Union, to enter GRU headquarters, needed to go through a security screening.
Following the dissolution of the USSR in December 1991, the GRU continued as an important part of Russia's intelligence services, especially since it was never split up, unlike the KGB. The KGB was dissolved after aiding a failed coup in 1991 against the then Soviet President Mikhail Gorbachev. It has since been divided into the Foreign Intelligence Service (SVR) and the Federal Security Service (FSB).
The GRU chief Igor Sergun′s death in early January 2016 caused speculations of foul play. At the helm of the GRU since late 2011, Igor Sergun was reported to have taken charge of the agency in the wake of the drastic cuts to the service implemented in the course of radical reorganization of the military at the hands of Defence Minister Anatoliy Serdyukov, and was credited with the GRU having recovered some of its former influence, most notably by playing a prominent role in the capture of Crimea in 2014 and the Russian intervention in eastern Ukraine after an FSB-orchestrated pro-Russian unrest largely fizzled out.
The tenure of Sergun′s successor, Igor Korobov, was marked by what was construed by the news media as multiple high-profile failures such as the thwarted 2016 coup d'état attempt in Montenegro and the failed 2018 Salisbury poisoning, as well as an unprecedented number of disclosed GRU agents. Korobov died on 21 November 2018, "after a serious and prolonged illness", according to the official defence ministry′s statement. His death provoked speculations and unverified reports of him having fallen ill in October that year, following a harsh dressing-down from president Vladimir Putin. However, former CIA station chief Daniel Hoffman, cautioned in 2017 that some of the Russian intelligence′s recent operations that appeared to be botched might have been ″discoverable influence operations″, i.e. operations that were meant to be discovered.
The GRU is organized into numerous directorates.
The First Directorate is responsible for intelligence in Europe.
The Second Directorate is geographically responsible for the Western Hemisphere.
The Third Directorate has a geographic responsibility for Asia.
The Fifth Directorate is responsible for military operations intelligence, including naval intelligence.
According to a Western assessment of the GRU seen by Reuters in the autumn of 2018, the GRU had a long-running program to run ‘illegal’ spies, i.e. those who work without diplomatic cover and who live under an assumed identity in foreign countries for years. The assessment said: “It plays an increasingly important role in Russia’s development of Information Warfare (both defensive and offensive). It is an aggressive and well-funded organization which has the direct support of – and access to – [Russian President Vladimir] Putin, allowing freedom in its activities and leniency with regards to diplomatic and legislative scrutiny."
Commonly known as the Spetsnaz GRU, it was formed in 1949. Following the dissolution of the Soviet Union in 1991, the Spetsnaz GRU remained intact as part of the Russian GRU until 2010, when it was reassigned to other agencies. In 2013, however, the decision was reversed and Spetsnaz GRU units were reassigned to GRU divisions and placed under GRU authority again.
GRU officers train at a Ministry of Defence military academy at 50 Narodnoe Opolchenie Street, with intelligence agents receiving additional training at the Cherepovets Higher Military School of Radio Electronics. The A.F. Mozhaysky Military-Space Academy has also been used to train GRU officers.
According to the Federation of American Scientists: "Though sometimes compared to the US Defense Intelligence Agency, [the GRU's] activities encompass those performed by nearly all joint US military intelligence agencies as well as other national US organizations. The GRU gathers human intelligence through military attaches and foreign agents. It also maintains significant signals intelligence (SIGINT) and imagery reconnaissance (IMINT) and satellite imagery capabilities." Soviet GRU Space Intelligence Directorate had put more than 130 SIGINT satellites into orbit. GRU and KGB SIGINT network employed about 350,000 specialists.
On 9 November 2018, Austrian Chancellor Sebastian Kurz said that a 70-year-old retired army colonel was believed to have spied for Russia for years. The officer in question, whose name was not disclosed, was reported to have been engaged in selling official secrets to his GRU handlers from 1992 until September 2018.
A Russian citizen named Artem Zinchenko was convicted of spying on Estonia for GRU in May 2017. On September 5, 2018, Estonian Army Major Deniss Metsavas and his father, Pjotr Volin, were charged with giving classified information to the GRU since 2013.
In September 2018 Finnish police ran a large scale operation against numerous sites owned by Airiston Helmi Oy company that over years accumulated land plots and buildings close to nationally significant key straits, ports, oil refineries and other strategic locations as well as two Finnish Navy vessels. The security operation was run in parallel in multiple locations, involving Finnish National Bureau of Investigation, local police, Tax Administration, Border Guard, and Finnish Defence Forces. During the operation a no-fly zone was declared over Turku Archipelago where key objects were located. While official cause given for the raid was multi-million euro money laundering and tax fraud, media speculated that the company might have been a cover for GRU preparing infrastructure for a surprise attack on Finnish locations in case of a conflict situation.
