The three hackers are members of Unit-29155, a military entity of the GRU, Russia's foreign intelligence service.

The European Union imposed sanctions on January 27, 2025, against three Russian citizens for their involvement in cyberattacks targeting Estonia in 2020. Nikolay Korchagin, Vitaly Shevchenko, and Yuriy Denisov are agents of Unit-29155, a military entity of the GRU, Russia’s foreign intelligence service. The EU has frozen their assets and banned them from traveling or receiving funds from European individuals and entities.

The cyberattacks targeted Estonia’s Ministries of Economic Affairs and Communications, Social Affairs, and Foreign Affairs. According to the European Council, these intrusions “allowed hackers to gain unauthorized access to classified information and stored data” and led to “the theft of thousands of confidential documents,” including trade secrets and medical records.

In September 2024, the United States, Canada, Australia, and New Zealand released a joint investigation into Unit-29155. Comprising ten members, the Russian group—also known as “Cadet Blizzard,” “Ember Bear,” or “Frozenvista”—allegedly targets infrastructure and individuals from NATO countries or Ukraine.

The United States is offering rewards of up to $10 million (€9.6 million) for information on five members of this unit, including the three men sanctioned by the EU. In December 2024, Brussels had already sanctioned Unit-29155 for its involvement in targeted assassinations and bombings in Europe.

Stay tuned in real time
Subscribe to
the newsletter
By providing your email address you agree to receive the Incyber newsletter and you have read our privacy policy. You can unsubscribe at any time by clicking on the unsubscribe link in all our emails.
Stay tuned in real time
Subscribe to
the newsletter
By providing your email address you agree to receive the Incyber newsletter and you have read our privacy policy. You can unsubscribe at any time by clicking on the unsubscribe link in all our emails.