Unmasked: The Russian spies who targeted Britain on Putin’s orders

Government exposes dozens of agents including two who targeted Sergei Skripal’s daughter

Dozens of Russian spies who targeted Sergei Skripal’s daughter and mounted a series of attacks on Britain have been exposed by the UK’s security services.

Two of the agents were accused of hacking Yulia Skripal’s mobile phone five years before Russia’s GRU military intelligence agency poisoned the pair with deadly Novichok nerve agent on the streets of Salisbury in 2018.

Others were said to be behind a string of covert bombings, arson attacks and damage to infrastructure on British and European soil in an attempt to derail support for Ukraine.

On Friday, the Foreign Office announced that it was sanctioning 18 spies and three GRU units as part of a crackdown on Vladimir Putin’s campaign to sow chaos on the continent.

The Telegraph understands that the UK moved to sanction the Russians because officials were confident they would never travel to Britain for possible apprehension.

This is the UK’s largest-ever set of sanctions against Russian intelligence services.

Ed Bogan, a former CIA agent, told The Telegraph: “Sanctioning these GRU units in particular is crucial, given the depth and breadth of their grey zone operations across numerous countries, which often go unseen or at best, only partially understood. More light on them is needed, but more importantly, more pressure and more action against them.”

British efforts to expose the shadowy operations were supported by the US’s FBI as well as intelligence services from across the Nato military alliance.

Among the operatives named are Ivan Yermakov and Aleksey Lukashev, two senior members of GRU’s Unit 26165 of elite hackers accused of targeting Ms Skripal’s devices before Moscow’s botched attempt to murder her father.

Authorities are keen to stress that cyber attacks not only disrupt key infrastructure but can also be used to facilitate physical attacks, such as the failed assassination attempt on Mr Skripal.

The former Russian spy and his daughter were poisoned in one of the most brazen uses of chemical weapons on British soil in March 2018.

There remain concerns about the safety of the Skripals, although it is not thought Friday’s disclosures are linked to any renewed imminent threat to their lives.

British authorities later attributed the assassination attempts, using one of the deadliest man-made chemicals, to Russia’s military intelligence.

Yermakov and Lukashev also feature on an FBI wanted list for their alleged roles in interfering with the 2016 presidential election, won by Donald Trump.

Unit 26165 has also been named in investigations into alleged hacks around the French presidential elections and political interference in Germany. It was responsible for the creation of “X-Agent”, a malware used to hack Yulia Skripal’s mobile phone.

The GRU intelligence officers targeted her phone with “malicious” malware known as X-Agent in 2013, five years before the assassination attempts in which an innocent British woman, Dawn Sturgess, was killed after she was poisoned with Novichok discarded by the GRU officers sent to kill Skripal.

X-Agent was developed by a Russian hacking gang known as Fancy Bear, which is linked to the GRU. It was first discovered by the West in 2015 and is used by Russia to infect both Apple’s iPhones and Android devices and can activate a device’s microphone and record audio as well as harvest text messages, contact lists, photos and geolocation data.

X-Agent has been used by Russia to pinpoint the movements of Ukrainian troops on the battlefield. Ms Skripal, who lived in Moscow, was tracked to the UK on a visit to her father in Salisbury. Two GRU agents followed her to the UK and smeared Mr Skripal’s door handle with Novichok, a military-grade nerve agent.

British officials are confident that the country’s voters would not be swayed by similar Russian disinformation attempts.

In 2022, their same unit was said to be responsible for conducting online reconnaissance to help position Russian strikes against the Mariupol Theatre, killing hundreds of women and children who were sheltering from Putin’s invasion forces.

Outside the building in the port city, those sheltering had written the word “children” in giant Russian lettering. The theatre was later hit by Russian missiles, despite it obviously not being a military target.

The same unit was credited with hacking internet surveillance cameras between 2022 and 2024 across Bulgaria, France, Germany, Greece, Italy, Moldova, Poland, Romania, Slovakia, Ukraine, the Czech Republic and the Netherlands to monitor military assistance being sent to Kyiv.

GRU units 74455, 26165, 29155 were also hit with UK sanctions, which means businesses registered in Britain will not legally be allowed to provide them with services which could assist their sabotage campaigns.

It is alleged that the Russian spies are responsible for a series of hacks and attacks on European military support for Ukraine.

British and European intelligence officers have found repeated examples of targeted attacks against port infrastructure, transport hubs, border control points and government infrastructure involved in aid shipments.

British officials fear that the GRU has used the battlefields of Ukraine as a testing ground for further development of a range of cyber capabilities, which would one day be turned on Western countries.

In the UK, three men were recently found guilty of an arson attack on an east London warehouse involved in shipping humanitarian aid and Elon Musk’s Starlink satellite internet systems to Ukraine.

Prosecutors said the attack could be linked to Russia’s Wagner Group of mercenaries.

British investigators were also probing whether Russian agents had sent an incendiary device through the post after it ignited at a DHL hub in Birmingham last year.

A string of similar incidents has been reported across Europe, including warehouse fires and sabotage of train lines.

GRU Unit 29155 has been enlisted by Russia’s top decision makers to mount a campaign of attempted assassinations, including that of the Skripals, in recent years.