GRU operatives belonging to Fancy Bear/APT 28 reportedly used fake Facebook accounts to pose as associates of Emmanuel Macron's campaign staff, with the goal of interfering with the 2017 French presidential election. Georgy Petrovich Roshka, a member of the GRU's Unit 26165 was involved in the theft of Macron's emails, and subsequent distribution via WikiLeaks. Viktor Ilyushin, a GRU operative working as an Air Force deputy attaché, was expelled from France in 2014 for attempted espionage of the staff of François Hollande.
During the 2006 Georgian–Russian espionage controversy, four officers working for the GRU Alexander Savva, Dmitry Kazantsev, Aleksey Zavgorodny and Alexander Baranov were arrested by the Counter-Intelligence Department of the Ministry of Internal Affairs of Georgia and were accused of espionage and sabotage. This spy network was managed from Armenia by GRU Colonel Anatoly Sinitsin. A few days later the arrested officers were handed over to Russia through the Organization for Security and Co-operation in Europe (OSCE).
In September 2000, Japan expelled Captain Viktor Bogatenkov, a military attache at the Russian Embassy in Tokyo, on allegations of espionage. Bogatenkov was a GRU agent who received classified information from Shigehiro Hagisaki (萩嵜 繁博), a researcher at the National Institute for Defense Studies.
In June 2017, Moldova expelled five Russian GRU operatives with diplomatic cover from the Russian Embassy in Chisinau, as they were believed to be attempting to recruit fighters from Gagauzia to fight in the ongoing conflict with Ukraine. Russian Deputy Minister of Foreign Affairs Grigory Karasin rejected the allegations.
The two Russian nationals indicted by Montenegrin prosecution as the organisers of the attempted coup d'état in Montenegro in October 2016 are believed to be GRU officers. One of them, Eduard Vadimovich Shishmakov ("Shirokov") had been officially identified as GRU in October 2014, when Shishmakov, who then held the position of a deputy military attache at the Russian embassy in Poland, was declared persona non grata by the Polish government.
In mid-September 2018, the Swiss press reported that two men allegedly working for the GRU had been arrested in The Hague, the Netherlands in the spring that year, after the Salisbury poisoning incident, for planning to hack the computer systems of the Spiez Laboratory, a Swiss institute analyzing chemical weapon attacks for the Organisation for the Prohibition of Chemical Weapons (OPCW). In early October 2018, the government of the Netherlands announced they had arrested four GRU operatives on 13 April: the Russians allegedly attempted to launch a major ″close access″ cyberattack against the headquarters of the OPCW in the Hague and also intended to travel onwards to the Spiez laboratory in Switzerland, which was testing Novichok samples from Salisbury at the time. Investigation conducted by open-source intelligence outlets in the aftermath of the Dutch government's revelations that used Russian road police databases led to identification of further 305 GRU officers whose private cars were registered at GRU headquarters in Moscow.
On 13 February 2004, in Doha, two Russian men assassinated Zelimkhan Yandarbiyev, an exiled leader of Chechen rebels. Anatoly V. Belashkov and Vasily A. Bogachyov, thought to be GRU members, were found guilty of the murder by a Qatari criminal court, which said the men had acted under direct orders from the Russian leadership.
Dmitry Kozak and Vladislav Surkov, members of the Vladimir Putin administration, reportedly served in GRU. Two Chechen former warlords Said-Magomed Kakiev and Sulim Yamadayev are commanders of Special Battalions Vostok and Zapad ("East" and "West") that are controlled by the GRU. The battalions each included close to a thousand fighters until their disbandment in 2008.
The Sixth Directorate was responsible for maintaining the Center S covert listening post in Syria prior to its loss to the Free Syrian Army in 2014. The Sixth Directorate also operates a signals intelligence listening post at Hmeimim Air Base near Latakia.
In 2018 Turkish government published CCTV videos from assassination of a Chechen commander Abdulvahid Edelgiriev, who was killed in 2015 in Istanbul, claiming the perpetrator was the same person as Anatoly Chepiga ("Ruslan Boshirov") from Skripal assassination in UK.
