First came a destabilization campaign in Moldova, followed by the poisoning of an arms dealer in Bulgaria and then a thwarted coup in Montenegro. Last year, there was an attempt to assassinate a former Russian spy in Britain using a nerve agent. Though the operations bore the fingerprints of Russia’s intelligence services, the authorities initially saw them as isolated, unconnected attacks.
Western security officials have now concluded that these operations, and potentially many others, are part of a coordinated and ongoing campaign to destabilize Europe, executed by an elite unit inside the Russian intelligence system skilled in subversion, sabotage and assassination.
The group, known as Unit 29155, has operated for at least a decade, yet Western officials only recently discovered it. Intelligence officials in four Western countries say it is unclear how often the unit is mobilized and warn that it is impossible to know when and where its operatives will strike.
The purpose of Unit 29155, which has not been previously reported, underscores the degree to which the Russian president, Vladimir V. Putin, is actively fighting the West with his brand of so-called hybrid warfare — a blend of propaganda, hacking attacks and disinformation — as well as open military confrontation.
“I think we had forgotten how organically ruthless the Russians could be,” said Peter Zwack, a retired military intelligence officer and former defense attaché at the United States Embassy in Moscow, who said he was not aware of the unit’s existence.
In a text message, Dmitri S. Peskov, Mr. Putin’s spokesman, directed questions about the unit to the Russian Defense Ministry. The ministry did not respond to requests for comment.
Hidden behind concrete walls at the headquarters of the 161st Special Purpose Specialist Training Center in eastern Moscow, the unit sits within the command hierarchy of the Russian military intelligence agency, widely known as the G.R.U.
Though much about G.R.U. operations remains a mystery, Western intelligence agencies have begun to get a clearer picture of its underlying architecture. In the months before the 2016 presidential election, American officials say two G.R.U. cyber units, known as 26165 and 74455, hacked into the servers of the Democratic National Committee and the Clinton campaign, and then published embarrassing internal communications.
[Our correspondent Matt Apuzzo reported on Russia’s blueprint for foreign disruption on “The Weekly,” The Times’s TV show. Watch on FX and Hulu.]
Last year, Robert S. Mueller III, the special counsel overseeing the inquiry into Russian interference in the 2016 elections, indicted more than a dozen officers from those units, though all still remain at large. The hacking teams mostly operate from Moscow, thousands of miles from their targets.
By contrast, officers from Unit 29155 travel to and from European countries. Some are decorated veterans of Russia’s bloodiest wars, including in Afghanistan, Chechnya and Ukraine. Its operations are so secret, according to assessments by Western intelligence services, that the unit’s existence is most likely unknown even to other G.R.U. operatives.
The unit appears to be a tight-knit community. A photograph taken in 2017 shows the unit’s commander, Maj. Gen. Andrei V. Averyanov, at his daughter’s wedding in a gray suit and bow tie. He is posing with Col. Anatoly V. Chepiga, one of two officers indicted in Britain over the poisoning of a former spy, Sergei V. Skripal.
“This is a unit of the G.R.U. that has been active over the years across Europe,” said one European security official, who spoke on condition of anonymity to describe classified intelligence matters. “It’s been a surprise that the Russians, the G.R.U., this unit, have felt free to go ahead and carry out this extreme malign activity in friendly countries. That’s been a shock.”
To varying degrees, each of the four operations linked to the unit attracted public attention, even as it took time for the authorities to confirm that they were connected. Western intelligence agencies first identified the unit after the failed 2016 coup in Montenegro, which involved a plot by two unit officers to kill the country’s prime minister and seize the Parliament building.
But officials began to grasp the unit’s specific agenda of disruption only after the March 2018 poisoning of Mr. Skripal, a former G.R.U. officer who had betrayed Russia by spying for the British. Mr. Skripal and his daughter, Yulia, fell grievously ill after exposure to a highly toxic nerve agent, but survived.
(Three other people were sickened, including a police officer and a man who found a small bottle that British officials believe was used to carry the nerve agent and gave it to his girlfriend. The girlfriend, Dawn Sturgess, died after spraying the nerve agent on her skin, mistaking the bottle for perfume.)
The poisoning led to a geopolitical standoff, with more than 20 nations, including the United States, expelling 150 Russian diplomats in a show of solidarity with Britain.
Ultimately, the British authorities exposed two suspects, who had traveled under aliases but were later identified by the investigative site Bellingcat as Colonel Chepiga and Alexander Mishkin. Six months after the poisoning, British prosecutors charged both menwith transporting the nerve agent to Mr. Skripal’s home in Salisbury, England, and smearing it on his front door.
But the operation was more complex than officials revealed at the time.
