The GRU Cyber Warfare Division

Military Unit 26165, also known as APT28 or "Fancy Bear", is the specialized cyber espionage department of the Russian General Staff’s Main Directorate (GRU). It specializes in SIGINT, unauthorized network intrusions, and satellite target acquisition.

Reconnaissance Preceding the Mariupol Drama Theatre Bombing

Digital forensic evidence indicates that Unit 26165 operatives conducted cyber surveillance and digital reconnaissance of telecommunications in Mariupol in March 2022, facilitating the coordinates fed to Russian strategic bombers that struck the Mariupol Drama Theatre, killing hundreds of sheltering civilians.