On March 20, 2012, a decree signed by Defense Minister Anatoly Serdyukov was published by the Russian government. The decree set out a system of payments to military servicemen “for special achievements in the service.”
Section 4 of the order, which was first highlighted by RFE/RL’s Russian Service, stated that "servicemen of military units 99450, 74455, and the structural unit of military unit 29155 are paid a monthly supplement.”
At the time, little attention was paid to the decree: Little was known about the units, which fell under the umbrella of the feared-and-respected military intelligence agency known as the GRU.
In the years that followed, however, these units burst into the public eye appearing in indictments, sanctions announcements, and political statements from Washington D.C. to the Black Sea.
Unit 29155 in particular has grabbed outsized attention, having been linked by 2018 to an alleged coup plot in Montenegro and the near-fatal poisonings of a former Russian military intelligence officer in England and an arms dealer in Bulgaria.
Now, Czech government allegations that the unit’s members were behind a 2014 explosion at a Czech ammunition depot have blown up relations between Prague and Moscow, with both sides expelling diplomats and exchanging angry rhetoric.
“These are the guys you send in because you want to break stuff,” said Mark Galeotti, an expert on Russian security services.
Here’s a look at the Russian military intelligence unit that has captured the attention of Western intelligence.
Evolution of An Intelligence Unit
The GRU -- whose official name is the Main Directorate of the General Staff of the Armed Forces of the Russian Federation -- is not a new entity. It’s been around for decades, operating first in parallel with the KGB and then, after the Soviet breakup, with the KGB successor agencies: the Federal Security Service and the Foreign Intelligence Service.
In addition to providing more traditional tactical battlefield intelligence for Russian commanders, the agency also oversees several special forces units known as spetsnaz, some of which are charged with sabotage-type operations. It engages in electronic surveillance and recruitment of foreign spies, and, more noteworthy, cyberespionage and offensive cyberoperations -- hacking into adversaries’ computers, and possibly even inserting destructive code into computer systems.
GRU spetsnaz units played a prominent role in the Soviet and Warsaw Pact invasions of Hungary in 1956 and Czechoslovakia in 1968. And they played an instrumental role in the 1979 coup in Afghanistan, that led to a disastrous decade of intervention by Soviet troops.
The 2008 war with Georgia, in which the GRU also played a leading role, was considered a victory by the Kremlin but exposed major problems in Russian forces. The Kremlin undertook major reforms, including with the GRU.
Unit 29155 and similar units were likely established during these reforms, Galeotti and other experts said.
Since 2018, the overall agency has been headed by a naval officer, Admiral Igor Kostyukov, whose direct line of authority is to the chief of the general staff, General Valery Gerasimov, and the Russian defense minister, Sergei Shoigu, a close confidant of President Vladimir Putin.
That means major operations that could have significant political consequences -- like using a Soviet-era military-grade nerve agent that was developed in contravention to international law -- likely get top-level Kremlin approval, or at least a heads-up.
A Wedding Near Moscow
The highly secretive nature of intelligence operations, in Russia or anywhere, means there is scant verifiable information about Unit 29155: its budget or its staffing.
However, journalists, open-source researchers, and law enforcement agencies in Western countries have been able to compile a substantial amount of information about the unit.
29155 is reportedly connected to Special Operations Forces Command, whose headquarters is based in Senezh, north of Moscow. Its commander is believed to be Major General Andrei Averyanov, whose daughter was married at a site near Senezh in 2017.
Averyanov became publicly prominent in late 2019, when The New York Times, RFE/RL, and other media uncovered photographs and video from the wedding that showed Averyanov’s presence, as well as that of a man named Anatoly Chepiga, who is also believed to be a member of Unit 29155.
At the time of the wedding in 2017, Chepiga was not publicly known. But his face and a pseudonym -- Ruslan Boshirov -- became front-page news about nine months later, when the former Russian military intelligence officer Sergei Skripal and his daughter Yulia nearly died in Salisbury, England.
British officials said the Skripals were poisoned with a secret nerve agent called Novichok, and they alleged two GRU officers were the culprits.
The open-source research organization Bellingcat later published evidence identifying the men under their true names: Chepiga and Aleksandr Mishkin.
Eight months later, in November 2018, the GRU observed its 100th anniversary in Moscow, in a ceremony attended by Putin himself.
“As commander-in-chief, I of course know, and this is no exaggeration, about your unique abilities including in conducting special operations,” he said.
A Flood Of Revelations
In addition to resulting in the expulsion of dozens of Russian diplomats from Britain, Germany, the United States, and elsewhere, the Skripal case prompted intelligence agencies throughout Europe to reexamine old cases.
That included the near-fatal poisoning in April and May 2015, in Sofia, of a Bulgarian arms dealer named Emilian Gebrev. Bulgarian prosecutors made little public headway in the case until four years later -- and more than a year after the Skripal poisoning -- when they announced they were reopening their investigation, partly because of information from British authorities.
