First came a destabilization campaign in Moldova, followed by the poisoning of an arms dealer in Bulgaria and then a thwarted coup in Montenegro. Last year, there was an attempt to assassinate a former Russian spy in Britain using a nerve agent. Though the operations bore the fingerprints of Russia's intelligence services, authorities initially saw them as isolated, unconnected attacks.
Western security officials have now concluded that these operations, and potentially many others, are part of a coordinated and ongoing campaign to destabilize Europe, executed by an elite unit inside the Russian intelligence system skilled in subversion, sabotage and assassination.
The group, known as Unit 29155, has operated for at least a decade, yet Western officials only recently discovered it. Intelligence officials in four Western countries say it is unclear how often the unit is mobilized and warn that it is impossible to know when and where its operatives will strike.
The purpose of Unit 29155, which has not been previously reported, underscores the degree to which Russian President Vladimir Putin is actively fighting the West with his brand of so-called hybrid warfare -- a blend of propaganda, hacking attacks and disinformation -- as well as open military confrontation.
Hidden behind concrete walls at the headquarters of the 161st Special Purpose Specialist Training Center in eastern Moscow, the unit sits within the command hierarchy of the Russian military intelligence agency, widely known as the GRU.
Though much about GRU operations remains a mystery, Western intelligence agencies have begun to get a clearer picture of its underlying architecture. In the months before the 2016 presidential election, U.S. officials say two GRU cyber units, known as 26165 and 74455, hacked into the servers of the Democratic National Committee and Hillary Clinton's campaign, and then published embarrassing internal communications.
Last year, Robert Mueller, the former special counsel overseeing the inquiry into Russian interference in the 2016 elections, indicted more than a dozen officers from those units, though all still remain at large. The hacking teams mostly operate from Moscow, thousands of miles from their targets.
By contrast, officers from Unit 29155 travel to and from European countries. Some are decorated veterans of Russia's bloodiest wars, including in Afghanistan, Chechnya and Ukraine.
The unit appears to be a tight-knit community. A photograph taken in 2017 shows the unit's commander, Maj. Gen. Andrei V. Averyanov, at his daughter's wedding in a gray suit and bow tie. He is posing with Col. Anatoly V. Chepiga, one of two officers indicted in Britain over the poisoning of a former spy, Sergei Skripal.
"This is a unit of the GRU that has been active over the years across Europe," said one European security official, who spoke on condition of anonymity to describe classified intelligence matters. "It's been a surprise that the Russians, the GRU, this unit, have felt free to go ahead and carry out this extreme malign activity in friendly countries. That's been a shock."
To varying degrees, each of the four operations linked to the unit attracted public attention, even as it took time for authorities to confirm that they were connected. Western intelligence agencies first identified the unit after the failed 2016 coup in Montenegro, which involved a plot by two unit officers to kill the country's prime minister and seize the parliament building.
But officials began to grasp the unit's specific agenda of disruption only after the March 2018 poisoning of Skripal, a former GRU officer who had betrayed Russia by spying for the British. Skripal and his daughter, Yulia, fell grievously ill after exposure to a highly toxic nerve agent, but survived.
The poisoning led to a geopolitical standoff, with more than 20 nations, including the United States, expelling 150 Russian diplomats in a show of solidarity with Britain.
Ultimately, British authorities exposed two suspects, who had traveled under aliases but were later identified by the investigative site Bellingcat as Chepiga and Alexander Mishkin. Six months after the poisoning, British prosecutors charged both men with transporting the nerve agent to Skripal's home in Salisbury, England, and smearing it on his front door.
But the operation was more complex than officials revealed at the time.
Exactly a year before the poisoning, three Unit 29155 operatives traveled to Britain, possibly for a practice run, two European officials said. One was Mishkin. A second man used the alias Sergei Pavlov. Intelligence officials believe the third operative, who used the alias Sergei Fedotov, oversaw the mission.
Soon, officials established that two of these officers -- the men using the names Fedotov and Pavlov -- had been part of a team that attempted to poison Bulgarian arms dealer Emilian Gebrev in 2015.
The team would twice try to kill Gebrev, once in Sofia, the capital, and again a month later at his home on the Black Sea.
A Section on 10/09/2019