iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Russia-linked cyber activity targeting Ukraine spans espionage, destructive attacks and access operations—not one coordinated list of five interchangeable “hacker groups.” The five examples below are actors identified in UK Government and Microsoft reporting. Their names come from different attribution systems, and some labels overlap; this is an evidence-based selection, not a definitive ranking or an official five-group roster.
Why the names do not map neatly to five separate groups
Cybersecurity reporting may name a military or intelligence unit, a vendor-tracked activity cluster, or a public-facing hacktivist identity. Those labels are not always equivalent. The UK Government identifies GRU units 26165 and 74455, while Microsoft uses names including Seashell Blizzard and Secret Blizzard. Microsoft says Seashell Blizzard overlaps with industry labels such as Sandworm and APT44; that does not mean every report using those names describes an identical set of operators or campaigns. The UK’s GRU cyber and hybrid threat profile and Microsoft’s reporting use different naming and attribution frameworks.
The five profiles below therefore identify the reporting label and the attribution attached to it, rather than treating each name as a universally agreed organizational identity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Five Russia-linked examples reported in activity targeting Ukraine
| Reporting label | Attribution in the cited reporting | Reported focus |
|---|---|---|
| GRU Unit 74455 / Seashell Blizzard | UK Government identifies Unit 74455; Microsoft describes Seashell Blizzard as acting on behalf of the GRU unit. | Destructive operations and persistent access affecting Ukrainian strategic sectors. |
| GRU Unit 26165 / APT28 | UK Government describes Unit 26165; APT28 is an associated industry label. | Intelligence collection and hack-and-leak operations. |
| Secret Blizzard | Microsoft reports a Russia-linked actor; CISA attributes it to FSB Center 16. | Placing its own backdoors on Ukrainian military devices, including after access associated with other actors. |
| Aqua Blizzard | Microsoft attributes the actor to Russia’s FSB. | An intrusion into a Ukrainian investigative body. |
| Midnight Blizzard | Microsoft attributes the actor to Russia’s SVR. | A compromise of a legal organization with international responsibilities. |
1. GRU Unit 74455 / Seashell Blizzard
The UK Government describes Unit 74455 as a destructive cyber actor targeting Ukrainian military, government and critical infrastructure. Microsoft says Seashell Blizzard conducts activity on behalf of GRU Unit 74455 and notes overlaps with names including Sandworm and APT44. Treat these as related reporting labels, not as guaranteed synonyms for every incident.
#1 Best Overall
Microsoft’s February 2025 account of the BadPilot campaign describes a multiyear access operation and persistent targeting in Ukraine. It lists energy, water, government, military, transport and logistics, manufacturing, telecommunications, and supporting civilian infrastructure among the strategic targets. Reported methods include tailored intrusions, phishing, exploitation of internet-facing infrastructure, trojanized software, and supply-chain or managed-service-provider access. See Microsoft’s BadPilot campaign report.
2. GRU Unit 26165 / APT28
The UK Government characterizes Unit 26165 as conducting intelligence gathering and hack-and-leak operations against Ukraine and other countries. Its listed techniques include spear phishing, brute force, social engineering and vulnerability exploitation. The UK profile also describes an operation that used internet-connected cameras to map assistance flows to Ukraine across several countries. APT28 is an industry tracking name associated with the unit, rather than a separate UK unit designation.
3. Secret Blizzard
Microsoft’s December 2024 reporting describes Secret Blizzard using access associated with other actors to install its own Tavdig and KazuarV2 backdoors on Ukrainian military devices. The report says observed footholds included Amadey bot activity and a backdoor associated with Storm-1837. Microsoft was investigating whether Secret Blizzard bought access or commandeered it, so the precise route of access should not be treated as settled. CISA attributes Secret Blizzard to FSB Center 16; Microsoft lists Turla among overlapping industry names. These qualifications and observations appear in Microsoft’s Secret Blizzard report.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →4. Aqua Blizzard
Microsoft attributes Aqua Blizzard to Russia’s FSB and describes an intrusion into a Ukrainian investigative body. That account appears in Microsoft’s Russia-Ukraine War cyber threat intelligence reporting, which also covers other Russian-linked activity. Aqua Blizzard is a vendor tracking label; the cited account does not establish that it is a formal Russian unit name.
Rank #3
5. Midnight Blizzard
Microsoft attributes Midnight Blizzard to Russia’s SVR and reports a compromise of a legal organization with international responsibilities. As with Aqua Blizzard, this is a vendor tracking name, not a unit designation in the UK profile. The incident is described in Microsoft’s war-related threat intelligence report.
Other actors and public-facing fronts complicate the picture
Storm-1837 and Turla reporting
Storm-1837 is a separate Microsoft-tracked Russia-based actor, not one of the five profiles above. Microsoft says it has targeted devices used by Ukrainian military drone operators since December 2023, including with PowerShell and Android backdoors. In one case, Microsoft assessed that Secret Blizzard used a Storm-1837 backdoor to deliver its own malware. That is an assessment about a specific observed case, not proof of a permanent relationship between the actors.
CERT-EU’s December 2024 brief summarizes Microsoft reporting that Turla used spear phishing and Amadey bots to deploy Tavdig and KazuarV2 backdoors on Ukrainian military devices. The brief also summarizes Recorded Future reporting that BlueAlpha had targeted Ukrainian organizations since 2014. These reports illustrate why actor names can overlap across vendors and why a list of five cannot capture all Russia-linked activity. See CERT-EU Cyber Brief 25-01.
Free tools Windows power users keep installed
One-click scans. No signup required.
Hacktivist fronts and claims
Microsoft reports interaction between Seashell Blizzard and the public-facing identities Solntsepek, InfoCentr and Cyber Army of Russia. These outlets typically conduct lower-complexity actions such as distributed denial-of-service (DDoS) attacks and leaks of Ukrainian personal information. Microsoft cautions that interaction may reflect short-term use and does not by itself demonstrate that the state-linked actor controls those identities. A claim posted by a hacktivist front is therefore not, on its own, proof of who directed or carried out an operation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the attacks have done—and what the figures mean
The UK Government attributes several disruptive incidents to GRU Unit 74455. The incidents show distinct effects; their figures should not be added together or taken as a measure of the overall scale of cyber activity in Ukraine.
- 2015 electricity disruption: the UK profile says a BlackEnergy operation left 230,000 people without power for between one and six hours.
- 2016 electricity disruption: the UK profile says an Industroyer operation left a fifth of Kyiv without power for more than an hour.
- December 2023 telecommunications disruption: the UK profile attributes an operation against Kyivstar, Ukraine’s largest provider, to Unit 74455 based on the SBU’s naming. Kyivstar served 24 million customers; that is the provider’s customer count, not a count of people confirmed to have lost service.
These attributions and incident details are in the UK Government’s GRU profile.
How cyber operations fit into Russia’s military aims, according to the UK
The UK Government says GRU cyber activity since Russia’s full-scale invasion has served several aims: gathering intelligence and battlefield advantage, pairing cyber effects with physical operations, applying psychological pressure, and developing capabilities. The UK also says Ukraine has been used as a testing ground for cyber capabilities integrated into Russian military doctrine since 2014. These are the UK Government’s assessments, not independently established descriptions of every operation.
The practical distinction is important: espionage can support intelligence collection without visibly disrupting a service; destructive operations seek to damage or interrupt systems; and access operations can establish a foothold that another actor later uses. The reporting summarized here documents all of these patterns, but it does not provide a single comparable measure of the total scale of Russia-linked cyber activity in Ukraine.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
