1.0 Introduction 

The Main Directorate of the General Staff of the Armed Forces of the Russian Federation, commonly known by its acronym GRU (Glavnoe Razvedyvatelnoe Upravlenie), is Russia’s military intelligence agency, founded officially in 1918. Unlike the country’s civilian spy services, the GRU is embedded in the military chain of command, reporting to the Minister of Defence and the Chief of General Staff. Long known for secrecy and deniability, the GRU has evolved from a Cold War intelligence collector into a service increasingly associated with cyber operations, sabotage, assassination, and other high risk foreign missions, making it one of Russia’s most closely scrutinised security institutions today. The GRU has been linked to a wide array of hostile actions – including the Novichok poisoning on Yulia and Sergei Skripal, destructive cyber attacks across the globe, and recruiting “disposable” operatives in foreign states to carry out missions – all of which have driven sanctions against the service and its personnel by governments around the world.

2.0 History, Motto, Symbols

2.1 History

Origins and Early Years

In the aftermath of the Russian Revolution of 1917, and the outbreak of Russian Civil War, Bolshevik leaders recognised the need for a dedicated military intelligence service to protect the new revolutionary state and support Red Army operations amid civil war and foreign intervention, or the “counterrevolutionaries.” [source] 

In November 1918, the Revolutionary Military Council established a central intelligence organ called the Registration Department (Razvedupr). Administratively, it was the Third Department of the Field Staff’s Operations Directorate, placing it within the Red Army’s Field Staff (Polevoi Shtab) command structure. This department is widely regarded as the earliest incarnation of Soviet military intelligence and a precursor to the GRU, where its founding date is celebrated today as Russian military intelligence’s ‘birthday.’ The unit’s activities initially centered around operations regarding regime defence and handling counter-revolutionaries, before it quickly expanded to encompass broader intelligence tasks. By the end of 1919, it had begun organising HUMINT activities and coordinating reconnaissance beyond Russia’s borders; this laid the foundation for the service’s evolution. As part of post-Civil War reorganisations, it was elevated in 1921 to the Second Intelligence Directorate (Razvedupr) of the Red Army Staff and later became known as the Fourth Intelligence Directorate. [source, source, source]

During the 1920’s and 1930’s, as the mission expanded from predominately defence and internal tasks to collecting foreign intelligence and other active and foreign operations, the Fourth Directorate of the Red Army gained notoriety for its seemingly reckless and aggressive operations. Its agents were sent abroad with little oversight, frequently operating through an expansive network of ‘illegals’ and using aggressive tactics to recruit, gather information, and spread influence. Felix Dzerzhinsky, founder of the Cheka, referred to the Fourth Directorate’s “irresponsible activities of the Razvedupr…dragging us into conflict with neighbouring states.” This statement by Dzerzhinsky also reflects the internal issues this Directorate seeded. The U.S. Congressional Research Service referred to the “rivalries” the Fourth Directorate developed, especially with the Soviet Union’s People’s Commissariat for Foreign Affairs. By conducting poorly coordinated actions especially through Comintern (Communist International) networks, the Directorate frequently encroached on diplomatic channels, contributing to friction within the Soviet system and further diplomatic fallout abroad. [source] 

Formation of the GRU (WWII) 

As internal rivalries persisted through the 1930s, Soviet leaders moved to streamline intelligence as the Soviet Union was fully engaged against Nazi Germany. On 16 February 1942, under the order of the People’s Commissar of Defense of the USSR, Stalin established the Main Intelligence Directorate of the General Staff (GRU), building on the institutional lineage of its predecessor organisations. During the war, the GRU directed sabotage, resistance, and coordinated guerrilla activities. Additionally, HUMINT was handled exclusively outside the USSR by April 1943. Following 1945, the GRU was subordinated directly to the General Staff, and, working alongside the KGB’s First Chief Directorate, oversaw both legal/official (under diplomatic cover) and illegal/unofficial (without diplomatic cover) intelligence operations abroad, with a focus on militarily relevant intelligence. [source, source, source] 

Cold War Expansion

During the Cold War, the GRU continued to develop its military operations, as well as maintain extensive rezidentura networks. Rezidentura is essentially intelligence stations that are run on foreign grounds. The GRU also operated SIGINT facilities in allied countries, including the major listening post at Lourdes, Cuba, which monitored NATO communications. [source, source], 

