Adversary Intelligence — 2026-05-26

Kremlin Appoints Cyber Executive With Alleged GRU Ties to Security Council Role

BLUFBack-to-back placement of Unit 26165-linked aides in Shoigu's office signals deliberate GRU cyber embedding at the policy core, though Western designation of Kozlov by November 26, 2026 remains unlikely.

Putin signed a decree on May 22 appointing Andrei Kozlov, a former Rostec cybersecurity executive, as aide to Security Council Secretary Sergei Shoigu 123. Kozlov served as acting general director of RT-IB, Rostec's cybersecurity subsidiary, in late 2022 and headed the RUSIB information security association from May 2024 to April 2026 34. The Insider, citing leaked security clearance records, reports that Kozlov held a classified clearance under Military Unit 26165, the GRU unit Western governments and cybersecurity researchers have linked to Fancy Bear/APT28 34. Kozlov's predecessor in the post, Pavel Konovalchik, was dismissed in March 2026 and named first deputy general director of TASS in April; The Insider had previously reported Konovalchik's ties to the same unit 234.

Analysis
Designation by November 26, 2026 is unlikely: precedent for sanctioning Security Council advisory staff at this tier is thin, and Kozlov's limited public profile falls short of the threshold historically triggering OFAC or EU action against Rostec-linked officials. Two consecutive aides to Shoigu with Military Unit 26165 clearances indicate the Kremlin is deliberately embedding GRU cyber expertise in this staff position. Kozlov's RT-IB background positions him for liaison between offensive cyber capability and national security policy. Moderate confidence, given the GRU linkage rests entirely on The Insider's leaked records without independent corroboration. His clearance may instead reflect routine defense-sector access common across Russia's information security sector. OFAC inaction leaves allied compliance officers without grounds to treat Security Council advisory staff as a sanctions category.

5 sources