Introduction
This report presents a cyber threat intelligence assessment of two concurrent Russian state-sponsored threat actors: APT29, operating under the Foreign Intelligence Service (SVR), and SaintBear, assessed to operate under the General Staff's Main Directorate (GRU) as part of Unit 29155. Though they serve separate mandates, both groups have sustained significant operations against a wide variety of targets across Europe and NATO member states throughout 2025 and well into 2026. This report examines their infrastructure patterns, tradecraft, and operational activity as tracked by Augur's predictive infrastructure telemetry across more than a decade of continuous coverage of both actors.
APT29 and SaintBear are not interchangeable. The SVR's mandate centers on long-term espionage: silent network access, identity compromise, diplomatic intelligence collection, and pre-positioning inside government and critical infrastructure. The GRU's mandate through Unit 29155 is more aggressive and disruptive, focusing on direct sabotage campaigns and infrastructure destruction that creates genuine operational consequences beyond the digital domain. The duo’s 2026 behavior shows a significant, simultaneous surge against the same European target population during a moment of sustained geopolitical pressure (the ongoing Russia-Ukraine War and Russia’s growing friction with NATO). Understanding them together, rather than in isolation, provides a more accurate threat picture.
Executive Summary
APT29 remains one of the most operationally disciplined and continuously active state-sponsored espionage actors tracked by Augur. The group's primary infrastructure cluster has been active without interruption since August 2020, with new maximum-priority predictions generated as recently as this week.
Across 8.4 million active IPs tracked across APT29's infrastructure clusters in Augur's predictive engine (and 934,114 IPs confirmed by third-party threat feeds) the group has shown a deliberate preference for Hetzner-hosted infrastructure within AS24940. The group cycles through tight CIDR blocks daily while maintaining secondary nodes across multiple bulletproof hosting providers, including JSC Selectel, Trabia SRL, and Host Sailor Ltd. The group's 2026 operations reflect a continued pivot toward cloud identity infrastructure, targeting Microsoft Entra ID environments, OAuth token chains, and trusted federated authentication pathways, allowing operators to maintain access inside victim networks without touching endpoints that generate host-level telemetry.
SaintBear, the cyber arm of GRU Unit 29155, presents a different but equally serious threat profile. Where APT29 operates with patience and precision, SaintBear surges, provisioning large address blocks rapidly, executing disruptive operations, then withdrawing. Augur's earliest SaintBear cluster dates to November 2019, and the group's infrastructure activity peaked in the lead-up to and early months of Russia's full-scale invasion of Ukraine in February 2022. The most significant finding in Augur's dataset is cluster profile-151410: 29,440 IPs attributed simultaneously to both APT29 and SaintBear, active from February 2022 through October 2023, with 25,635 confirmed detections.
These two separate Russian intelligence organs drawing from the same infrastructure pool during the same invasion-era targeting window reflect coordinated, parallel tasking against European government/defense and critical infrastructure networks. Organizations across NATO member states, particularly those supporting Ukraine-related logistics and defense procurement, should treat both actors as active threats and prioritize preemptive blocking of APT29 and SaintBear infrastructure.
The Actors: Two Services, One Target Set
APT29: The SVR's Quiet Machine
Russia maintains two foreign intelligence services with distinct mandates and operating philosophies, yet their target sets overlap almost entirely. The SVR (Russia's civilian foreign intelligence arm) tasks APT29 with long-term, quiet intelligence collection against governments and defense contractors, occasionally assisting in operations against foreign dissidents. The GRU's Unit 29155, operating under the tradename SaintBear, executes a shorter-cycle playbook: destabilize, sabotage, and if necessary, assassinate. These are not the same mission, but require the same access. Targets of interest frequently include Western ministries of defense, NATO infrastructure, telecommunications providers, and political advisors involved in shaping Western policy toward Russia. The result is a persistent, dual campaign in which one service breaches the target and the other raids it.
This distinction matters operationally. SVR infrastructure is built to last: clusters rotate slowly and providers are vetted while exposure is minimized through operational discipline. By contrast, GRU infrastructure surges. Unit 29155 stands up significant footprints rapidly when operations demand and allows them to decay just as quickly when the operational window closes. Augur's behavioral clustering captures both patterns with precision: APT29 maintains one of the largest, most stable infrastructure profiles tracked by Augur, while SaintBear's signature is a series of episodic, high-IP-count bursts aligned to specific operational periods.
