Moscow attacked by drones, one crashes into building near GRU hackers' headquarters

One of the drones crashed on Komsomolsky Avenue — one of the city's central thoroughfares. A building situated in close proximity to a university, reportedly housing the notorious hacker group APT28 (FancyBear), has been left damaged following the incident. As previously reported by The Insider, the building is believed to serve as a hub for the cybercriminal organization. The nature of the damage strongly indicates that the strike may have been deliberately aimed at this specific facility.

Bellingcat investigator Christo Grozev also reported that a building next to the one housing the hacker group FancyBear, which has been repeatedly linked to GRU, the Russian military intelligence agency, was also damaged.

In February 2022, a group of FancyBear hackers launched a large-scale attack on Ukrainian websites. In addition to DDOS attacks on government resources, they also spread malware through cloned government websites, such as through a fake petition in support of Volodymyr Zelensky, written in broken Ukrainian.

In 2017, The Insider exposed the true identity of Fancy Bear, revealing its members as employees of the GRU military unit 26165. This revelation was later corroborated by the US Department of Justice, leading to official charges against the hacker group. APT28 gained notoriety for its prominent cyber operation targeting the US Democratic Party servers in 2016, with the aim of influencing the presidential election in favor of Donald Trump over Hillary Clinton.

The group's cyberattacks extended beyond US borders, hitting various high-profile targets, including the White House and other entities in the United States. Additionally, foreign ministries of several countries such as the Czech Republic, Poland, Germany, Italy, Latvia, Estonia, Ukraine, Norway, and the Netherlands were also victims. Furthermore, APT28 targeted the defense ministries of Denmark, Italy, and Germany, along with international organizations like NATO, OSCE, IOC, WADA, JIT, and several foreign media editorial offices, including TV5Monde and Al Jazeera.

Notably, the same hacking group carried out attacks on numerous Russian opposition figures, members of NGOs, and journalists, including employees of The Insider. This was independently verified by four information security companies.