A core development within the GRU following the war was the creation of Spetsnaz, the GRU’s special forces units, on 24 October 1950. Several experts—including Lester W Grau, Charles K Bartles and Mark Galeotti—claim the cause for the formation of modern spetsnaz was the U.S. introduction of tactical nuclear weapons systems into the European theater. Nuclear weapons became central to Cold War battlefield planning, and the Soviets were not adequately prepared for addressing these threats with established conventional forces. The Spetsnaz was thus formed to address this gap, specialising them in deep reconnaissance with training to infiltrate the enemy rear, specifically targeting NATO command and control and nuclear weapons. Throughout the Cold War, GRU Spetsnaz were deployed in key interventions and conflicts and continue to remain a core component of Russia’s military intelligence operations. [source,  source, source, source]

Post Soviet Transition

Following the collapse of the Soviet Union in 1991, the GRU continued as Russia’s principal military intelligence service while many Soviet agencies were dismantled and reorganised, like the KGB’s split into the SVR and the FSB. During the 90s and early 2000s, the GRU faced severe budget pressures and reductions in personnel and it struggled for political support amid attempts to prevent its dissolution/absorption into other organisations. The GRU remained intact despite these challenges, although the next few decades saw a change in its location and even attempted to change its name; around 2010, the former Minister of Defense Anatoly Serdyukov allegedly ordered the service to be renamed to the “Main Directorate” (GU). However, the original GRU acronym stuck. Putin himself preferred the inclusion of the word intelligence, stating in 2018 “it would be necessary to restore.” [source, source, source, source]

Today, the GRU stands as Russia’s principal military intelligence service, deeply involved in foreign conflicts, espionage, and other covert action worldwide. Its activities have expanded well beyond traditional military intelligence, making it a core hybrid warfare entity – performing sabotage, assassinations, cyber and influence operations, continuing to run “illegal” programmes and more. As a consequence of these operations, the agency has been sanctioned in its entirety by the U.K., and many of staff independently sanctioned by the E.U., the U.S. and more. [source, source, source] 

2.1 Motto 

“Greatness of the Motherland in your glorious deeds”

The phrase is engraved on earlier versions of the GRU emblem. However, it is not widely recognised as a formal motto officially adopted by the GRU. [source]

“Only the stars are above us”

1TV, or Channel 1, a Russian state-owned media outlet, referred to this line as the motto of military intelligence. [source]

2.2 Symbols 

3.0 Organisation 

3.1 Place within Russian government 

3.1.1. Command structure

As Russia’s military intelligence organ, the GRU is formally integrated into the General Staff of the Armed Forces of the Russian Federation and operates under the Ministry of Defence. Furthermore, its director (Kustyukov) reports up the military chain of command, ultimately to the Minister of Defence and the Chief of the General Staff. Unlike the SVR (Russia’s foreign intelligence) or the FSB (domestic security), it is not a civilian agency. It focuses on areas of primarily military intelligence and support measures, with subsidiary roles of political, economic and counter-intelligence. [source, source] 

3.1.2 GRU Headquarters 

The GRU is located in northern Moscow at Khoroshevskoye Highway 76B. Unit 45807 is also listed at the same address, with the commander of the unit, Kostyukov, also head of the GRU. During the Soviet era, the GRU’s main HQ was based at Khodynka Field in Moscow, in a complex that became known informally in intelligence circles as the “Aquarium” because of its secure, glass faced office blocks. It transferred to the Khoroshevskoye Highway area on 9 November 2006. The new building took roughly three and a half years to complete and cost the state the equivalent of USD $11.72 million today, with much of the investment in the fence around the HQ, which can withstand the onslaught of a tank, according to the builders.  [source, source, source, source]

3.1.3 Internal structure

A 2021 report by the U.S. Congressional Research Service offers a widely cited and detailed assessment of the structure of the GRU. However, inevitable information gaps need addressing. The Russian intelligence system is highly opaque, and any organisational changes or internal realignments are rarely disclosed in a verifiable way. As a result, even widely cited baseline understandings should be treated as provisional rather than definitive. [source] 