In September 2018, the Crown Prosecution Service formally named two Russian nationals, Alexander Petrov and Ruslan Boshirov (the names used by the men when entering the UK), as suspected perpetrators of the assassination attempt of the former GRU officer Sergei Skripal and his daughter in March 2018. As part of the charge announcement Scotland Yard released a detailed track of the individuals' 48 hours in the UK. This covered their arrival in the UK at Gatwick Airport, trip to Salisbury the day before the attack, trip to Salisbury on the day of the attack and return to Moscow via Heathrow Airport. The two men stayed both nights in the City Stay Hotel on Bow Road, East London and Novichok was found in their room after police sealed it off on 4 May 2018. British Prime Minister Theresa May told the Commons the same day that the suspects were part of the G.U. intelligence service (formerly known as GRU) and the assassination attempt was not a rogue operation and was "almost certainly" approved at a senior level of the Russian state.
As a side effect of the Skripal poisoning investigation, Russian and Western media reported conclusions made by open-source intelligence outlets that claimed that GRU operatives were issued Russian foreign travel passports with certain characteristics that would allow their tentative identification. Through further research, in the autumn of 2018, "Boshirov" was publicly exposed as Anatoliy Chepiga, a decorated GRU officer, and "Petrov" as Alexander Mishkin.
GRU officer Stanislav Lunev, who defected to the U.S. in 1992 while he was posted in Washington under the cover of a TASS news agency correspondent, in the 1990s publicized his claims that small nuclear weapons that could be fit into a knapsack or a briefcase or suitcase had been secretly pre-positioned in the U.S. and other countries around the world to be used for sabotage by Russia′s agents in the event of war. U.S. Congressman, Curt Weldon, pursued these claims publicly while admitting that they had been found largely spurious by the FBI. Searches of the areas identified by Lunev – who admitted he had never planted any weapons in the US – have been conducted, "but law-enforcement officials have never found such weapons caches, with or without portable nuclear weapons."
On 29 December 2016, the White House sanctioned the nine entities and individuals, including the GRU as well as the FSB, for their alleged activities to disrupt and spread disinformation during the 2016 US presidential election. In addition, the United States State Department also declared 35 Russian diplomats and officials persona non grata and denied Russian government officials access to two Russian-owned installations in Maryland and New York. On July 13, 2018, an indictment to several GRU Staffers was issued. GRU Unit 26165 and Unit 74455 are alleged to be behind the DCLeaks website, and were indicted for obtaining access and distributing information from data about 500,000 voters from a state election board website as well as the email accounts of John Podesta, Hillary Clinton, and volunteers and employees of the Unites States Presidential Campaign of Hillary Clinton, the Democratic Congressional Campaign Committee, and the Democratic National Committee (DNC). According to information leaked by Reality Winner, the GRU attempted to hack the voting machine manufacturer VR Systems, as well as local election officials.
According to Microsoft VP Tom Burt, a GRU-run group dubbed Strontium (alternatively known as APT28, Sofacy, and Pawn Strorm, and Fancy Bear) has been engaged in spear phishing attacks against at least three campaigns in the 2018 midterm elections.
The Head of the Russian Military Intelligence is a military officer. He is the primary military intelligence adviser to the Russian Minister of Defense and to the Chief of Staff and also answers to the President of Russia.
|#||Head||Term||President(s) served under|
|1||Yevgeny Timokhin||November 1991 – August 1992||Boris Yeltsin|
|2||Fyodor Ladygin||August 1992 – May 1997||Boris Yeltsin|
|3||Valentin Korabelnikov||May 1997 – April 2009||Boris Yeltsin|
|4||Alexander Shlyakhturov||April 2009 – December 2011||Dmitry Medvedev|
|5||Igor Sergun||December 2011 – January 2016||Dmitry Medvedev|
|-||vacant position||3 January – 1 February 2016||Vladimir Putin|
|6||Igor Korobov||2 February 2016 – 21 November 2018||Vladimir Putin|
Unlike its predecessor, a drab, redbrick monolith nicknamed the Aquarium, the new GRU complex is a futuristic glass-clad and bulletproof structure that bears more than a passing resemblance to the London headquarters of Britain's MI6 [...] The complex, whose construction began in 2003, cost 9.5 billion rubles ($357 million) to build, and incorporates an area of 70,000 square meters.
President Dmitry Medvedev sacked Russia's most powerful intelligence chief Friday in a move that underscores strained ties with some of the military top brass over a Kremlin-backed reform of the armed forces. The Kremlin said Medvedev had signed a decree to dismiss General Valentin Korabelnikov, who has directed Russia's military intelligence service since 1997.