That December, Bulgarian officials said their investigation was focusing on five alleged GRU agents, including a top officer who purportedly oversaw the team that targeted Skripal. The next month, Bulgarian prosecutors announced charges against three Russians.
In a joint report with Der Spiegel and The Insider, Bellingcat, utilizing flight tracking information, leaked databases, and cell phone records, said as many as eight GRU officers from the same unit -- 29155 -- may have traveled to Bulgaria in the weeks surrounding the poisoning.
In a new analysis published on April 22, utilizing some of Bellingcat’s travel data, RFE/RL’s Bulgarian Service tracked the travels of some of the known GRU officers in and out of Bulgaria, and found the visits occurred around the times of a series of unexplained explosions that occurred at Bulgarian weapons and armaments facilities in the country in 2014 and 2015.
At least one Bulgarian official, former Defense Minister Todor Tagarev, called on authorities to reopen their investigations into the explosions.
Galeotti said the year 2014 appears to be pivotal in GRU operations -- the year the agency, and 29155 in particular, became more aggressive and far-reaching in its operations. Why 2014?
That’s when the months-long Maidan protests in Ukraine culminated in violence against the demonstrators and the ouster of Moscow-friendly President Viktor Yanukovych. Russia reacted by seizing Ukraine’s Crimean Peninsula, and fomenting a war in eastern Ukraine that continues today.
“What we didn’t quite realize, which is what makes the Czech case really interesting, is that 2014 marks the beginning of the process, a reaction to what was seen as the continuation of [the] Maidan, and this belief [in Moscow] that the West is trying to steal Ukraine from us,” Galeotti said.
“Russia considered itself at political war with the West and from that point was willing to wage that war on Western soil,” he said.
“They were willing to conduct fairly dangerous operations as far back as 2014,” he told RFE/RL.
Montenegro Plot, Ukraine Weapons?
Unit 29155 is not widely known for cyberattacks and hacking activities. Those have been spearheaded by other GRU divisions -- Unit 26165 and Unit 74455, which have been indicted by U.S. authorities on charges of election-related hacking -- and the Foreign Intelligence Service.
But 29155 has been linked to at least one attempted cyberintrusion. In October 2018, Dutch officials said that GRU agents allegedly tried to hack into the computers at the headquarters of the Organization for the Prohibition of Chemical Weapons in The Hague. The organization was deeply involved in the investigation of the substance used in the Skripal poisoning.
Two years earlier, in October 2016, Montenegrin authorities claimed they thwarted a plot to take over the country’s parliament building and assassinate the prime minister in a bid to block Montenegro from joining NATO.
In the investigation and trial that followed, 14 people were charged, including Serbian and Russian citizens. Prosecutors charged two Russian military intelligence operatives, Eduard Shishmakov and Vladimir Popov.
Shishmakov and Popov were among those convicted -- in absentia in their case -- in May 2019. But a Montenegrin court overturned the verdicts in February 2021, citing “significant violations of criminal procedure,” and asked the High Court to retry the case.
Popov is a pseudonym of a man tentatively identified as Vladimir Moiseyev, who also traveled back and forth to Bulgaria at least four times in 2014, all around the same time as four separate explosions at Bulgarian arms manufacturers.
On October 16, 2014, meanwhile, an arms depot near the eastern Czech town of Vrbetice exploded under mysterious circumstances; the bodies of two Czech men were later recovered.
It’s unclear how far the initial Czech investigation into that blast, and another one nearby two months later, proceeded.
But on April 17, at an unusual evening news conference, Prime Minister Andrej Babis announced that Czech intelligence had determined that Unit 29155 was to blame for at least the first explosion. Czech police said they were seeking the same two men wanted in Britain for the Skripal poisoning for questioning.
Other revelations have come out since Babis’s announcement. Bellingcat reported that Averyanov was in Vienna in October 2014, just before the Vrbetice explosion, and that one of the two Russians now linked to the blasts posted a photograph of Prague’s Old Town on October 11.
In another twist, initial reports said the ammunition at the depot that detonated was collected and owned by Gebrev, the Bulgarian arms dealer, and may have been destined for Ukraine as it fought Russian-backed fighters in eastern Ukraine, something partly corroborated by top Ukrainian security officials.
Gebrev has denied the arms were his, or that they were destined for export to Ukraine.
Tor Bukkvoll, a researcher who specializes in Russian security at the Norwegian Defense Ministry’s Defense Research Establishment, said the Czech revelations, while not revolutionary, add further detail suggesting how early and aggressively the GRU was in deploying this unit.
“This demonstration, showing the [Russian] willingness to engage in these kinds of missions, and go into other countries -- and perform these kinds of operations -- this is really scary,” he said.
