The United Kingdom said it will continue working with NATO partners and the European Union to address future cyberthreats of the Russian military intelligence directorate, or GRU.
The move comes as London announced Friday that it was sanctioning three GRU units and over 20 Russian spies, hackers and agencies that were identified as using advanced cyber tactics to spy on governments and institutions in Europe.
Book a seat at the 2025 GovCon International Summit on Oct. 16 for more insights on global collaboration to support national and regional security.
One of the U.K. sanctions covers GRU Unit 26165, which the U.K. government said was behind the development of the X-Agent and X-Tunnel malware for cyber intrusions, including support of combat operations. The GRU unit reportedly deployed X-Agent for geolocation to enable Russian artillery strikes against Ukrainian positions.
Microsoft Outlook Vulnerabilities
Also known as APT28, the 26165 unit was also inked to the exploitation of Microsoft Outlook vulnerabilities to conduct cyber espionage campaigns against national governments. According to a Reuters report, Britain’s National Cyber Security Centre said the unit has developed malware to harvest Microsoft login credentials.
Other operations traced to 26165 include cyberattacks on the 2024 Paris Olympic and Paralympic Games in France.
Infrastructure Targets
The U.K.’s sanction list also includes GRU Unit 29155, known for its malware called “WhisperGate,” which it said was deployed not only in Ukraine’s government systems in the buildup to the Russian invasion but also in cyberattacks against Estonia, the United Kingdom and the United States.
The third sanctioned entity is GRU Unit 74455, which mainly targets critical national infrastructure and industrial control systems. Kyiv identified the unit as responsible for the December 2023 attack on the Kyivstar telecommunications channels that affected 24 million customers.