Gen Korabelnikov had been the head of military intelligence for 12 years and was a four-star general. Analysts say the 63-year-old was one of the main opponents of the planned military reforms, which could see the Russian armed forces shrink from 1.3 million serving men and women to one million. The majority of those cuts would come from the officer corps, which could see the loss of around 200,000 posts, including many generals. Some of the proposed reforms were said to have included the disbanding of several GRU-controlled army special forces (Spetsnaz) brigades and the redistribution of the command of some GRU structures to the SVR. Gen Korabelnikov is reported to have submitted his resignation in protest last November.
The GRU's Sixth Directorate uses over 20 different types of aircraft, a fleet of 60 SIGINT collection vessels, satellites, and ground stations to collect signals intelligence. Together with FAPSI, the GRU operates SIG1NT collection facilities in over 60 diplomatically protected facilities throughout the world. These agencies also operate large ground collection facilities within the territory of the Commonwealth of Independent States, at Cam Rank Bay, Vietnam, and at Lourdes, Cuba.
1. Andreyevka SATCOM Station, Russia
The station is located in the Maritime Province of the Russian Far East near the tiny village of Andreyevka (Google Earth transliterates the name as Andreevka) at the following geographic coordinates: 44-30-30N 133-28-28E. [...] Built during the mid-1970s by the Soviets, a former senior NSA official mentioned it to me in the late 1980s as being "the biggest and baddest of the Sov’s SIGINT stations.“ At the station’s peak during the Cold War, it was jointly manned by several hundred KGB and GRU (Soviet military intelligence) SIGINTers. Today, the station is owned and operated solely by the GRU, and it would appear that the station has not been upgraded with new equipment in quite some time.
Andreyevka SATCOM Station: 44-30-30N 133-28-28E Some of these stations are still apparently active (the largest of which is the Andreyevka station near Vladivostok), although to what degree they are still working COMSAT targets cannot be determined from imagery available on Google Maps.
The Harper government has expelled staff at Russia’s embassy in the wake of charges filed against a Canadian military intelligence officer for allegedly passing secrets to a foreign power, The Globe and Mail has learned. [...] A Russian embassy official acknowledged the following three staffers have recently left Canada, saying, however, that all departures were routine: Lieutenant Colonel Dmitry V. Fedorchatenko, assistant defence attaché. Konstantin Kolpakov, attaché. Mikhail Nikiforov, with the administrative and technical staff. The embassy did not provide a clear explanation for the fourth name now gone from Canada’s official list of diplomatic, consular and foreign government representatives: Tatiana Steklova, who had been described as “administrative and technical staff.”
Initial media reports said up to four Russian Embassy staff had been removed from a list of embassy and diplomatic staff recognized by Canada. CBC News has confirmed that two have had their credentials revoked since news broke of the naval officer's arrest, while two diplomats left the country a month or more before the arrest this week of Canadian Sub.-Lt. Jeffrey Paul Delisle.
Zinchenko has lived in Estonia on a residence permit since 2013. The Estonian court determined that he was recruited by Russia’s Main Intelligence Directorate (GRU) in 2009, and spent the next four years collecting information about troop movements in Estonia, and about objects of national importance. [...] Zinchenko reportedly passed sensitive information to members of the GRU on multiple occasions, both by means of special communication and in person, on visits to St. Petersburg.
Artem Zinchenko, a Russian citizen legally resident in Estonia since 2013, was convicted on 8 May of espionage for Russia's GRU military intelligence organisation. Recruited in 2009 and arrested in January 2017, Zinchenko was sentenced to five years for spying on locations, equipment, and manoeuvres of Estonian and NATO forces and critical infrastructure.
A Tbilisi city court September 29 ordered two Russian officers arrested in the Georgian capital, Dmitri Kazantsyev and Alexander Savva, and seven Georgian citizens to be held in pre-trial detention. The Russian consul in Georgia, Valeri Vasiliyev, told Rustavi-2 television that a lawyer for the officers had not been allowed into the courtroom. The Georgian Interior Ministry did not immediately comment on the allegation. The court also passed the same ruling for Konstantin Pichugin, who has been accused of espionage, but who is believed to be inside Russia's regional military headquarters, which remained surrounded by police for a second day. Moscow has refused to surrender Pichugin.
Georgia's counter-intelligence service arrested four Russian military intelligence (GRU - Glavnoye Razvedovatelnoye Upravlenie) officers and eleven citizens of Georgia who were cooperating with Russian intelligence services, Georgian Interior Minister Vano Merabishvili said on September 27 [...] He said that two Russian intelligence operatives were arrested in Tbilisi - GRU colonel Alexander Sava, who was allegedly the chief of the group operating in Georgia, and Dimitri Kazantsev. Two others - Alexander Zavgorodny and Alexander Baranov - were arrested in Batumi, the Georgian Interior Minister said.