A key verifiable development that occurred in 2023 is the establishment of the GRU’s Department of Special Tasks (SSD). This department, with an unclear placement among or in directorates, is specialised with sabotage and subversion, a reflection of Russia’s escalation in this realm. According to RUSI, the SSD encompasses Unit 29155 and Unit 54654. [source]

3.1.4 Individual GRU units 

• Unit 29155: Foreign Covert Action Machine

GRU Unit 29155 is a clandestine unit under the SSD, founded in around 2007-2008 by Andrey Averyanov. This unit is understood to be one of Russia’s primary foreign covert action units, serving as a key instrument within the GRU’s hybrid warfare toolkits targeting predominantly NATO and Western states. Several governments, including the U.K. and Germany, have attributed Unit 29155 to several high profile incidents, including the 2018 novichok poisoning of Sergei and Yulia Skirpal in Salisbury, UK, as well as the 2016 Montenegro coup attempt, and the 2014 ammunition depot explosions in the Czech republic. More recently, the unit has indicated an expansion of capability, specifically cyber enabled activity. Western governments have especially associated it with the notorious Whispergate malware campaign. [source, source, source, source, source, source] 

• Unit 54777: Psychological Commands

GRU Unit 54777, also known as the 72nd Center of the Special Service is a key PSYOPS unit that operates in the cognitive and informational domain. Lab52, a threat intelligence division of S2 Grupo, claimed the unit is likely positioned within the 12th Directorate; however, this is unverified. The unit actively shapes narratives, produces and disseminates disinformation, and in addition, is characterised by its use of front organisations and cultural associations to maintain deniability. Furthermore, they also operate in support of other GRU cyber units and conduct electronic warfare. [source, source] 

The Free Russia Foundation’s Director of Special Investigations, Micheal Weiss, released memoirs of Colonel Aleksandr Golyev, a propagandist of unit 54777 during the 1980s. These documents published in 2020 offer crucial insights into the unit, including its history, culture, training and operations. He described his assigned involvement in producing films for propaganda purposes, including the film Dogs of War, which portrayed Chechens at the time as savage, violent extremists. [source]

• Unit 54654: Network of Illegals

GRU Unit 54654 is, in the Center for Strategic and International Studies’ words, “designed to build a network of illegal operatives under full legalization.” Its work therefore, centres on building and managing deep-cover networks of non-official cover agents who can operate in target countries while maintaining civilian profiles. Currently, units 54654 and 29155, along with the SSD’s management department, are the only known units that fall under the SSD. The unit reflects the GRU’s intensification of recruiting individuals without military backgrounds – a shift to generating cleanskin personnel. [source, source]

• Unit 74455: Cyber specialised unit

GRU Unit 74455, also known as the 85th Main Special Service Center (GTsSS), or Sandworm and APT44, is a “highly sophisticated, longstanding cyber actor, specialising in destructive cyber operations”, according to the UK government. This unit is associated with the Kyivstar operation in December 2023, which disrupted telecommunications channels from Ukraine’s biggest provider. This provider serves 24 million customers. Additionally, the UK claimed their involvement in the Novichok poisonings in Salisbury, as well as using data-deletion malware to sabotage computers and networks that run the 2018 Pyeongchang Winter Olympic and Paralympic games. [source, source, source]

• Center for the Study of the Military Potential of Foreign Countries (CIVPZS)

CIVPZS serves as a key hub for military-technical information and intelligence of foreign states. Unit 54726 was liquidated in 2005 and the center was created on its basis. Little is known publicly about this research institute. However, Russian media outlets have referred to its staff as “the most informed people in the GRU.” According to The Insider, CIVPZS receives “all of the information” obtained through intelligence collection on foreign forces. [source, source, source] 

• Unit 26165: Cyber specialised unit

GRU Unit 26165 is a renowned cyber-operations unit (also tracked as APT28, “Fancy Bear”, “Forest Blizzard” and others) responsible for hacking, cyber espionage, and “hack and leak” operations in support of Russian military and foreign policy objectives. Meduza referred to the unit as “perhaps the military’s biggest repository of hacker talent,” and also home to the GRU’s 85th Central Research Institute, where cryptographers create decryption algorithms. The unit’s cyber campaign against Western logistics providers and technology companies has targeted various entities, including the defense industry, transportation hubs, maritime, air traffic management, and IT services. [source, source, source] 