Exactly a year before the poisoning, three Unit 29155 operatives traveled to Britain, possibly for a practice run, two European officials said. One was Mr. Mishkin. A second man used the alias Sergei Pavlov. Intelligence officials believe the third operative, who used the alias Sergei Fedotov, oversaw the mission.
Soon, officials established that two of these officers — the men using the names Fedotov and Pavlov — had been part of a team that attempted to poison the Bulgarian arms dealer Emilian Gebrev in 2015. (The other operatives, also known only by their aliases, according to European intelligence officials, were Ivan Lebedev, Nikolai Kononikhin, Alexey Nikitin and Danil Stepanov.)
The team would twice try to kill Mr. Gebrev, once in Sofia, the capital, and again a month later at his home on the Black Sea.
Speaking to reporters in February at the Munich Security Conference, Alex Younger, the chief of MI6, Britain’s foreign intelligence service, spoke out against the growing Russian threat and hinted at coordination, without mentioning a specific unit.
“You can see there is a concerted program of activity — and, yes, it does often involve the same people,” Mr. Younger said, pointing specifically to the Skripal poisoning and the Montenegro coup attempt. He added: “We assess there is a standing threat from the G.R.U. and the other Russian intelligence services and that very little is off limits.”
The Kremlin sees Russia as being at war with a Western liberal order that it views as an existential threat.
At a ceremony in November for the G.R.U.’s centenary, Mr. Putin stood beneath a glowing backdrop of the agency’s logo — a red carnation and an exploding grenade — and described it as “legendary.” A former intelligence officer himself, Mr. Putin drew a direct line between the Red Army spies who helped defeat the Nazis in World War II and officers of the G.R.U., whose “unique capabilities” are now deployed against a different kind of enemy.
“Unfortunately, the potential for conflict is on the rise in the world,” Mr. Putin said during the ceremony. “Provocations and outright lies are being used and attempts are being made to disrupt strategic parity.”
In 2006, Mr. Putin signed a law legalizing targeted killings abroad, the same year a team of Russian assassins used a radioactive isotope to murder Aleksander V. Litvinenko, another former Russian spy, in London.
Unit 29155 is not the only group authorized to carry out such operations, officials said. The British authorities have attributed Mr. Litvinenko’s killing to the Federal Security Service, the intelligence agency once headed by Mr. Putin that often competes with the G.R.U.
Although little is known about Unit 29155 itself, there are clues in public Russian records that suggest links to the Kremlin’s broader hybrid strategy.
A 2012 directive from the Russian Defense Ministry assigned bonuses to three units for “special achievements in military service.” One was Unit 29155. Another was Unit 74455, which was involved in the 2016 election interference. The third was Unit 99450, whose officers are believed to have been involved in the annexation of the Crimean Peninsula in 2014.
A retired G.R.U. officer with knowledge of Unit 29155 said that it specialized in preparing for “diversionary” missions, “in groups or individually — bombings, murders, anything.”
“They were serious guys who served there,” the retired officer said. “They were officers who worked undercover and as international agents.”
Photographs of the unit’s dilapidated former headquarters, which has since been abandoned, show myriad gun racks with labels for an assortment of weapons, including Belgian FN-30 sniper rifles, German G3A3s, Austrian Steyr AUGs and American M16s. There was also a form outlining a training regimen, including exercises for hand-to-hand combat. The retired G.R.U. officer confirmed the authenticity of the photographs, which were published by a Russian blogger.
The current commander, General Averyanov, graduated in 1988 from the Tashkent Military Academy in what was then the Soviet Republic of Uzbekistan. It is likely that he would have fought in both the first and second Chechen wars, and he was awarded a Hero of Russia medal, the country’s highest honor, in January 2015. The two officers charged with the Skripal poisoning also received the same award.
Though an elite force, the unit appears to operate on a shoestring budget. According to Russian records, General Averyanov lives in a run-down Soviet-era building a few blocks from the unit’s headquarters and drives a 1996 VAZ 21053, a rattletrap Russia-made sedan. Operatives often share cheap accommodation to economize while on the road. British investigators say the suspects in the Skripal poisoning stayed in a low-cost hotel in Bow, a downtrodden neighborhood in East London.
But European security officials are also perplexed by the apparent sloppiness in the unit’s operations. Mr. Skripal survived the assassination attempt, as did Mr. Gebrev, the Bulgarian arms dealer. The attempted coup in Montenegro drew an enormous amount of attention, but ultimately failed. A year later, Montenegro joined NATO. It is possible, security officials say, that they have yet to discover other, more successful operations.
It is difficult to know if the messiness has bothered the Kremlin. Perhaps, intelligence experts say, it is part of the point.
“That kind of intelligence operation has become part of the psychological warfare,” said Eerik-Niiles Kross, a former intelligence chief in Estonia. “It’s not that they have become that much more aggressive. They want to be felt. It’s part of the game.”