Russia State Cyber Operations Guide: Which GRU, SVR and FSB Units Matter to You

Russian state cyber operations come from three different intelligence services with different missions, and defenders who treat "Russia" as one threat end up defending against the wrong thing. The military intelligence service (GRU) runs espionage, destructive attacks and influence operations; the foreign intelligence service (SVR) runs patient, cloud-focused espionage; the domestic security service (FSB) runs long-lived espionage, critical infrastructure reconnaissance and credential phishing. This guide maps the best known groups, APT28, Sandworm, Ember Bear, APT29, Turla, Star Blizzard, Gamaredon and Berserk Bear, to the service and unit that governments and MITRE ATT&CK attribute them to, then shows which ones matter for which sectors and which controls defeat their common tradecraft. It is written for threat intelligence analysts, SOC leads and security architects who need to turn a government advisory into a priority list. It does not repeat the strategic and legal material in the Cyber Warfare Guide.

Key takeaways

• Three services, three missions. GRU units steal, disrupt and destroy; the SVR collects intelligence quietly over long periods; FSB centres spy, phish and map critical infrastructure. Knowing which service is behind a cluster tells you what it is likely to do next.
• Identity is the common entry point. Password spraying, dormant and service accounts without MFA, stolen tokens, OAuth applications and device registration appear in advisories on APT28, APT29 and Star Blizzard alike.
• Edge and collaboration software comes next. Outlook, Roundcube, Exchange, Zimbra, TeamCity, ScreenConnect and FortiClient EMS flaws in the CISA KEV catalogue have all been used by GRU or SVR units.
• Targeting follows Russian state interest, not your size. Logistics firms supporting Ukraine, think tanks, NGOs, software vendors, energy operators and governments in NATO countries are named repeatedly; collateral damage from destructive attacks can reach anyone.
• Prioritise by unit, defend by behaviour. Use attribution to choose which advisories to act on first, then build detections on techniques, because names, infrastructure and malware change after every public exposure.

The three services and their cyber units

The table below lists the attributions published by governments or recorded by MITRE ATT&CK. Vendor names (Microsoft's Blizzard names, Mandiant's APT numbers, CrowdStrike's Bear names) describe overlapping but not always identical activity, a caveat the CISA logistics advisory AA25-141A states explicitly. See the Threat Actor Naming Conventions Guide for how the naming schemes work.

Two attributions need care. Gamaredon was publicly attributed to FSB Centre 18 by the Ukrainian government in November 2021 (as ATT&CK records); the 2022 Five Eyes advisory AA22-110A described Primitive Bear and Venomous Bear as Russian-aligned without formally attributing them, and only Berserk Bear was formally tied to the FSB in that document. Turla was later attributed by CISA to FSB Centre 16, which Microsoft cites in its Secret Blizzard reporting. Star Blizzard's link to FSB Centre 18 comes from UK and allied government statements of December 2023; Microsoft itself describes the group only as a Russian nation-state actor.

What each group does

GRU unit 26165: APT28

CISA's advisory AA25-141A describes a campaign against Western logistics and technology companies involved in delivering aid to Ukraine: defence industry, ports, maritime, air traffic management, rail and IT services across at least 13 countries including the United States. Initial access combined credential guessing through Tor and commercial VPNs, spearphishing to fake login pages behind geofencing redirectors, Outlook CVE-2023-23397 (an NTLM leak through calendar invitations), Roundcube flaws CVE-2020-12641, CVE-2020-35730 and CVE-2021-44026, WinRAR CVE-2023-38831 and compromised SOHO routers used as proxies. After access, the unit dumped NTDS.dit with ntdsutil, read Group Policy Preferences passwords, enumerated Active Directory with Certipy and ADExplorer, persisted through mailbox permission changes and enrolling compromised accounts in MFA, collected mail through EWS and IMAP and cleared logs with wevtutil. It also queried more than 10,000 RTSP IP cameras, most of them in Ukraine, to monitor aid shipments. See the APT28 (Fancy Bear) Threat Actor Profile.