What makes the Dueling Dragons framing analytically relevant is their convergence and tandem deployment. Augur data identifies a shared infrastructure cluster (profile-151410) active between February 2022 and October 2023 in which both APT29 and SaintBear identifiers appear. That window maps exactly to Russia's full-scale invasion of Ukraine. Whether the co-location reflects coordinated tasking, shared third-party infrastructure, or a common bulletproof hosting provider operating for both services, the implication is the same: when Moscow's objectives intensify, its intelligence services converge.
APT29 does not move fast. Its infrastructure is engineered for persistence: clusters that age slowly and resist attribution through provider diversity and operational hygiene. Augur's primary cluster for APT29 (profile-133688) is the largest single-actor infrastructure profile tracked across the entire platform by total IP count, a record that reflects years of disciplined, sustained buildout.
Built to Last: APT29's Infrastructure Doctrine
The cluster's behavioral signature distinguishes it immediately from the sporadic patterns typical of lower-sophistication actors. The cluster introduces IP addresses gradually, holds them across extended windows, and rotates them only when the threat of detection crosses critical thresholds. The ASN distribution within the cluster also reflects deliberate provider selection: commercial VPS providers with permissive abuse policies, residential proxy networks that obscure origination, and, in periods of elevated operational tempo, known bulletproof hosting infrastructure. Augur's ASN enrichment, enabled by the platform's internal bulletproof hoster registry, flagged multiple providers within this cluster as confirmed or suspected high-risk hosters, consistent with SVR procurement documented across multiple government attribution reports.
A secondary cluster (profile-156242) operates in parallel, likely segmented for operational hygiene. Where profile-133688 represents SVR's persistent collection backbone, profile-156242 shows a distinct deployment pattern (shorter hold times and faster IP rotation) consistent with use as an exfiltration or staging layer. Separating persistent access infrastructure from short-dwell exfiltration infrastructure is a hallmark of mature APT operations and reflects SVR's documented focus on longevity over speed.
APT 29's Ongoing Operations
APT29's tempo has not slowed despite increased global scrutiny. The group's most consequential intrusions (the SolarWinds supply chain compromise (2020), the Microsoft Exchange Online breach attributed to Midnight Blizzard (2024), and persistent targeting of European government ministries documented by CERT-EU) all fall within Augur's tracking window. These are not artifacts of a prior campaign generation, but the active output of the infrastructure preemptively identified above.
The SolarWinds operation in particular demonstrated the group's strategic patience. An estimated 18-month dwell time within the SolarWinds build pipeline, exploitation of a trusted software update mechanism, and subsequent lateral movement into at least nine federal agencies and over 100 private-sector organizations made it one of the most significant intelligence collection operations of the post-Cold War era. The infrastructure supporting that operation shares behavioral characteristics with Augur's profile-133688 cluster: deliberate, low-and-slow, and engineered to stay below detection thresholds for as long as operationally required.
In 2024, the group continued to adapt. The Midnight Blizzard campaign against Microsoft leveraged password spray attacks against a legacy OAuth test account to pivot into senior Microsoft leadership email and source code repositories. Microsoft disclosed that breach in January 2024; it resulted in the exfiltration of internal correspondence and a cache of Microsoft's own security correspondence with U.S. government clients. SVR was not collecting intelligence on Microsoft, but instead collected intelligence on what U.S. agencies and Microsoft's Threat Center knew about active SVR operatives. The operational logic today is the same as it was in 2020: access the infrastructure that handles intelligence about Russia and operators gain visibility into what NATO adversaries know.
Unit 29155 builds infrastructure rapidly, deliberately selecting abuse-tolerant providers with little expectation that the assets will survive long-term. Augur's earliest confirmed SaintBear cluster (profile-113181) was detected November 15, 2019, predating public attribution of Unit 29155 as a distinct GRU element and the bulk of Western reporting on the unit's cyber activity by more than two years. The cluster carried 256 IPs at initial detection, a modest footprint consistent with an early-stage or test deployment.
SaintBear's Operational Tempo
The operational surge came later. Augur's profile-119651 captures a marked expansion in SaintBear's infrastructure footprint, the behavioral signature of which differs fundamentally from the APT29 pattern: rapid IP accumulation over a compressed timeframe and higher turnover of individual addresses, alongside deliberate hosting choices optimized for speed of procurement. This infrastructure is not built to persist, but built to enable rapid operations and tolerate exposure after the fact.
SaintBear’s pattern is consistent with Unit 29155's documented operational model. The unit is responsible for some of the most brazen GRU operations of the last decade, including the Salisbury poisoning of Sergei Skripal (2018), a failed assassination attempt against Bulgarian arms dealer Emilian Gebrev, and a documented campaign of infrastructure sabotage across multiple NATO member states in the 2022–2026 period. These are not intelligence collection missions with decade-long horizons, but disruptive actions with specific objectives and acceptable exposure risk, ordered directly by Russian Intelligence. Their infrastructure choices reflect that very mission.