3.4 Key Figures 

Igor Olegovich Kustyukov: (Director)

Since December 2018, Kustyukov has served as the Director of the GRU. He has held the rank of Admiral since 2019 and received the title Hero of the Russian Federation in 2017 for his direct role in leading Russian military operations in Syria. Furthermore, in recent years, Kustyukov has represented Russia in high-level negotiations, including those regarding Ukraine. He has also been included in multiple sanctions lists, including by the U.S., the U.K., Canada and others. [source, source] 

Vladimir Alekseyev: CallSign “Stepanych” (First Deputy Head)

Alekseyev, born on 24 April 1961, serves as First Deputy Head of the GRU since 2011, holding the rank of Lieutenant General, and previously led the agency’s Spetsnaz directorate. A Russian insider source cited in an Institute for the Study of War (ISW) assessment reported that Alekseyev may have been dismissed in the Fall of 2023, however ISW cannot confirm nor deny this information. [source, source] 

Sources cited in a May 2023 joint report by The Insider, Der Spiegel, and Bellingcat stated the creation of Redut, a renowned PMC, was Alekseyev’s initiative. Additionally, a Telegram channel linked to Prighozhin’s Wagner forces also referred to him as “one of the founders” of Wagner. Furthermore, he was heavily implicated in several attacks including overseeing the 2018 Novichok attack in Salisbury and direct interference in the U.S. 2016 election. He later appeared at the Istanbul grain corridor talks as a Kremlin representative. During the June 2023 Wagner mutiny, Alekseyev publicly confronted Yevgeny Prigozhin’s mercenaries, urging them to stand down. [source, source, source, source, source, source]

On 6 February 2026, Alekseev was shot several times in Moscow by an assailant currently unknown. Russian media channel SHOT reported the assassin was waiting for the General near a residential building on Volokolamskoye Highway. Furthermore, Russian Foreign Minister Sergei Lavrov blamed Kyiv for the assassination atempt, accusing Zelensky of “provocations aimed at destabilizing the (peace) negotiation process.” [source]

Valery Gerasimov (Chief of General Staff, First Deputy Minister of Defence)

Gerasimov, born 8 September 1955, is the Chief of General Staff of the Russian Armed Forces. He is also the First Deputy Minister of Defence since November 2012. The GRU reports directly to Gerasimov, and it is likely that major operations require approval from this level. He therefore heads the command body that the GRU formally sits under, meaning he oversees the strategic military framework within which the GRU operates, though he does not direct the agency itself. 

Gerasimov is a central figure not only in Russia’s military establishment but also in the development of Russian hybrid warfare strategy. The “Gerasimov Doctrine,” coined by Mark Galeotti, described Gerasimov’s argument for renewed investment in Russia’s military amid leadership beliefs that future conflicts might be won without traditional force. However, Galeotti himself later stated he regretted introducing the term, claiming it overstated his role in shaping ideas about hybrid warfare. Nonetheless, Gerasimov is considered one of Russia’s most powerful figures, reflected in his direct access to the nation’s nuclear weapons. [source, source, source] 

Andrei Removich Belousov (Minister of Defence)

Belousov, born 17 March 1959, is the current Defence Minister of the Russian Federation, a position he has held since 14 May 2024. The GRU head, Kustyokov, reports back to both Belousov and Gerasimov. He predominantly worked as an economist and lacks any formal military background, which is unprecedented for a Russian Minister of Defence. Before becoming defence minister, he held several senior posts in the Russian government: he was First Deputy Prime Minister in 2020-2024, served as presidential aide, and acted as Minister of Economic Development in 2012-2013. [source]

Valentin Korabelnikov (Former Director)

Korabelnikov is the former head of GRU (1997-2009). He is one of the longest serving leaders of the GRU in post-Soviet Russia. Korabelnikov was born in the Tambov region of the former Soviet Union and built his career in military intelligence after graduating from the Minsk Higher Engineering Anti-Aircraft Rocket School of Air Defense, the Frunze Military Academy and the General Staff Academy. As director, he oversaw GRU activity during key operations including the Chechen conflicts. The Russian Federation awarded him the title Hero of the Russian Federation, and he has authored research on informational support papers for decision-making. [source, source] 

3.5 Recruitment and training 

Methods 

Formal

Available information shows the GRU’s recruitment of personnel is done both formally and informally, and is likely dependent on the individual units within its structure. Some open sources provide details into GRU training and recruitment; however, these accounts are likely to be limited in scope, and may be outdated and inaccurate, given the nature of secrecy surrounding the agency.