GRU unit 74455: Sandworm (APT44, Seashell Blizzard)

ATT&CK records the 2015 and 2016 attacks on Ukrainian electricity companies, NotPetya in 2017 and Olympic Destroyer in 2018. Mandiant, which graduated the group to APT44 in April 2024, describes it as running the full spectrum of espionage, attack and influence operations and notes that its wartime focus shifted from disruption towards intelligence collection supporting Russian ground forces. Microsoft's February 2025 BadPilot report describes an initial access subgroup that has exploited internet-facing software since at least 2021, from 2024 relying mainly on ScreenConnect CVE-2024-1709 and FortiClient EMS CVE-2023-48788, and then installing legitimate remote management tools (Atera Agent, Splashtop) for command and control. In 2024 its targeting concentrated on the United States, Canada, Australia and the United Kingdom. See the Sandworm Threat Actor Profile.

GRU unit 29155: Ember Bear (Cadet Blizzard)

ATT&CK links Ember Bear to unit 29155 and attributes the WhisperGate wiper attacks on Ukraine in early 2022 to it. Its operations focus on Ukrainian government and telecommunications, with activity against critical infrastructure in Europe and the Americas. ATT&CK notes confusion in public reporting with the separate Saint Bear cluster. See the Cadet Blizzard Threat Actor Profile.

SVR: APT29 (Midnight Blizzard)

The US and UK attributed the SolarWinds compromise to the SVR in April 2021. The NCSC-led 2024 advisory on APT29's cloud tradecraft (published by CISA as AA24-057A) lists the techniques that matter most to defenders: password spraying service accounts, reusing dormant accounts of departed staff, stealing system-issued tokens (T1528), MFA request flooding (T1621), registering attacker devices in the tenant (T1098.005) and routing traffic through residential proxies (T1090.002). Microsoft's own January 2024 incident followed the same pattern: a password spray against a legacy non-production test tenant account without MFA, abuse of a legacy test OAuth application, and a grant of the Exchange Online full_access_as_app role to read mailboxes through EWS. In 2023 the SVR also exploited TeamCity CVE-2023-42793 against software developers. See the APT29 (Midnight Blizzard) Threat Actor Profile.

FSB Centre 16: Turla (Secret Blizzard) and Berserk Bear

Turla has compromised victims in more than 50 countries since at least 2004 (ATT&CK). Microsoft's December 2024 reporting shows it hijacking the command and control servers of a Pakistan-based espionage cluster, Storm-0156, to deploy its own tools to targets in Afghanistan and India; Microsoft's lesson is that an organisation compromised by one actor may be compromised by another through the same intrusion. Berserk Bear (Dragonfly) targets energy, transport, water, defence and state and local government in Europe and North America, scanning and exploiting internet-facing devices and stealing NTLM credentials through compromised websites (AA22-110A). See the Turla Threat Actor Profile and the Berserk Bear Threat Actor Profile.

FSB Centre 18: Star Blizzard and Gamaredon

Star Blizzard runs persistent credential phishing against academics, defence, government, NGOs and think tanks in NATO countries, particularly the US and UK, and against people working on logistics support to Ukraine. Microsoft reports Evilginx adversary-in-the-middle phishlets as a constant, behind shifting redirectors: HubSpot and MailerLite campaign links, open redirects including Safe Links, altered OneDrive sharing templates and Proton accounts impersonating trusted senders. Gamaredon focuses on Ukrainian military, law enforcement, judiciary and NGO targets with high-volume phishing. See the Star Blizzard Threat Actor Profile and the Gamaredon Group Threat Actor Profile.

The criminal ecosystem around the state

AA22-110A also lists Russian-aligned criminal groups that pledged support for the state or threatened retaliation, including Wizard Spider (TrickBot and Conti), Mummy Spider (Emotet) and the Killnet DDoS group. These are not state units, but in a crisis they raise ransomware and DDoS risk for the same targets. See the Ransomware Groups Guide and the Hacktivism Guide.

