The European Union has imposed sanctions on three Russian hackers from Unit 29155, a division of Russia’s military intelligence agency (GRU), for their involvement in cyberattacks targeting Estonia’s government agencies in 2020.
The sanctioned individuals—Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov—gained unauthorized access to sensitive data, compromising several Estonian ministries.
According to the EU Council, the hackers breached government agencies, including the Ministries of Economic Affairs, Social Affairs, and Foreign Affairs. Thousands of classified documents were stolen, including business secrets, health records, and other critical information, jeopardizing the security of the institutions. The EU noted that Unit 29155 has a history of conducting cyberattacks across Europe, targeting other member states, Ukraine, and NATO allies.
Unit 29155, also known by aliases such as Cadet Blizzard and Ember Bear, has been linked to various destabilization activities, including cyberattacks, assassinations, and sabotage. Since early 2022, the group has focused on disrupting organizations aiding Ukraine and targeting Ukrainian entities with malware and phishing campaigns.
In addition to the EU sanctions, the U.S. State Department has offered a reward of up to $10 million for information on GRU officers, including Korchagin and Denisov.