Figure 1: Leaked personnel files of military training pipeline and student profiles used to feed Russian cyber-espionage units like APT29 and Unit29155 (DomainTools)
The institutional depth behind Unit 29155's cyber operations came into sharper focus in mid-2026, when a 1.8GB leak of Bauman Moscow State Technical University training records surfaced on a darknet forum (DarkForums RU). Department No. 4 of the university functions as a formal military cyber academy, producing approximately 250 career and reserve students per cycle across specialties like server exploitation, malware development, and penetration testing.
Unit 29155 placements appear among confirmed graduates: Vladislav Borovkov, a GRU officer assigned to the unit, was indicted in September 2024 for cyber operations against Ukraine and 26 NATO member states, with attribution tied directly to the WhisperGate campaign. The Bauman materials confirm what the infrastructure record implies: Unit 29155 is not an ad hoc team of recruited hackers but a continuously replenished operational corps with formal military backing and an institutional recruiting pipeline, governed with explicit GRU officer oversight at every stage.
Figure 2: Russian GRU Senior Lieutenant Vladislav Borovkov, a cyber operative tied to the state-sponsored espionage group Cadet Blizzard (Unit 29155).
Sabotage Season
The invasion of Ukraine in February 2022 marked another transformational moment for Unit 29155's operational tempo. Within weeks of the ground campaign's launch, Western governments began documenting a sustained campaign of sabotage, physical arson, and infrastructure disruption attributed to GRU-linked actors operating across Poland, the Baltic states, Germany, and the United Kingdom. Fires at warehouses routing humanitarian aid to Ukraine and severed communications and logistics networks mirrored the operators' patterns across both physical and digital domains.
The campaign's cyber dimension followed the same surge. Augur's shared cluster (profile-151410) became active in February 2022 and remained populated through October 2023, a window that maps fairly precisely to the most intensive phase of Russian hybrid operations against Western Europe. The presence of both APT29 and SaintBear identifiers in this cluster, alongside Stark Industries, a provider flagged in Augur's bulletproof hoster registry, suggests that during this period, the two services were either deliberately co-located, shared a common third-party procurement pipeline, or both independently drew from the same restricted hosting ecosystem. Any of these explanations carries significant implications for how Western defenders should model Russian cyber threat infrastructure.
Unit 29155's hybrid targeting has explicitly extended into the digital terrain. The WhisperGate wiper deployed against Ukrainian government networks in January 2022, days before the invasion, has been attributed to the GRU, as has the subsequent deployment of the AcidRain modem wiper against the Viasat KA-SAT network, which disabled satellite communications across Ukraine and disrupted wind turbine operations in Germany. These are not espionage operations with a collection objective, but disruption operations, and the infrastructure profile Augur tracks for SaintBear is consistent with an actor that treats exposure as an acceptable operational cost.
Augur Assessment
Augur's telemetry on APT29 spans over a decade of continuous infrastructure tracking, with the earliest attributed cluster (profile-369) dating to February 2012. The group's primary active cluster, profile-133688, has run uninterrupted since August 2020 and continues to receive new maximum priority predictions: 8,777,179 total IP predictions logged, 7,746,380 currently active, and 655,905 confirmed detections. The cluster is concentrated almost exclusively within AS24940 (Hetzner Online GmbH), with daily new /27, /28, /29, and /32 CIDR blocks flagged at priority 100. The most recent confirmed detection, 91.190.191[.]117, was sourced from AlienVault OTX in June 2026. A secondary cluster, profile-156242, active November 2022 through January 2026, contributed an additional 3,072 IPs, all active, 1,595 detected, consistent with a parallel infrastructure track running alongside the primary Hetzner operation.
The sustained concentration within a single ASN over five years is not a liability, but deliberate doctrine. Hetzner's address density and legitimate commercial co-tenancy structurally suppress IP reputation blocking, forcing defenders into higher-cost behavioral and anomaly detection methods that APT29 is specifically engineered to evade.
SaintBear's infrastructure profile is operationally distinct but precisely bounded in time. Augur's earliest SaintBear cluster dates to November 15, 2019 (profile-113181, 256 IPs), with a significant surge in January 2020 through profile-119651, carrying 27,648 total IPs across a window that ran through April 2020. The critical data point is profile-151410, attributed to both APT29 and SaintBear simultaneously: 29,440 total IPs, all active within the cluster window, 25,635 confirmed detections, running February 2022 through October 2023. February 2022 marks the start of Russia's full-scale invasion of Ukraine. The infrastructure convergence reflects a documented pattern in which SVR collection operations and GRU disruptive campaigns drew from overlapping address pools during the same targeting window against Western government, defense, and critical infrastructure networks across Europe. Augur's clustering engine detected this overlap at the infrastructure level without requiring attribution from either actor's known indicators; the co-location surfaced from behavioral clustering alone.
