Kremlin Appoints Ex-Cybersecurity Exec Linked to Fancy Bear to Security Council
The Russian government has appointed **Andrei Kozlov**, a former cybersecurity executive, as an aide to the Secretary of Russia's Security Council. Kozlov has alleged ties to Military Unit 26165, also known as the 85th Main Special Service Center, which is associated with the hacking group **Fancy Bear** (APT28).
### Kozlov's Appointment Raises Concerns
**Vladimir Putin** has appointed **Andrei Kozlov**, formerly the head of a cybersecurity center within **Rostec**, Russia's state-owned defense conglomerate, as an aide to Security Council Secretary **Sergei Shoigu**. The appointment, announced Friday, has sparked concern due to Kozlov's alleged connections to a notorious Russian military intelligence hacking unit.
According to leaked data published by *The Insider*, Kozlov previously held a classified security clearance under Military Unit 26165. This unit, also known as the 85th Main Special Service Center, has been linked by Western governments and cybersecurity firms to **Fancy Bear**.
### Fancy Bear's History of Cyber Espionage
**Fancy Bear**, also tracked as APT28, BlueDelta, and Forest Blizzard, has been implicated in years of cyber espionage, credential theft, and influence operations. Their targets include governments, defense contractors, logistics companies, and policy organizations across Europe and the United States. The group has been accused of leveraging vulnerabilities in **Microsoft Office** and other widely used software to gain access to sensitive information and disrupt operations.
### Predecessor Also Linked to GRU Unit
Notably, Kozlov's predecessor in the Security Council role, **Pavel Konovalchik**, was also reportedly linked to the same GRU unit, according to *The Insider*. In April, Konovalchik was appointed first deputy general director of the Russian state news agency **TASS**.
### Kozlov's Background in Information Security
Before his Security Council appointment, Kozlov was active in the Russian information security sector. From May 2024 to April 2026, he headed an association representing local cybersecurity and information security organizations. In 2022, Kozlov served as acting general director of **RT-Information Security (RT-IB)**, a cybersecurity center operated by **Rostec**. **RT-IB** offers services such as protection for critical information infrastructure, incident response, penetration testing, and cybersecurity audits. As a subsidiary of **Rostec**, **RT-IB** has been sanctioned by the U.S., EU, and other Western states.
### Russia's Security Council: An Influential Advisory Body
The Security Council is a key advisory body within the Kremlin, advising Putin on national security and strategic policy matters. Its members include senior officials such as the defense minister, intelligence chiefs, and top military commanders. The council is currently headed by former Defense Minister Shoigu.
<a href="https://www.recordedfuture.com/?utm_source=therecord&utm_medium=ad"><figure><img src="https://cms.therecord.media/uploads/2025_0514_Record_Ads_970x250_1_d144dbf901.png" data-nimg="1" decoding="async" height="500" width="1000" alt="Recorded Future"></figure></a>
