GRU.
Russian military intelligence agency
- Reports this week
- 0
- Active events
- 2
- Connections
- 69
What's happening
Active this week
-
GRU is linked to unexplained explosions and fires at Leipzig airport hub as part of a suspected sabotage campaign across Europe.Well supported5 reports2 developments inside
-
GRU is linked to Russian state cyber operations that have targeted German political and government bodies.Well supported3 reports2 developments inside
Earlier this month
-
GRU utilized server data found in Dubai, while funds were traced back to Azerbaijan.Some support1 report
-
GRU is controlled by Russia’s intelligence services and seeks to destabilise nations standing up to NATO.Some support1 report1 development inside
-
GRU conducted cyber espionage against NATO defense organizations, utilizing Microsoft Edge and reverse SSH tunnels.Some support1 report
-
Investigations in Europe link security incidents to GRU-related suspects.Some support1 report3 developments inside
-
GRU utilized European agents to carry out sabotage operations.Some support1 report
One to three months ago
-
Diana retaliates against nerve agent attacks, prompting GRU to use a list for counter-retaliation.Some support1 report
-
GRU agents infiltrated Ukrainian companies to seek targets within the Ukrainian defense sector.Some support1 report
-
Grozev identified GRU officers behind poisonings, revealing how Russian intelligence used a guesthouse in Great Yarmouth for a foreign operation prosecuted by the CPS.Some support2 reports1 development inside
-
GRU ordered arson in the Czech Republic, orchestrated by Adrian, who acted on behalf of the Russian intelligence agency.Some support1 report
-
Joshua Cammidge researched drone sites in Swindon, connecting to the high-tech surveillance project.Some support1 report
-
GRU is involved in security services competing for control of lucrative businesses.Some support1 report
-
Sanctions are being imposed on individuals and entities, with the GRU being mentioned in the context of Russia's war against Ukraine.Well supported8 reports1 development inside
-
An agency manages assets of sanctioned oligarch Mikhail Fridman while GRU conducts cyber espionage against Ukrainian asset recovery bureaucracy.Some support1 report
-
FSB is suspected of targeting diplomatic missions, while GRU seeks to destabilize Western democracies, involving the Austrian Armed Forces and Klaudia Tanner.Some support1 report
Gone quiet
No new reports in 90+ days-
GRU launched disinformation campaigns targeting French figures Léa Salamé and Edwy Plenel, while Viginum monitors the interference.Some support1 report
-
GRU used network weak points to attack Critical National Infrastructure in Russia.Some support2 reports1 development inside
-
Alleged infiltration of the national parliament by GRU on July 20, 2026.Some support1 report
-
IISS published findings regarding a specific espionage campaign allegedly carried out by GRU.Some support1 report1 development inside
-
Russia uses shadow fleet with intelligence assets.Some support1 report
-
Japan's high-tech industry is being used to aid the Russian war effort, with components being laundered through third countries and the GRU using Japan as an espionage base.Some support3 reports1 development inside
-
GRU officers were operating in Rome, Italy, seeking air defense information for Ukraine.Some support2 reports
-
Suspected GRU involvement in attempted assassination plot against Keir Starmer.Some support1 report
No events began in the chosen period. Widen it, or reset.
What's reaching GRU
Events traced to GRU, step by step, newest firstAround GRU this week
News at the entities that move GRU most-
Kremlin StructuralKremlin and Mohsen Rezaei are negotiating the supply of advanced air defense systems and discussing regional security.Moves GRU
-
London OperationalFilm industry news highlights include Gutiérrez's film being shortlisted by Cinema Eye Honors and various festival screenings in London and Amsterdam.Moves GRU
-
Security Service of Ukraine OperationalNABU is conducting anti-corruption raids and investigating SBU officials for corruption in Ukraine.Moves GRU
-
Gainesville Shared contextState education funding issues are impacting local schools in Gainesville, Florida.Moves GRU
-
Microsoft OperationalDemocrats gained control of both chambers of Congress while major tech companies like Amazon, Microsoft, and Meta continue to deploy AI infrastructure in the US.Moves GRU
-
Keir Starmer OperationalCharity supports displaced communities in Gaza while political figures pressure UK on arms sales and Hamas links emerge.Moves GRU
Connections
The 40 strongest of 69, analyzed from the reporting. The bars show how strongly a change on one side reaches the other.-
Kremlin Structural
The Kremlin relies on GRU for its operational functions.
-
Keir Starmer Operational
Evidence suggests GRU involvement in a suspected attempted assassination plot targeting Keir Starmer.
-
Sergei Skripal Transactional
GRU is linked to the attempted murder of Sergei Skripal.
-
Adrian Structural
Adrian is documented as acting as an agent on behalf of the GRU.
-
Kyiv Operational
GRU is actively seeking operational information regarding Kyiv, including air defense details for Ukraine.
-
NATO Operational
GRU actively seeks to destabilize nations and targets NATO defense organizations.
-
Czech Republic Operational
GRU was found to have ordered arson attacks within the territory of the Czech Republic.
-
Crimea Transactional
GRU was involved in the annexation of the territory of Crimea.
Show all 40 connections
-
Security Service of Ukraine Operational
The relationship involves active operational counter-intelligence between the two security services.
-
Kingdom of Great Britain Transactional
GRU targets intelligence agency officers of the Kingdom of Great Britain through sanctions.
