A U.S. grand jury charged 12 Russian citizens on July 13 with interfering in the 2016 U.S. presidential election by organizing cyberattacks on the computers of Democratic Party figures during the campaign.
The indictment contains the names of the dozen accused, who are described as “employees of the GRU,” referring to Russian military intelligence. In addition, the indictment contains the numbers of the military units that they allegedly serve in and a relatively detailed account of the methods they purportedly used to break into the computers and publish the information they acquired in the hacking attacks.
RFE/RL has conducted its own open-source investigation into those accused intelligence operatives, although there is relatively little openly available information about the men or their military units.
But some information does seem important: One of the accused participated in a 2014 conference of hackers on the topic of “infiltration, hacking, and the national peculiarities of cyberwarfare.” The building in the Moscow suburb of Khimki that is referred to in the indictment as “the Tower” can be connected to the founder of the pro-Kremlin Antimaidan propaganda organization.
And the military unit that allegedly carried out the distribution of the stolen information through WikiLeaks and anonymous social-media accounts is based at the same address as GRU officer Oleg Ivannikov (known as Orion), who has been named by the independent Bellingcat research organization as a participant in the events that led to the July 2014 downing of the MH-17 passenger jet over eastern Ukraine.
Unit No. 26165
According to the indictment, nine of the 12 accused GRU personnel serve in military unit No. 26165, which is based at Komsomolsky Prospekt No. 20 in Moscow. That building is part of a Defense Ministry complex located on the territory of the former Khamovnicheskiye barracks, built in the early 19th century.
There is no official sign at the entrance to the territory listing the units based there, but it is not difficult to establish that unit No. 26165 is, in fact, located at those barracks. It can be found under that address in the online Unified State Register of Legal Entities.
In Soviet times, that unit was assigned to the decoding and cryptanalysis of intercepted messages for the 6th Directorate of the GRU under the official name “85th Main Center of GRU Special Service.”
These days, according to numerous citations available online, the unit is also involved in cutting-edge computer technologies.
The signature of the unit’s commander, Viktor Borisovich Netyksho, who is the first name listed on the U.S. indictment, is found on cooperation agreements signed with several Moscow high schools specializing in mathematics, including high school Nos. 1507, 1573, and 1517. The earliest of these agreements dates from 2014 and they are signed personally by Netyksho. The agreement with school No. 1573 can be found here (archived copy). They are identical.
The first point of the agreement obligates the two parties to “prepare students for entry into the Institute of Cryptography, Communications, and Informatics of the Academy of the FSB (Federal Security Service).”
According to the above-mentioned register of legal entities, Netyksho headed military unit No. 26165 until January 2018. There are numerous online indications of this unit’s activity, besides the agreements concluded with the math schools. For instance, in 2004, officers of the unit identified as P.M. Konovalchik, A.I. Ivanov, and A.D. Malevanchuk published an article in the journal Artificial Intelligence titled A Multiprocessor System Adapted To The Information Structure Of Various Classes Of Computations.