Which unit matters for your organisation

Use this mapping to decide which advisories go to the top of the queue. It reflects targeting named in the sources above; it is a starting point, not a guarantee that other units will ignore you.

Shared tradecraft mapped to ATT&CK and controls

Across services, the same small set of techniques recurs. Building detections and controls on these gives coverage that survives renaming and new malware.

Where identity fits

The advisories read like an identity hygiene audit. The SVR's cloud playbook depends on accounts nobody owns: service accounts without MFA, test tenants, leaver accounts and OAuth applications with application permissions such as full_access_as_app or EWS.AccessAsUser.All. APT28 adds MFA enrolment of hijacked accounts and plaintext passwords in Group Policy Preferences. Treat these as non-human identity problems with owners, expiry and monitoring:

• Service accounts and principals: inventory every service principal and application permission in Entra ID or other tenants, remove unused grants and alert on new credentials added to existing apps. See the Consent Phishing and Illicit OAuth Grants Guide.
• Test and legacy tenants: bring non-production tenants into the same conditional access and logging baseline, or delete them.
• Canary accounts: create service accounts that no legitimate process uses, as the APT29 advisory recommends, and treat any sign-in as an incident.
• Phishing-resistant MFA: both AA25-141A and AA24-057A recommend it, and AA25-141A names passkeys and PKI smartcards. See the Phishing-Resistant MFA Guide.

Detection and hunting priorities

1. Password spray patterns: low numbers of failures per account across many accounts, especially service and test accounts, from residential or VPN address ranges. See the Password Spraying and Credential Stuffing Defence Guide.
2. OAuth and mailbox access: grants of full_access_as_app or ApplicationImpersonation, new apps created by unusual users, spikes in EWS calls and MailItemsAccessed by application identities (Microsoft's January 2024 guidance gives these alert names and a hunting query).
3. Device and MFA registration: new device joins or authentication methods added shortly after a risky sign-in.
4. NTLM to the internet: outbound SMB or WebDAV authentication to external hosts, the CVE-2023-23397 signature. See the NTLM Relay Guide.
5. Domain controller credential access: ntdsutil, shadow copy creation and registry hive exports on tier zero hosts.
6. Unexpected RMM agents: Atera, Splashtop or other remote management software appearing on servers that never had it, often after a ScreenConnect or FortiClient EMS exploitation.
7. Log clearing: wevtutil cl or Security log clear events (Event ID 1102) on any host.

Metrics that show the programme is working

• Accounts without phishing-resistant MFA: count of human, service and test accounts with only password or telephony factors, trending to zero for privileged roles.
• KEV time to remediate: median days from KEV listing to patch for internet-facing systems named in Russian advisories.
• Dormant account age: number of enabled accounts with no sign-in for 90 days.
• High-privilege OAuth grants: count of applications holding mailbox-wide or directory-wide application permissions, each with a named owner.
• Advisory turnaround: days from publication of a relevant joint advisory to completed hunt and control check.

Turning an advisory into action: a phased approach

1. Triage (day 1): read the advisory's attribution and target list, decide whether your sector, geography or suppliers are named, and assign an owner.
2. Exposure check (days 1 to 3): compare listed CVEs with your asset inventory and the KEV catalogue; patch or isolate internet-facing matches first; check whether any listed products sit in your suppliers' environments.
3. Hunt (days 2 to 7): run the advisory's behavioural detections back over 90 days or more of logs; treat IP and domain indicators as short-lived.
4. Harden (weeks 1 to 4): close identity gaps the advisory names: MFA on service and test accounts, dormant account removal, device registration restrictions, NTLM egress blocking. Pilot policy changes on a test group and keep a documented rollback (for example, conditional access policies in report-only mode first).
5. Prepare for destruction (ongoing): for sectors in Sandworm's or Ember Bear's sights, test offline restores and a rebuild of identity infrastructure. See the Identity Recovery Guide.
6. Record and review: log the advisory, actions and residual risk in the risk register and revisit at the next escalation.

