BLOWING up warehouses, global assassination plots and deadly Novichok poisonings all helped stoke Russia’s most dangerous secret black ops unit.
Vladimir Putin deployed his bloodthirsty Unit 29155 across the West – their main goal being to unleash hell on Moscow’s enemies in a chilling seven-year campaign of death and destruction.
Often dubbed the Kremlin’s ghosts, Unit 29155 is made up of assassins, saboteurs and bombers working within the shadows of Russia‘s GRU military intelligence directorate.
The group was so secretive that for years nobody in the West even knew they existed.
Codenamed “Ember Bear” by cybersecurity experts, Unit 29155’s mission briefs ranged from explosives and hybrid warfare to foreign destabilisation and covert infiltration.
The unit is most well-known for being behind the Salisbury poisonings on British soil in 2018. They attempted to murder double agent Sergei Skripal and his daughter with deadly nerve agent Novichok.
The poisoning was seen as a major Western security emergency and one of the most brazen assassination attempts the world had witnessed since the end of the Cold War.
Dr Kamil Zwolski, Associate Professor and Jean Monnet Chair of European Security at the University of Southampton told The Sun: “It’s interesting how the unit fits into the broader, evolving Russian strategy of achieving things abroad.
“When we talk about elite units like this one, they do what we could call ‘bespoke wet work’.”
The term wet work is often used as a chilling euphemism for murder, assassinations or any covert operations that involve bloody attacks.
Putin’s most formidable hit squad rose quickly after first emerging undetected on the global scene in 2011 as Putin’s dangerous lackeys.
In the dead of night on November 12, 2011, an ammunition depot near the Bulgarian village of Lovnidol suddenly erupted in a devastating fireball.
More than 3,000 artillery shells, owned by arms company EMCO and believed to be ultimately bound for Georgia, were destroyed in the blast.
The explosion was quickly linked back to Russia as Moscow had invaded Georgia only three years earlier in the five-day Russo-Georgian War.
No group claimed responsibility and it would take years for spy chiefs to finally realise they had just witnessed the opening salvo of a terrifying new campaign on European soil: the debut mission, investigators now believe, of Unit 29155.
In 2014, when Putin illegally annexed Crimea, Unit 29155 embarked on one of its most terrifying periods of violence.
Agents from 29155, reportedly including commander Andrei Averyanov, were deployed as part of a wider GRU effort to support the insurgency in Eastern Ukraine led by Wagner paramilitaries.
That same year, the unit was sent into Moldova to back Moscow’s campaign to destabilise the tiny Eastern European republic’s pro-EU government.
Then came a return to what the bloodthirsty group did best – explosives.
On October 16, and then on December 3, operatives travelled to the Czech Republic and carried out separate bombings at the Vrbětice ammunition depot.
The target was Bulgarian arms dealer Emilian Gebrev and his shipments to Ukraine. He survived, but two Czech workers were killed with more than £38million of damage caused.
Czech investigators identified officers Alexander Mishkin and Anatoliy Chepiga as perpetrators with both travelling on forged passports as “Ruslan Tabarov” and “Nikolai Popa”.
Dr Dan Lomas, Assistant Professor of International Relations at the University of Nottingham, says none of the incidents should be viewed in isolation.
He told The Sun: “This fits a broader pattern of GRU activity, which is kind of moving beyond strict intelligence gathering and into this realm of hybrid operations.
“It’s a broader pattern of behaviour, and we’ve seen it increase as Russia’s aims in Ukraine have become more maximalist.”
Blowing up Emilian Gebrev’s warehouses apparently wasn’t punishment enough for his support of Ukraine.
In the spring of 2015, 29155 went after him personally, smearing the door handles of his car with a “Novichok-like” nerve agent – much like in the Salisbury poisonings a few years later.
Gebrev fell seriously ill at the end of April and his production manager, Valentin Tahchiev, was also found poisoned two days later.
Gebrev and his son Hristo would suffer a near-identical relapse and were hospitalised again barely a month later.
Investigators later traced GRU Major General Denis Sergeev, travelling under the alias “Sergei Fedotov,” making three trips into Bulgaria that spring around the attacks.
Unit 29155 was also named responsible for severe election interference which included a foiled plot to storm parliament and assassinate a prime minister.
In October 2016, on the eve of Montenegro’s general election, authorities claimed Prime Minister Milo Đukanović was being lined up by a foreign death squad.
Officials claimed the attempt was a malicious bid to derail Montenegro from joining Nato and install a pro-Russian government.