According to a 2018 article by Meduza, the GRU is known to recruit through standard pipelines, especially through drawing its officers from the Russian Armed Forces as well as through the technical/military education system. GRU recruiters travel to military units across the country to review the records of young officers. They interview selected candidates at home and, if they pass the screening, send them to Moscow for further evaluation. [source] 

The core training hub for GRU officers is the Defense Ministry’s Military Academy located at 50 Narodnoe Opolchenie Street, universally known as the “Conservatory.” It sits close to the GRU HQ and the affiliated research institutes. Additionally, individuals train in other institutions like the Cherepovets Higher Military School of Radio Electronics, where they receive intensive training in computer science, SIGINT, and electronic warfare. Training reportedly lasts three years, including week-long assessments in Moscow where candidates endure “hundreds of exams.” During the first year, emphasis is placed on foreign languages, regional studies, encryption, operating special-purpose machinery, and covert intelligence work, including the development of credible aliases and counter-surveillance. [source]

Informal, outsourced operational

Aside from formal pathways, in recent years, the GRU has increasingly turned to informal recruitment of civilians and one-time agents, otherwise known as ‘disposables’ for operations. Analysts have described this as a kind of ‘gig-economy’ model of espionage, in which ordinary civilians are contacted often through informal means, especially social media, and are financially compensated for specific tasks. Unit 29155, for example, has been associated with recruiting one-time operatives over Telegram. In the investigation by German newspaper Suddeutsche Zeitung and their broadcasters NDR and WDR, they found that the GRU recruited such agents for the July 2024 sabotages of DHL logistics centers in Birmingham and at Leipzig-Halle Airport in Germany, as well as a transport hub in Warsaw. Most disposable agents receive no training, no protection, and may not even know who is contacting them or the reasons behind it. This style of recruitment has garnered significant concern, especially for its increased scale, reflected in “Don’t Become a Disposable Agent,” a joint campaign by Germany’s Federal Criminal Police Office, the Federal Intelligence Service, the Federal Office for the Military Counterintelligence Service, and the Federal Office for the Protection of the Constitution. [source, source, source] 

Requirements

Requirements for entering the GRU vary depending on role and unit, particularly when distinguishing between kinetic operators, cyber personnel, or spetsnaz fighters. 

Generally, for traditional operational officers/field operatives, the GRU requires a combination of linguistic, analytical and psychological capabilities. Their rigorous screening that focuses on foreign language proficiency, cognitive stamina and memory reflects the demands of such work. Sometimes, higher authority send officers on long deployments and have to live double lives for as much as decades. They therefore require individuals with psychological stability, patience, and the ability to compartmentalise their personal and operational identities over extended periods. [source]  

Open-source insight into GRU Spetsnaz training and requirements has been supplemented by accounts in Preparing a Spy: The GRU Spetsnaz System, a book by former special forces personnel. Meduza referenced this work, concluding that Spetsnaz selection and training is markedly more demanding than conventional military conditioning. Exceptional physical endurance, broad operational capability, and adaptability are conditional requirements. A striking aspect of Spetsnaz, however, is the psychological demands. In these written accounts, recruits may undergo exercises designed to desensitise them to blood and violence. For instance, in boot camp, candidates are subjected to an exercise where they are required to catch a live rabbit, smash its head against a tree, behead it, and drink its blood. [source]  

GRU Colonel Sergey Kozlov in his book recalled: “We’d make this scarecrow — a mannequin. We’d dress him in a U.S. Army uniform and hide some document in his shirt pocket…Then we’d dump buckets of blood on the mannequin and smear the guts and other innards taken from a stray dog all inside the unbuttoned jacket. And the intelligence officers have to search this ‘corpse.’ [source]  

5.0 Tactical-Operational Information 

5.1 Operations

GRU operations are extensive, though much of their activity remains undisclosed. Since its establishment, the GRU has played key roles in numerous conflicts, with its Spetsnaz elements continuing to conduct direct-action and special reconnaissance missions. Broadly, the GRU is active in the following core areas: 

