Top secret Russian unit seeking to destabilise Europe, security officials say

First came a destabilisation campaign in Moldova, followed by the poisoning of an arms dealer in Bulgaria and then a thwarted coup in Montenegro. Last year, there was an attempt to assassinate a former Russian spy in Britain using a nerve agent. Though the operations bore the fingerprints of Russia’s intelligence services, authorities initially saw them as isolated, unconnected attacks.

Western security officials have now concluded that these operations, and potentially many others, are part of a coordinated and ongoing campaign to destabilise Europe, executed by an elite unit inside the Russian intelligence system skilled in subversion, sabotage and assassination.

The group, known as Unit 29155, has operated for at least a decade, yet Western officials only recently discovered it. Intelligence officials in four Western countries say it is unclear how often the unit is mobilised and warn that it is impossible to know when and where its operatives will strike.

The purpose of Unit 29155, which has not been previously reported, underscores the degree to which Russian president Vladimir Putin is actively fighting the West with his brand of so-called hybrid warfare — a blend of propaganda, hacking attacks and disinformation — as well as open military confrontation.

“I think we had forgotten how organically ruthless the Russians could be,” said Peter Zwack, a retired military intelligence officer and former defence attache at the US Embassy in Moscow, who said he was not aware of the unit’s existence.

In a text message, Dmitry Peskov, Mr Putin’s spokesman, directed questions about the unit to the Russian Defence Ministry. The ministry did not respond to requests for comment.

Hidden behind concrete walls at the headquarters of the 161st Special Purpose Specialist Training Centre in eastern Moscow, the unit sits within the command hierarchy of the Russian military intelligence agency, widely known as the GRU.

Though much about GRU operations remains a mystery, Western intelligence agencies have begun to get a clearer picture of its underlying architecture. In the months before the 2016 presidential election, US officials say two GRU cyber units, known as 26165 and 74455, hacked into the servers of the Democratic National Committee and the Clinton campaign, and then published embarrassing internal communications.

Last year, Robert Mueller, the special counsel overseeing the inquiry into Russian interference in the 2016 elections, indicted more than a dozen officers from those units, though all still remain at large. The hacking teams mostly operate from Moscow, thousands of miles from their targets.

By contrast, officers from Unit 29155 travel to and from European countries. Some are decorated veterans of Russia’s bloodiest wars, including in Afghanistan, Chechnya and Ukraine. Its operations are so secret, according to assessments by Western intelligence services, that the unit’s existence is most likely unknown even to other GRU operatives.

The unit appears to be a tight-knit community. A photograph taken in 2017 shows the unit’s commander, Major General Andrei Averyanov, at his daughter’s wedding in a grey suit and bow tie. He is posing with Colonel Anatoly Chepiga, one of two officers suspected of carrying out the poisoning of former double agent Sergei Skripal in Salisbury in March 2018.

“This is a unit of the GRU that has been active over the years across Europe,” said one European security official, who spoke on condition of anonymity to describe classified intelligence matters. “It’s been a surprise that the Russians, the GRU, this unit, have felt free to go ahead and carry out this extreme malign activity in friendly countries. That’s been a shock.”

To varying degrees, each of the four operations linked to the unit attracted public attention, even as it took time for authorities to confirm that they were connected. Western intelligence agencies first identified the unit after the failed 2016 coup in Montenegro, which involved a plot by two unit officers to kill the country’s prime minister and seize the parliament building.

But officials began to grasp the unit’s specific agenda of disruption only after the March 2018 poisoning of Mr Skripal, a former GRU officer who had betrayed Russia by spying for the British. Skripal and his daughter, Yulia, fell grievously ill after exposure to a highly toxic nerve agent, but survived.

Three other people were sickened, including a police officer and a man who found a small bottle that British officials believe was used to carry the nerve agent and gave it to his girlfriend. The girlfriend, Dawn Sturgess, died after spraying the nerve agent on her skin, mistaking the bottle for perfume.

The poisoning led to a geopolitical standoff, with more than 20 nations, including the United States, expelling 150 Russian diplomats in a show of solidarity with Britain.

Ultimately, British authorities exposed two suspects, who had travelled under aliases but were later identified by the investigative site Bellingcat as Mr Chepiga and Alexander Mishkin. Six months after the poisoning, British prosecutors charged both men with transporting the nerve agent to Mr Skripal’s home in Salisbury, England, and smearing it on his front door.

But the operation was more complex than officials revealed at the time.

Exactly a year before the poisoning, three Unit 29155 operatives travelled to Britain, possibly for a practice run, two European officials said. One was Mr Mishkin. A second man used the alias Sergei Pavlov. Intelligence officials believe the third operative, who used the alias Sergei Fedotov, oversaw the mission.

Soon, officials established that two of these officers — the men using the names Fedotov and Pavlov — had been part of a team that attempted to poison Bulgarian arms dealer Emilian Gebrev in 2015. (The other operatives, also known only by their aliases, according to European intelligence officials, were Ivan Lebedev, Nikolai Kononikhin, Alexey Nikitin and Danil Stepanov.)

The team would twice try to kill Mr Gebrev, once in Sofia, the capital, and again a month later at his home on the Black Sea.

Unit 29155 is not the only group authorised to carry out such operations, officials said. British authorities have attributed the 2006 killing of Alexander Litvinenko to the Federal Security Service, the intelligence agency once headed by Putin that often competes with the GRU.

Although little is known about Unit 29155 itself, there are clues in public Russian records that suggest links to the Kremlin’s broader hybrid strategy.

A 2012 directive from the Russian Defence Ministry assigned bonuses to three units for “special achievements in military service.” One was Unit 29155. Another was Unit 74455, which was later involved in the 2016 election interference. The third was Unit 99450, whose officers are believed to have been involved in the annexation of the Crimean Peninsula in 2014.

A retired GRU officer with knowledge of Unit 29155 said that it specialised in preparing for “diversionary” missions, “in groups or individually — bombings, murders, anything.”

“They were serious guys who served there,” the retired officer said. “They were officers who worked undercover and as international agents.”

The New York Times