-
Léa Salamé Operational
GRU carried out a targeted operation against Léa Salamé using fabricated audio and text.
-
Edwy Plenel Operational
GRU targeted Edwy Plenel through a disinformation campaign.
-
TCP Structural
GRU utilized the TCP protocol for establishing a reverse SSH tunnel.
-
Bucharest Operational
GRU has utilized Bucharest as a base or source for recruitment activities.
-
Crown Prosecution Service Operational
The Crown Prosecution Service is actively investigating and prosecuting alleged contacts involving the Russian military intelligence service GRU.
-
Swindon Operational
GRU is actively targeting drone manufacturing sites located within the area of Swindon.
-
Douglas Beck Structural
Douglas Beck was previously employed by the GRU.
-
Aeroflot Operational
GRU utilizes Aeroflot officers and infrastructure for intelligence cover operations.
-
Chippenham Shared context
GRU operates from a base in Chippenham.
-
Microsoft Operational
GRU was observed utilizing Microsoft Edge for espionage purposes.
-
Damien Operational
Damien provided a list to a Russian contact, indicating direct operational interaction with GRU's sphere.
-
Leipzig Shared context
GRU utilized Leipzig as a location for a cargo hub involved in shipments destined for Ukraine.
-
Aleksandr Krasiy Structural
Leaked databases link Aleksandr Krasiy to the GRU, indicating an affiliation.
-
London Operational
The UK government, whose center of power is London, has formally designated GRU as a threat.
-
Swindon Operational
GRU is actively seeking intelligence on drone manufacturing sites located within Swindon.
-
Matthew Cole Mentioned together
Matthew Cole reports on the actions and compromises carried out by the GRU.
-
Christo Grozev Operational
Christo Grozev identified GRU officers responsible for poisonings.
-
JANE Operational
GRU actively retaliated against JANE using a list.
-
Gainesville Shared context
GRU operates within Gainesville and is involved in legal proceedings with the city.
-
SIS Operational
SIS is actively monitoring potential threats associated with GRU.
-
Armed Forces of Ukraine Operational
GRU is actively seeking targets within the Ukrainian defense sector.
-
International Institute for Strategic Studies Mentioned together
IISS published findings regarding GRU's espionage activities.
-
Jared Kushner Transactional
GRU compromised Jared Kushner's iPhone X in 2017.
-
England Shared context
GRU conducts hostile operations and maintains a volunteer corps within England.
-
Slovakia Shared context
GRU agents are reported to be operating from Slovakia.
-
Great Yarmouth Shared context
The town of Great Yarmouth served as a location utilized by the GRU, specifically providing guesthouse accommodation.
-
Madagascar Shared context
The relationship is observed as a geopolitical backdrop where GRU's influence operations are reported to be active in Madagascar.
-
Lithuania Shared context
Evidence suggests GRU's actions are situated in the geopolitical region of Lithuania, specifically involving organized incendiary device crimes.
-
Dubai Shared context
GRU accessed server data that was physically located in Dubai.
-
Diana Mentioned together
Diana is mentioned in the context of retaliation related to nerve agent attacks.
History
Events by the month they beganOctober 2026
4 events- GRU utilized server data found in Dubai, while funds were traced back to Azerbaijan.
- GRU conducted cyber espionage against NATO defense organizations, utilizing Microsoft Edge and reverse SSH tunnels.
- GRU utilized European agents to carry out sabotage operations.
- Diana retaliates against nerve agent attacks, prompting GRU to use a list for counter-retaliation.
September 2026
7 events- GRU is linked to unexplained explosions and fires at Leipzig airport hub as part of a suspected sabotage campaign across Europe.
- GRU is controlled by Russia’s intelligence services and seeks to destabilise nations standing up to NATO.
- Investigations in Europe link security incidents to GRU-related suspects.
- GRU agents infiltrated Ukrainian companies to seek targets within the Ukrainian defense sector.
- GRU ordered arson in the Czech Republic, orchestrated by Adrian, who acted on behalf of the Russian intelligence agency.
- Joshua Cammidge researched drone sites in Swindon, connecting to the high-tech surveillance project.
- GRU is involved in security services competing for control of lucrative businesses.
August 2026
4 events- GRU is linked to Russian state cyber operations that have targeted German political and government bodies.
- An agency manages assets of sanctioned oligarch Mikhail Fridman while GRU conducts cyber espionage against Ukrainian asset recovery bureaucracy.
- FSB is suspected of targeting diplomatic missions, while GRU seeks to destabilize Western democracies, involving the Austrian Armed Forces and Klaudia Tanner.
- GRU launched disinformation campaigns targeting French figures Léa Salamé and Edwy Plenel, while Viginum monitors the interference.
Show 2 earlier months
July 2026
7 events- Sanctions are being imposed on individuals and entities, with the GRU being mentioned in the context of Russia's war against Ukraine.
- GRU used network weak points to attack Critical National Infrastructure in Russia.
- Alleged infiltration of the national parliament by GRU on July 20, 2026.
- IISS published findings regarding a specific espionage campaign allegedly carried out by GRU.
- Russia uses shadow fleet with intelligence assets.
- Japan's high-tech industry is being used to aid the Russian war effort, with components being laundered through third countries and the GRU using Japan as an espionage base.
- GRU officers were operating in Rome, Italy, seeking air defense information for Ukraine.