--- alias: - Main Intelligence Directorate - Main Intelligence Directorate (Russia) - Glavnoye Razvedyvatelnoye Upravleniye - Russian Military Intelligence - Soviet Military Intelligence category: Intelligence & Government created: 2026-09-24 location: Moscow, Russia relations: - end: 1981 fn: 3 reverse: true start: 1979 type: informant_for with: '[[Robert Hanssen]]' - fn: 1 reverse: true role: indictment of twelve officers of Units 26165 and 74455 start: 2018-07-13 type: prosecuted with: '[[Department of Justice]]' - fn: 2 reverse: true role: indictment of five officers of Unit 29155 start: 2024-09-05 type: prosecuted with: '[[Department of Justice]]' summary: The military intelligence directorate of the Soviet and Russian General Staff, whose officers the United States indicted for the 2016 election hacks and the WhisperGate attack and Britain charged over the Salisbury poisoning. tags: - Organization - Russia - SovietUnion - Intelligence - MilitaryIntelligence - ColdWar - Cyber - ElectionInterference - Assassination updated: 2026-09-24 --- The GRU, the Main Intelligence Directorate, is the military intelligence agency of the General Staff of the Armed Forces of [Russia](/places/russia/), and before 1991 of the [Soviet Union](/places/soviet-union/).[^1][^2][^3] ### Robert Hanssen In 1979 [Robert Hanssen](/people/robert-hanssen/), a special agent of the [Federal Bureau of Investigation](/organizations/federal-bureau-of-investigation/), delivered an anonymous package to a Soviet trade office in [New York](/places/new-york-city/) that served as a front for the GRU, revealing the identity of a GRU officer who was serving as an FBI informant. Over about two years he received roughly $21,000 in cash from the GRU.[^3] ### The 2016 Election On July 13, 2018, a grand jury in the District of Columbia returned an indictment presented by the Special Counsel's Office charging twelve GRU officers, Viktor Netyksho, Boris Antonov, Dmitriy Badin, Ivan Yermakov, Aleksey Lukashev, Sergey Morgachev, Nikolay Kozachek, Pavel Yershov, Artem Malyshev, Aleksandr Osadchuk, Aleksey Potemkin and Anatoliy Kovalev, "officials in Unit 26165 and Unit 74455 of the Russian government's Main Intelligence Directorate." Deputy Attorney General Rod Rosenstein announced the charges.[^1] According to the indictment, officers of Unit 26165 began in 2016 to spearphish volunteers and employees of the presidential campaign of Hillary Clinton, including its chairman, and through stolen credentials entered the networks of the Democratic Congressional Campaign Committee and the Democratic National Committee, where they monitored the computers of dozens of employees and implanted hundreds of files of malicious code. Unit 26165 coordinated with Unit 74455 on releasing the stolen material. The officers registered DCLeaks.com, presented themselves as "American hacktivists," and promoted the site through fictitious Facebook and Twitter accounts. After public accusations that the Russian government was behind the intrusions they created the persona Guccifer 2.0; on the evening of June 15, 2016, between 4:19 and 4:56 PM, they used a Moscow-based server to search for English words and phrases that later appeared in Guccifer 2.0's first blog post, "falsely claiming to be a lone Romanian hacker." Unit 74455 also conspired to hack the computers of state boards of elections, secretaries of state, and companies that supplied election software. The operation was paid for with cryptocurrency, including bitcoin mining, and the same mining operation that paid for the DCLeaks.com registration funded the servers and domains of the spearphishing campaign.[^1] The indictment contained eleven counts, including conspiracy against the [United States](/places/united-states/), aggravated identity theft, and a conspiracy to launder the equivalent of more than $95,000. The [Department of Justice](/organizations/department-of-justice/) stated that there was no allegation that any American was a knowing participant or that the conduct altered the vote count.[^1] ### Salisbury In March 2018 Sergei Skripal and his daughter Yulia were poisoned in Salisbury with a military-grade nerve agent of a type developed by Russia, known as Novichok. Two Wiltshire Police officers who searched their home were also poisoned. In July 2018 two members of the public in Amesbury were exposed to the same agent, and one of them, Dawn Sturgess, died. On September 5, 2018, the Director of Public Prosecutions announced charges against two Russian nationals traveling as Alexander Petrov and Ruslan Boshirov, and the Prime Minister, Theresa May, announced that the government had concluded that the two men "were members of the Russian Military Intelligence Service, the GRU," and that the operation "was almost certainly approved outside the GRU at a senior level of the Russian state." Britain expelled 23 undeclared Russian intelligence officers, and 28 other countries and [NATO](/organizations/nato/) joined in an expulsion of more than 150.