EU sanctions Russian GRU hackers for cyberattacks against Estonia

The European Union sanctioned three hackers, part of Unit 29155 of Russia’s military intelligence service (GRU), for their involvement in cyberattacks targeting Estonia’s government agencies in 2020.

Today, the Council of the EU says that GRU officers Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov stole thousands of sensitive documents containing classified information after breaching several Estonian ministries.

“The cyber-attacks granted attackers unauthorized access to classified information and sensitive data stored within several government ministries, —including Economic Affairs and Communications, Social Affairs, and Foreign Affairs—leading to the theft of thousands of confidential documents,” the Council added in a press release.

“These documents included business secrets, health records, and other critical information compromising the security of the affected institutions. Unit 29155 is also responsible for conducting cyber-attacks against other EU member states and partners, notably Ukraine.”

The EU also sanctioned Unit 29155 in December for its involvement in assassinations and various destabilization activities (including bombings and cyber-attacks) across Europe.

Since 2020, the group—also known as Cadet Blizzard, Ember Bear, Frozenvista, UAC-0056, and UNC2589—has orchestrated sabotage attempts throughout Europe and cyberattacks against NATO members and countries in North America, Europe, Latin America, and Central Asia.

More recently, it has switched to disrupting efforts targeting organizations providing aid to Ukraine since early 2022. Since at least March 2021, Ember Bear has also targeted Ukrainian entities with backdoors, information stealers, and fake ransomware primarily delivered via phishing emails.

In September 2024, the United States and its allies linked this Russian military hacking group with cyberattacks targeting global critical infrastructure.

The U.S. State Department has also announced a reward of up to $10 million for information on Vladislav Borovkov, Denis Igorevich Denisenko, Yuriy Denisov, Dmitry Yuryevich Goloshubov, and Nikolay Aleksandrovich Korchagin, five Russian military intelligence officers believed to be part of GRU’s Unit 29155.