GRU

Russia's military intelligence service, not a single cyber group. Multiple GRU units conduct espionage, influence, disruptive, and destructive cyber operations; well-known subordinate activity includes APT28/Fancy Bear and Sandworm-linked operations.