[^4] On September 21, 2021, the Home Secretary, Priti Patel, told Parliament that the police could now evidence that Petrov and Boshirov were aliases for Alexander Mishkin and Anatoliy Chepiga, "both members of the GRU," and that the Crown Prosecution Service had authorized charges against a third man, known as Sergey Fedotov, who had flown from Moscow to Heathrow, stayed at a central London hotel from March 2 to 4, 2018, and met the other two more than once. Fedotov was Denis Sergeev, "also a member of the GRU," and "all 3 individuals previously worked together for the GRU as part of additional operations outside Russia." On the same day the European Court of Human Rights ruled that Russia was responsible for the assassination of Alexander Litvinenko.[^4] ### Unit 29155 and WhisperGate On September 5, 2024, the Justice Department unsealed an indictment returned in [Maryland](/places/maryland/) against five officers of GRU Unit 29155 and one civilian, Amin Sitgal. The officers were Colonel Yuriy Denisov, "a commanding officer of Cyber Operations for Unit 29155," and Lieutenants Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov and Nikolay Korchagin. On January 13, 2022, according to the indictment, they used the services of a United States company to distribute the malware known as WhisperGate, "designed to look like ransomware," to dozens of Ukrainian government systems, including the Ministry of Internal Affairs, the State Treasury, the Judiciary Administration and the Ministry of Energy, when "WhisperGate was actually a cyberweapon designed to completely destroy the target computer and related data in advance of the Russian invasion of Ukraine." They exfiltrated data including patient health records, defaced websites to read "Ukrainians! All information about you has become public, be afraid and expect the worst," and offered the stolen data for sale the same day.[^2] The same officers were charged with probing systems in 26 NATO countries from August 2021, with hacking the transportation infrastructure of a Central European country that supported Ukraine in October 2022, and with probing a federal government agency in Maryland from August 5, 2021, to February 3, 2022. Assistant Attorney General Matthew G. Olsen called the campaign "emblematic of Russia's abhorrent disregard for innocent civilians." The indictment was part of an international effort, Operation Toy Soldier, accompanied by a joint cybersecurity advisory from the FBI and twelve partners representing nine countries, and the [State Department](/organizations/state-department/)'s Rewards for Justice program offered up to $10 million for information on the defendants.[^2] ### The Buma Allegation In May 2025 [Jonathan Buma](/people/jonathan-buma/), a former FBI counterintelligence special agent of sixteen years, alleged in a documentary broadcast by the German broadcaster ZDF that the GRU had targeted [Elon Musk](/people/elon-musk/) for exploitation and offered him direct contact with Vladimir Putin, and that Russian intelligence ran special operations to influence [Silicon Valley](/places/silicon-valley/) executives such as Musk and [Peter Thiel](/people/peter-thiel/), including gathering damaging information that could later be used as blackmail. "Musk's susceptibility to promiscuous women and drug use, particularly ketamine," Buma said, was "seen by Russian intelligence as an opportunity for an agent to exploit." Buma had been arrested in March 2025 and charged with one count of disclosure of confidential information for sharing material with a publishing company, and was free on $100,000 bail.[^5] [^1]: U.S. Department of Justice, Office of Public Affairs. "Grand Jury Indicts 12 Russian Intelligence Officers for Hacking Offenses Related to the 2016 Election." Press release 18-923, July 13, 2018. Archived at http://web.archive.org/web/20200104195032/https://www.justice.gov/opa/pr/grand-jury-indicts-12-russian-intelligence-officers-hacking-offenses-related-2016-election [^2]: U.S. Department of Justice, Office of Public Affairs. "Five Russian GRU Officers and One Civilian Charged for Conspiring to Hack Ukrainian Government." Press release, September 5, 2024. Archived at http://web.archive.org/web/20250207071434/https://www.justice.gov/archives/opa/pr/five-russian-gru-officers-and-one-civilian-charged-conspiring-hack-ukrainian-government [^3]: U.S. Department of Justice. *United States v. Robert Philip Hanssen: Affidavit in Support of Criminal Complaint.* United States District Court for the Eastern District of Virginia, February 2001. [^4]: Patel, Priti, Home Secretary. "The new Salisbury charging decision." Oral statement to Parliament, Home Office, September 21, 2021. https://www.gov.uk/government/speeches/the-new-salisbury-charging-decision [^5]: Pehlman, Nick. "Russian Intelligence Used Sex, Drugs to Target Elon Musk: Former FBI Agent." *Kyiv Post,* May 15, 2025. https://www.kyivpost.com/post/52742