Hagisaki told the Tokyo District Court that he handed the MSDF documents to Viktor Bogatenkov, 44, in violation of the SDF Law. Bogatenkov, who reportedly is an agent of the Russian intelligence agency GRU, was with Hagisaki when he was arrested but refused to submit to questioning and returned to Moscow two days later.
Allegations that five Russian diplomats expelled from Moldova last month recruited fighters for the Moscow-backed separatists in Ukraine were "idle gossip", the RIA news agency quoted a deputy Russian foreign minister as saying on Tuesday. Grigory Karasin made the comment shortly after Reuters published an exclusive report citing Moldovan government and diplomatic sources as saying that the five were ejected because of their alleged activities as undercover officers with the Russian military intelligence agency, the GRU.
The Swiss daily newspaper Tages-Anzeiger reported that the men were carrying equipment that could be used to break into the Spiez laboratory’s IT network when they were seized.
Sulim Yamadayev: heads 1000 strong East battalion, controlled by the chief intelligence directorate (GRU) of the Russian military. Dislikes Kadyrov [...] Said Magomed Kakiev: commander of 900-strong "West" battalion, also under GRU control. Dislikes Kadyrov.
GRU commando units operate in the armed forces to provide field intelligence and carry out special operations, such as the penetration and elimination of enemy units. The military actively employs GRU commandoes in Chechnya, where they have proven to be about the most able of all military units. More than 300 commandos, intelligence officers and other GRU personnel have died in fighting in Chechnya, Korabelnikov said.
In a surprise move, the Russian Defense Ministry assigned security responsibility for its team of military engineers in Lebanon to two detachments of Chechen troops [...] The East and West battalions of Chechen troops are controlled by the Russian military intelligence (GRU) and do not report directly to the Chechen government.
In October 2014, the Free Syrian Army sacked a Russian listening post in Tel al-Hara, south of the Quneitra border crossing with Israel. Its location was key. A YouTube video showed a Syrian officer giving the rebels a guided tour of the office building attached to the facility. Documents hanging on the wall, in both Arabic and Russian, including the symbols for Syrian intelligence and 6th Directorate of Russia’s military intelligence agency (GRU), and photos showed spies from both countries hard at work deciphering intercepts. Maps displayed rebel positions; they also showed coordinates of Israel Defense Force units.
At some point in the video, the seal of Syrian intelligence is clearly visible, placed next to the seal of the GRU’s 6th Directorate, the branch of Russian military intelligence that is tasked with collecting signals intelligence (SIGINT).
The Russian operator of Center S was the Osnaz GRU, responsible for radio electronic intelligence within Russia’s Armed Forces. Although not much is known about this unit, its logos can be seen below. “Части особого назначения” – Osnaz GRU and “Военная радиоэлектронная разведка” – Military Radio Electronic Intelligence.
The electronic intelligence was gathered, according to the report, by a Russian listening station at Hmemim Airport near Latakia, Syria, operated by the Sixth Directorate of GRu military intelligence.
CIT also published screenshots from the Instagram page of Ilya Gorelykh, who it said had served in Russia's GRU special forces in the past [...] In late October it showed he had uploaded pictures from Aleppo, one of which showed him holding an assault rifle while wearing civilian clothes. Another image of him posing in camouflage with three other armed men was apparently taken in Homs.
We believe that Russia's operation in Syria is a "hybrid war", not unlike the one seen in Ukraine. Apart from the airstrikes, Russia provides Assad forces with surface-to-surface rocket systems, combat vehicles, equipment, advisors, artillery support and spotters. More importantly, recently there have been more and more reports of Russian soldiers, vehicles and "volunteers" being spotted close to the frontlines.
Top Russian military officials, including figures from the GRU military intelligence service, had already visited Qamishli, it added.
Also known as APT28, Sofacy, Pawn Strorm and Strontium—Microsoft’s preferred moniker—Fancy Bear has been conducting cyber espionage since at least 2007, breaching NATO, Obama’s White House, a French television station, the World Anti-Doping Agency and countless NGOs, and militaries and civilian agencies in Europe, Central Asia and the Caucasus.
Speaking on a panel at the Aspen Security Forum on Thursday, Tom Burt, Microsoft's vice president for customer security and trust, said that his team had discovered a spear-phishing campaign targeting three candidates running for election in 2018. Analysts traced them to a group Microsoft has nicknamed Strontium, which is closely tracked by every major threat intelligence company and is widely accepted to be run by the GRU, Russia’s military intelligence agency.