# Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage Campaign Against Europe's Ukraine Defence Supply Chain

> Truesec documents a sustained Russian intelligence campaign — GRU Unit 26165 (85th GTsSS, aka APT28/Fancy Bear/Forest Blizzard/BlueDelta) for cyber and logistics-targeting operations — combining physical surveillance, sabotage, cyber espionage and public intimidation against European defence manufacturers, logistics firms and technology suppliers backing Ukraine. Named targets include Donaustahl (CEO Stefan Thumann surveilled by two recruited agents, Dec 2025-Mar 2026) and Rheinmetall (CEO Armin Papperger, 2024 assassination plot disrupted by US/German intelligence). In April 2026 Russia's Ministry of Defence published addresses of 21 European drone-production and component sites across the UK, Germany, Netherlands, Denmark, Latvia, Lithuania, Poland, Czechia, Spain, Italy, Turkiye and Israel, which Security Council Deputy Chairman Dmitry Medvedev publicly called a list of "potential targets."

- **Published:** 2026-08-16T00:00:00Z
- **Last reviewed:** 2026-08-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2031
- **ID:** TL-2026-2031
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** GRU Unit 26165 (Russia)
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-23397, CVE-2023-38831, CVE-2021-44026, CVE-2020-35730, CVE-2020-12641

## Description

Since 2022, GRU Unit 26165 (Russia's General Staff Main Intelligence Directorate, 85th Main Special Service Center / GTsSS, publicly tracked as APT28, Fancy Bear, Forest Blizzard and BlueDelta) has run a multi-year, multi-vector campaign against the European supply chain sustaining Ukraine's defence. Truesec's August 2026 report ties together three converging lines of activity attributed to Russian state intelligence.

First, physical surveillance and intimidation of defence-industry executives: German investigators (per Die Zeit) allege that a Ukrainian national (Serhii N.) and a Romanian national (Alla S.), operating as recruited 'disposable' agents contacted via Telegram, filmed and photographed the home and headquarters of Donaustahl CEO Stefan Thumann between December 2025 and March 2026, with both arrested in a coordinated Spain/Germany operation in March 2026 and charged with acting as agents of a foreign intelligence service. This mirrors the pattern behind the July 2024 plot against Rheinmetall CEO Armin Papperger, in which US intelligence warned German authorities in time to disrupt an assassination attempt tied to Rheinmetall's build-out of an armoured-vehicle plant in Ukraine.

Second, a documented cyber-espionage program: CISA/NSA/FBI/NCSC-UK joint advisory AA25-141A (May 2025, building on an April 2026 follow-on advisory referenced by Truesec) attributes a two-year campaign by Unit 26165 against Western logistics entities and technology companies coordinating the transport and delivery of Ukraine aid. Initial access combined credential guessing/brute forcing (routed through Tor and compromised SOHO routers/VPNs for anonymization), targeted spearphishing in the recipient's local language, and exploitation of known vulnerabilities in Microsoft Outlook (CVE-2023-23397, forced NTLM authentication leak), WinRAR (CVE-2023-38831, archive content-type spoofing) and Roundcube webmail (CVE-2021-44026, CVE-2020-35730, CVE-2020-12641). Post-compromise activity used the HEADLACE credential-phishing/LNK-dropper backdoor, the Python-based MASEPIE file-transfer/remote-access tool, and the OCEANMAP and STEELHOOK backdoors; persistence via scheduled tasks, registry Run keys/startup-folder LNK files and Exchange mailbox-permission abuse; defense evasion via Windows Event Log clearing (wevtutil); credential access via NTDS.dit extraction, GPP password recovery and Certipy ADCS abuse; lateral movement via RDP, Impacket WMIEXEC and PAExec; and exfiltration of .pst/.ost mail archives and shipment manifests over encrypted mail protocols, custom OpenSSH binaries and, in some cases, abused third-party webhook-relay services (webhook.site, pipedream.net, mockbin.org) as low-noise C2/exfil relays. A related, tactically linked sub-campaign hijacked internet-facing IP cameras at logistics sites and border crossings via crafted RTSP requests and brute-forced credentials — over 80% of targeted cameras in Ukraine, with a high concentration also in Romania and Poland — to visually track aid-shipment movements, feeding the same targeting picture used for the physical operations.