Cross-referencing detected IPs from both actors against Augur's bulletproof hoster intelligence confirms that neither group confines its infrastructure to legitimate commercial providers. Detected indicators attributed to APT29 and SaintBear fall within CIDR ranges operated by Trabia SRL, Host Sailor Ltd, IPV, HZ Hosting Ltd, MivoCloud SRL, and JSC Selectel, all flagged as bulletproof or high-abuse-tolerance providers in Augur's dataset.
The Selectel overlap is particularly notable: JSC Selectel is a Russian-registered provider with a documented history of hosting infrastructure tied to Russian state and criminal actors, and its appearance alongside the Hetzner-heavy APT29 predictions indicates the group uses legitimate high-volume providers for primary rotation while maintaining parallel nodes on providers that resist Western law enforcement takedown requests. Organizations within APT29 and SaintBear's confirmed European target set should treat indicators across all six of these provider ranges as blocking priorities.
IOC Table
Mitigations
Organizations targeted by either SVR or GRU infrastructure should approach defense across three distinct threat models.
Against APT29 (SVR): The group's primary advantage is patience. Defense must therefore prioritize detection of low-and-slow behaviors that evade threshold-based alerting: authentication anomalies in cloud environments, unexpected OAuth token grants, lateral movement using valid credentials over extended dwell periods. Enforcing multi-factor authentication across all remote access points remains the highest-return control against SVR's documented credential-spray tradecraft. Organizations should audit OAuth application grants quarterly and revoke legacy service accounts with elevated privilege. Supply chain integrity monitoring, particularly for third-party software update mechanisms, remains essential given the SolarWinds precedent.
Against SaintBear (GRU): The surge-and-vanish infrastructure model requires defenders to prioritize indicator freshness. SaintBear clusters detected by Augur in the 2019–2022 window represent infrastructure already cycled, whilst active Augur insights represent infrastructure active today. The defensive value lies in behavioral profiling of the hosting ASNs and provider patterns characteristic of GRU procurement, not in blocking specific indicators that have likely already rotated. Physical security posture for facilities involved in Ukraine-related logistics or defense procurement should be reviewed in parallel with cyber controls. Unit 29155's hybrid model means that a cyber intrusion may be reconnaissance for a physical disruption operation.
Against shared-cluster infrastructure: The profile-151410 finding indicates that during periods of Russian conflict, both services may draw from common hosting pools. Organizations should treat detection of Stark Industries and analogous bulletproof hosters as an indicator of potential interest from multiple Russian intelligence actors simultaneously, not a single attributed threat. Network-level blocking of known bulletproof ASNs, cross-referenced against Augur's hoster registry, provides coverage across the SVR/GRU procurement overlap without requiring per-actor attribution.
Conclusion
Russia's intelligence architecture was not designed for efficiency, but for resilience. The SVR and GRU maintain parallel capabilities against overlapping target sets not because Moscow is organizationally disorganized, but because redundancy is doctrine. If one service's infrastructure is burned, the other's survives. If one operation is interdicted, the parallel track continues. The Dueling Dragons framing captures this intentional redundancy: two services, one strategic objective, and a combined infrastructure footprint that Augur has been tracking for years before most of it appeared in Western threat intelligence reporting.
The shared cluster finding (profile-151410) is perhaps the clearest evidence that this parallelism is not purely bureaucratic. During the most operationally intense period of the Ukraine conflict, APT29 and SaintBear infrastructure converged on common hosting resources. Whether that reflects deliberate coordination at the GRU/SVR level, shared procurement from the same bulletproof hosting ecosystem, or something more transient, the behavioral record is unambiguous. When Moscow escalates, its cyber teams move together.
For defenders across the West, the implication is that attribution to a single Russian actor is a floor, not a ceiling. A network that APT29 has accessed is a network that GRU will attempt to access. A target set defined by one service's collection priorities will be revisited by the other when operational requirements demand. Defending against Russia's parallel intelligence war requires treating both services as persistent, simultaneous threats and blocking their infrastructure before they reach your perimeter.
For questions or additional analysis, contact: research@augursecurity.com
References
- DomainTools Investigations | Threat Intelligence Report: University Leak Exposes Russia’s Military Cyber Training Pipeline
- Russia State-Sponsored Cyber Threat: Advisories | CISA
- GRU 29155 CYBER ACTORS — FBI
