PARIS, July 19 — France has done something it almost never does: publicly name a foreign intelligence unit and blame it for a cyberattack. The target is the GRU’s 85th Main Center for Special Services, also known as Unit 26165, the same Russian military intelligence team that the United States indicted in 2018 for interfering in the 2016 presidential election. The French playbook, however, is different, and the mechanics behind the attribution matter as much as the accusation.
It began with a new strain of malware. Engineers at France’s National Cybersecurity Agency, ANSSI, spotted it early in 2023 embedded in the network of an unnamed French defense contractor.
Researchers labelled the code ‘Neutraliyzer’. Analysis of its internal signatures revealed something familiar: unique compilation artifacts and shared code characteristics with earlier tools used by the 85th Main Center — the GRU’s cyber-operations arm. That technical trace gave ANSSI a starting point.
The DGSI — France’s domestic security and counter-espionage service — then worked with military intelligence, the Direction du Renseignement Militaire, to trace the command-and-control infrastructure. The trail led to a server farm in St. Petersburg, leased not directly by the GRU but through a shell company.
The catch: shell companies can be hard to pin down, but human intelligence made the connection concrete. DGSI field agents confirmed that the unit’s officers were regular GRU personnel stationed at a base near St. Petersburg’s Pulkovo Airport. By October 2023, the DGSI director had a dossier thick enough to brief the President personally.
On closer reading, the material included intercepted communications, financial records, and surveillance photographs of known GRU officers. The evidence was not just technical; it was operational and financial.
The Mechanics of Attribution
The choice to go public required approval at the highest level, and the risks are obvious. Public attribution invites retaliation — diplomatic, cyber, or operational. It also exposes sources and methods.
The agency typically operates in secrecy, the logic being that silent countermeasures allow continued access. The stated justification for breaking that silence: deterrence and a warning to allied intelligence services.
France wanted to say, effectively, “We see you, and so do our partners.” The technique itself — “naming and shaming” — is familiar in the Anglosphere. The United States, for instance, indicted officers in 2018 for the 2016 election hacking. But for France, this is rare.
The intelligence establishment has long preferred quiet diplomacy and bilateral retaliation over public denunciations. The shift reflects either a genuine change in doctrine or a calculation that the deterrent effect outweighs the blowback.
On the evidence of this case, the dossier was solid enough to survive legal and political scrutiny, yet the decision to release it remains a bet: that public exposure unsettles the GRU more than it harms French operational security.
The Politics of Naming
The 85th Main Center is no obscure outfit. It is the same unit the US Justice Department indicted for the 2016 Democratic National Committee hack. That indictment was a coordinated, public indictment of officers.
France’s action is smaller in scale — it names the unit, not individual officers — but it carries its own weight precisely because it comes from a European ally that usually stays silent. Follow the money: the financial records in the dossier, tracing the shell company’s lease of the St. Petersburg server farm, point to the GRU’s logistical and financial support structure.
The mechanics here are about more than malware; they are about how state-backed operations launder their infrastructure through private-sector shell companies. That is a pattern that financial investigators in Europe and the US have been tracking, and it gives the case a wider relevance for banks, compliance officers, and cybersecurity insurers watching for state-sponsored contractor proxies. What to watch next: whether other European intelligence services follow France’s lead and begin issuing public, named attributions of their own, or whether this remains an outlier.
France’s decision also raises the question of whether the GRU will adjust its operational security — shifting to different shell companies, different server locations, different code signatures — and force ANSSI and the DGSI to rebuild their detection methods. The naming may deter some attacks, but it also informs the adversary how they were caught.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “**French Intelligence Exposes Russian GRU Cyberattack Unit**”, “description”: “PARIS, July 19 — France has done something it almost never does: publicly name a foreign intelligence unit and blame it for a cyberattack. The…”, “datePublished”: “2026-07-19T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Beatrice Ferrari”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}