Third, sabotage and information-operations pressure: CSIS's March 2025 'Russia's Shadow War Against the West' dataset recorded Russian-linked arson/explosive incidents in Europe rising from 1 in 2023 to 26 in 2024 (at least 6 more in 2025), roughly 28% against transportation targets and 28% against government targets; incidents tied to the same actor set include a May 2024 arson at a Berlin Diehl Group munitions-linked facility and explosives intercepted at the Serbian-Hungarian border in June 2026 in a truck bound for Bavaria, where investigators have not ruled out a second executive-targeting plot. In April 2026, Russia's Ministry of Defence published two target lists — 'Branches of Ukrainian Companies in Europe' (11 sites) and 'Foreign Enterprises Producing Components' (10 sites) — naming drone and component manufacturers across 12 countries, after which Medvedev stated on X that the list 'must be taken literally... a list of potential targets for the Russian armed forces,' explicitly fusing the surveillance/cyber-espionage targeting picture with a public threat of kinetic strikes.

Taken together, the campaign represents a hybrid warfare posture: cyber-espionage and IP-camera surveillance build the targeting picture, recruited 'disposable' human agents conduct physical surveillance and pre-attack reconnaissance, and sabotage/assassination planning plus public information operations (Medvedev's threats) convert that intelligence into intimidation and, potentially, kinetic action against a supply chain no single company or nation can defend against in isolation.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1110 Brute Force
- T1187 Forced Authentication
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1021 Remote Services
- T1114 Email Collection
- T1125 Video Capture
- T1560 Archive Collected Data
- T1090 Proxy
- T1573 Encrypted Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Russia Targets Businesses and Officials Behind Europe's Ukraine Defence Supply Chain](https://www.truesec.com/hub/blog/russia-targets-businesses-and-officials-behind-europes-ukraine-defence-supply-chain)
- [Russian GRU Targeting Western Logistics Entities and Technology Companies (AA25-141A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a)
- [Response to CISA Advisory (AA25-141A)](https://www.attackiq.com/2025/05/21/response-to-cisa-advisory-aa25-141a/)
- [Russian Unit 26165 Targets Western Logistics and Technology Companies](https://www.picussecurity.com/resource/blog/russian-unit-26165-targets-western-logistics-and-technology-companies)
- [US CERT Alert AA25-141A: SafeBreach Coverage](https://www.safebreach.com/blog/safebreach-coverage-for-us-cert-aa25-141a-russian-gru-espionage/)
- [Detect APT28 Attacks: Russian GRU Unit 26165 Targets Western Logistics and Technology Companies Coordinating Aid to Ukraine](https://socprime.com/blog/detect-apt28-attacks-against-western-companies-coordinating-aid-to-ukraine/)
- [Rheinmetall: US and Germany foiled Russian plot to assassinate Armin Papperger CEO](https://www.cnn.com/2024/07/11/politics/us-germany-foiled-russian-assassination-plot/index.html)
- [Foiled Assassination Plot on Rheinmetall CEO Armin Papperger](https://bisi.org.uk/reports/foiled-assassination-plot-on-rheinmetall-ceo-armin-papperger)
- [Russian secret services plotted assassination of German drone manufacturer chief](https://www.pravda.com.ua/eng/news/2026/08/05/8047393/)
- [The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them](https://euromaidanpress.com/2026/08/06/the-throwaway-agents-moscow-sent-after-a-bavarian-drone-boss-arming-ukraine-and-how-germany-stopped-them/)
- [Germany Thwarts Russian Plot to Assassinate Executive of Donaustahl, Drone Supplier to Ukraine](https://militarnyi.com/en/news/germany-thwarts-plot-donaustahl-executive/)
- ['Potential targets': Russia threatens European firms producing drones for Ukraine](https://www.pravda.com.ua/eng/news/2026/04/16/8030425/)
- [Russia's Defense Ministry publishes list of European drone manufacturers, and a Kremlin official calls them potential military targets](https://meduza.io/en/news/2026/04/15/russia-s-defense-ministry-publishes-list-of-european-drone-manufacturers-and-a-kremlin-official-calls-them-potential-military-targets)
- [Medvedev to help: The Poles found two of their cities in the list of targets of the Ministry of Defense](https://eadaily.com/en/news/2026/04/18/medvedev-to-help-the-poles-found-two-of-their-cities-in-the-list-of-targets-of-the-ministry-of-defense)
- [Russia's Shadow War Against the West](https://csis-website-prod.s3.amazonaws.com/s3fs-public/2025-04/hb250318_Jones_Shadow_War.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2031