Two military intelligence officers, linked by investigators to the same network behind the Bulgaria and Czech operations, were accused of directing the plan with local conspirators on the ground.
Eduard Shishmakov and Vladimir Popov were both later convicted in absentia.
Unit 29155 was also accused of attempting to meddle in Spain around the time of the 2017 Catalan independence referendum as Russian mobsters would soon descend on the Costas.
After the spate of ambushes on Europe, the black ops squad levelled up their attacks by targeting the UK.
The notorious 2018 Salisbury poisonings turned out to be a rare reckless and poorly coordinated plot carried out by Unit 29155.
The poisonings made headline news across the West after ex-Russian spy Sergei Skripal, his daughter Yulia and police officer Nick Bailey were all poisoned by Novichok and survived.
A few months later, mum-of-three Dawn Sturgess, 44, became accidentally contaminated with the deadly nerve agent after spraying a perfume bottle she had found in a charity collection bin in Amesbury.
The major fallout from the poisonings – both the fatal killing of an innocent woman and the failure to kill target Skripal – was a disaster for Unit 29155.
The operation finally broke the unit’s carefully curated cover and exposed Putin’s nefarious plans to wage a secret war against the West.
Dr Dan Lomas explained: “There’s traditionally been this idea that states will conduct this kind of covert action with plausible deniability.
“You can do stuff, but do it in a way where you can deny you were ever involved.”
Two agents easily identified as being behind the failed poisonings were named as Alexander Petrov and Ruslan Boshirov after both were caught on CCTV and easily tracked through flight records.
Petrov and Boshirov were soon unmasked by their real names Alexander Mishkin and Anatoliy Chepiga – both GRU officers.
Chepiga was also found to have used the alias of Popa in the Vrbětice bombings in Czech Republic.
Russian military chiefs scrambled to try and hide any Kremlin involvement, even shamelessly parading the two deep cover officers on Russia Today, a state-owned propaganda network.
The excruciating interview saw them infamously insist they were merely tourists who had travelled to Salisbury to admire its famous cathedral spire.
“The Russians really did not care,” Lomas says.
“Yes, it was dodgy tradecraft, they were operating in an environment where it was clear they were going to be identified.
“But from a Russian perspective, I don’t think they really cared because it sent a message.”
For Britain, though, it was a turning point.
Lomas said: “I think for the UK government, Salisbury was the moment the gloves suddenly came off.”
Then-Prime Minister Theresa May put the intelligence case “front and centre,” expelled Russian diplomats, and rallied allies to do the same.
“That was the start of the first real purge of Russian intelligence activity within Nato allies.”
At this point, Unit 29155 was still not known as a faction despite the string of attacks all being linked to Russia.
The first crack in uncovering the unit’s armour came from an unlikely source.
Experts investigating the European sabotage plots managed to dig up a throwaway line from a Russian defence ministry payroll memo titled: “Special achievement bonus – Unit 29155”.
Buried in a 2012 decree, the single line became the thread that investigators and journalists eventually pulled to unravel the whole operation.
Once exposed, 29155’s shadow operatives found themselves thrown under a broad and intense light; suddenly becoming the hunted, not the hunters.
Wanted posters bearing their real faces circulated from London to Washington with members effectively trapped inside Russia by Interpol Red Notices, sanctions, and warrants across the EU.
That shadowy network is largely gone now as Russia had to change tactics.
Russian commanders reportedly hoped to draw a line under the Salisbury humiliation by folding the unit into cyber operations.
Western agencies, including America’s CISA and Britain’s NCSC, formally attributed a run of cyber operations to Unit 29155 in 2024.
The FBI posted a $10million reward for information on its cyber operatives that August as the EU sanctioned individual members of the unit by name as recently as January 2025.
Experts see this as evolution rather than extinction.
Lomas says: “Cyber operations offer a kind of low-cost, high-win type of activity. You’re looking at a pyramid of activity, targeted assassination, your kind of Bond-like attack on a particular target, is going to be the top of the pyramid.
“At the bottom, you have information operations and cyber activity, which would probably take up most of what these types of organisations do.
“But I still think there’s still a need for kinetic, hybrid warfare activity, that need hasn’t gone away. I think it’s an evolution, rather than anything else.”
Zwolski agrees the shift was forced, not chosen: “Since 2022, Russia was forced to change tactics.
“They could no longer rely on this widespread network of diplomats doing double work with Russian security services.”
After seven years of violence including at least seven poisonings, three bombings and a handful of planned assassinations, Putin’s most feared operatives were left trapped in Moscow with nowhere to run.