Kinetic Killers go Digital: GRU Unit 29155 and the WhisperGate Wipers

From Assassinations to Algorithms

For years, Unit 29155 of the Russian Main Intelligence Directorate (GRU) was the Kremlin's blunt instrument. Operating out of the 161st Specialist Training Center in Moscow, they were the 'kinetic' specialists—linked to the 2018 Skripal poisoning in Salisbury and a failed coup in Montenegro. However, a joint advisory by the NSA, FBI, and CISA, alongside a massive DOJ indictment, reveals a strategic pivot: the wetwork squad has learned to code. Since 2020, this unit has deployed destructive malware against Ukraine and NATO allies, blurring the line between physical sabotage and digital destruction.

The Weapon: WhisperGate

The unit's signature operation, launched in January 2022 just prior to the full-scale invasion of Ukraine, was the deployment of WhisperGate. To the untrained eye, it looked like standard ransomware—files encrypted, ransom note delivered. But forensic analysis proved this was a ruse.

Destruction over Profit

WhisperGate was a wiper. There was no decryption key; the goal was purely to cripple Ukrainian critical infrastructure and government networks. By masquerading as a criminal ransomware gang, Unit 29155 attempted to provide the Kremlin with plausible deniability, a tactic that failed when CISA forensics linked the code directly to GRU infrastructure.

The Irony of Anonymity: The Tor Network

To conduct these operations, Unit 29155 relies heavily on the Tor network to obfuscate their Command and Control (C2) traffic and conduct reconnaissance. This usage highlights the supreme irony of modern cyber warfare: Russian military hackers are attacking Western infrastructure using technology created by the United States military.

Born in the US Navy

Tor (The Onion Router) was developed in the mid-1990s by mathematicians at the U.S. Naval Research Laboratory (NRL) to protect US intelligence communications online. The logic was simple: if only the government uses the network, the traffic is obviously government. To hide, they had to open it to the public to create 'noise.' Today, that noise protects everyone—from whistleblowers and drug vendors to GRU operatives.

The Battlefield is the Onion

While Unit 29155 uses Tor to hide their origin IPs while scanning NATO networks for vulnerabilities (CVEs), the US military and intelligence agencies still utilize the network for OSINT (Open Source Intelligence) gathering and secure field communications. It is a digital no-man's-land where the creators of the technology and their adversaries operate side-by-side, shielded by the same layers of encryption.

Operation Toy Soldier: The Indictment

The anonymity provided by Tor and VPNs ultimately failed the GRU. In an operation dubbed 'Toy Soldier,' the US Department of Justice unsealed indictments against five GRU officers and one civilian hacker.

• Col. Yuriy Denisov: The commanding officer of cyber operations.
• Lieutenants: Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov, and Nikolay Korchagin.
• Civilian Asset: Amin Stigal, a 22-year-old accused of aiding the unit in scanning US infrastructure.
• The Bounty: The US State Department is offering up to $10 million for information on their locations, effectively grounding them within Russian borders for life.

Global Reach: Beyond Ukraine

The indictment reveals that Unit 29155's ambition extended far beyond Kyiv. They are accused of probing critical infrastructure in 26 NATO member countries and even US government agencies in Maryland. This was not just a tactical support operation for the war in Ukraine; it was a strategic reconnaissance mission to map the vulnerabilities of the entire Western alliance.