Reading attribution with care

• Government attribution versus vendor clustering: a joint advisory naming a unit is the strongest public statement; vendor names track observed activity and may split or merge clusters. AA25-141A warns that industry names may not map one-to-one to US government attribution.
• Personas and false flags: NotPetya was disguised as criminal ransomware, and state groups use hacktivist-style personas. Judge by behaviour (no working decryption, destruction) as well as by claims.
• Shared infrastructure: Turla's use of Storm-0156 infrastructure shows that indicators can point to the wrong actor.
• Small versus large organisations: a small firm rarely needs a dedicated Russia programme; it needs KEV patching, phishing-resistant MFA and offline backups, which defeat most of the techniques above. A large or targeted organisation should subscribe to national CERT and ISAC feeds, map each advisory to its own telemetry and run hunts on publication. See the Threat Actor Groups Guide.

Framework mapping

Common failure patterns

• Forgotten test tenants and accounts: the Microsoft Midnight Blizzard breach began with a legacy test account without MFA and a legacy OAuth app with elevated rights.
• Exposed developer infrastructure: the TeamCity CVE-2023-42793 exploitation shows the SVR picking victims simply because their build servers were unpatched and internet-facing.
• Trusting signed updates and app identities: in the SolarWinds compromise attackers moved from a signed update to forged SAML tokens and credentials added to service principals.
• Blocking IPs instead of behaviours: residential proxies and compromised routers make IP indicators stale within days; Microsoft and the APT29 advisory both say to prioritise behavioural signals.
• Assuming you are too small: destructive attacks spread beyond their targets, as NotPetya did, and opportunistic exploitation picks anyone with the vulnerable product.
• Ignoring people's personal accounts: Star Blizzard targets personal as well as corporate mail; staff in policy and research roles need protection on both.

Practitioner checklist

• Record which Russian units are relevant to your sector, geography and suppliers, using the mapping table, and review it at each escalation.
• Subscribe to joint advisories from CISA, NCSC and your national CERT and set a turnaround target for triage and hunting.
• Enforce phishing-resistant MFA for administrators, email and remote access, then extend it to service and test accounts or replace them with workload identities.
• Run a dormant account and OAuth application review; remove mailbox-wide application permissions without an owner.
• Restrict device registration and MFA method enrolment to managed devices or verified flows.
• Patch KEV-listed mail, collaboration, CI/CD and remote management software on short deadlines; block outbound NTLM.
• Allowlist remote management tools and alert on any unapproved agent.
• Deploy EDR on domain controllers and mail servers and alert on log clearing and NTDS access.
• Test offline restores and an identity rebuild, especially if you operate in or support Ukraine.

Standards and references

• CISA and partners: AA22-110A Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
• CISA and partners: AA25-141A Russian GRU Targeting Western Logistics Entities and Technology Companies
• NCSC and partners: AA24-057A SVR Cyber Actors Adapt Tactics for Initial Cloud Access
• MITRE ATT&CK: Groups (APT28, Sandworm Team, Ember Bear, APT29, Turla, Dragonfly, Star Blizzard, Gamaredon Group)
• Microsoft: Midnight Blizzard, Guidance for Responders on Nation-State Attack
• Microsoft: The BadPilot Campaign, Seashell Blizzard Subgroup Conducts Multiyear Global Access Operation
• Microsoft: Star Blizzard Increases Sophistication and Evasion in Ongoing Attacks
• Google Cloud (Mandiant): APT44, Unearthing Sandworm

Related NHI Mgmt Group resources: Cyber Warfare Guide · China State Cyber Operations Guide · Iran State Cyber Operations Guide · Threat Actors Targeting SaaS and Cloud Identity Guide · ITDR Guide