5.1.1. Information/ psychological operations

• 2016 U.S. election interference: GRU officers from several units, including Units 26165 and 74455, allegedly hacked the Democratic Party email system and distributed emails via platforms like DCLeaks and WikiLeaks to influence the election narrative. [source] 
• Covid-19 and health disinformation: GRU affiliated campaigns have spread false narratives regarding vaccines, disease origin, and government responses. [source] 
• Inflaming societal tensions: The GRU has been documented to exploit anti-immigration sentiment in Europe, amplifying far-right narratives and exploiting social tensions. For example, French authorities linked Unit 29155 to the placement of pig heads outside nine mosques in and around Paris, and throwing green paint on synagogues. [source]

5.1.2. Cyber operations

• 2019: Georgia Disruptive attacks: The UK National Cyber Security Centre assessed that Unit 74455 conducted widespread attacks in Georgia in 2019, including website defacements and service interruptions at government, media, and business sites. [source] 
• 2017: NotPetya attack: The GRU engaged in a destructive cyber attack targeting the Ukrainian financial, energy and government sectors, which in turn affected other European businesses. [source] 
• 2015: BlackEnergy attack: The UK government publicly exposed the GRU for its actions on shutting off Ukraine’s electricity grid, with 230,000 people losing power between 1-6 hours. [source] 

NotPetya, a computer worm the GRU used to attack several countries. [source] 

5.1.3. HUMINT enabled operations

• 2018 Salisbury Novichok poisoning: Unit 29155 was tied to the Novichok poisoning on Sergei and Yulia Skripal. Investigations by Bellingcat and its independent Russian media partners revealed that members of Unit 29155 entered the UK under false identities and exposed the victims to the nerve agent on a public door handle. The agent caused both Yulia and Sergei to fall critically ill for several weeks. Investigators later found a perfume bottle containing the nerve agent in a trash bin, reportedly containing enough of the compound to kill thousands of people. [source, source, source] 
• 2018 The Hague: Dutch intelligence disrupted a covert GRU operation targeting the Organisation for the Prohibition of Chemical Weapons in The Hague (OPCW). Dutch Military Intelligence and Security Service (MIVD) intercepted a team of GRU officers equipped with HUMINT support and technical equipment near OPCW headquarters. [source]

5.1.4. Sabotage operations

• 2025 Estonian arson campaign: An Estonian court ruled that the GRU ordered arson attacks on a Ukrainian restaurant and a supermarket in Estonia, with one perpetrator acting on behalf of the GRU and another unwittingly involved. [source] 
• 2024 Lithuania arson plot: Lithuanian authorities accused the GRU of coordinating attempted arson attacks on key infrastructure, including a plant supplying radio scanners to Ukraine’s army. [source] 
• 2014 Czech ammunition depot explosions: Czech investigators concluded that members of unit 29155 engineered the October and December 2014 explosions at ammunition warehouses in Vrbětice. The explosion killed two people and were intended to disrupt weapons supplies to Ukraine and allied forces. [source, source] 

5.2. Core purpose 

As the GRU is composed of numerous specialised units and directorates, each focused on a specific region, method or mission type (although often supporting each other), each fulfills a distinct role in advancing the agency’s objectives. Ultimately, the GRU serves as an entity that advances the Kremlin’s military and strategic objectives, or grand strategy, by providing intelligence and conducting operations beyond Russia’s borders. 

Russia’s grand strategic objectives generally fall into three categories, all of which the GRU supports: [source, source] 

1. Physical expansion in key strategic regions
2. The maintenance/boosting of Putin’s status quo
3. Opposition to Western influence

7.0 Conclusion 

The GRU remains a central pillar of Russian military-intelligence power, combining traditional espionage, special operations and hybrid warfare capabilities. Based on existing patterns, its future trajectory points toward greater integration of cyber and information operations, and persistent covert actions abroad, with an emphasis on disrupting NATO, Europe and the post-Soviet sphere’s cohesion. The GRU will remain a persistent threat, with attribution as a serious challenge, amplified by its widespread use of proxies, front organisations, and one-time operatives that obscure its involvement and ultimately allow space for its continuation.

GRU emblem above “Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation.”