First came a destabilization campaign in Moldova, followed by the poisoning of an arms dealer in Bulgaria and then a thwarted coup in Montenegro. Last year, there was an attempt to assassinate a former Russian spy in Britain using a nerve agent. Though the operations bore the fingerprints of Russia's intelligence services, authorities initially saw them as isolated, unconnected attacks.
Western security officials have now concluded that these operations, and potentially many others, are part of a coordinated and ongoing campaign to destabilize Europe, executed by an elite unit inside the Russian intelligence system skilled in subversion, sabotage and assassination.
The group, known as Unit 29155, has operated for at least a decade, yet Western officials only recently discovered it. Intelligence officials in four Western countries say it is unclear how often the unit is mobilized and warn that it is impossible to know when and where its operatives will strike.
The purpose of Unit 29155, which has not been previously reported, underscores the degree to which Russian President Vladimir Putin is actively fighting the West with his brand of so-called hybrid warfare — a blend of propaganda, hacking attacks and disinformation — as well as open military confrontation.
"I think we had forgotten how organically ruthless the Russians could be," said Peter Zwack, a retired military intelligence officer and former defense attaché at the U.S. Embassy in Moscow, who said he was not aware of the unit's existence.
The Russian Defense Ministry did not respond to requests for comment.
At the headquarters of the 161st Special Purpose Specialist Training Center in eastern Moscow, the unit sits within the command hierarchy of the Russian military intelligence agency, known as the GRU.
Though much about GRU operations remains a mystery, Western intelligence agencies have begun to get a clearer picture of its underlying architecture. In the months before the 2016 presidential election, U.S. officials say two GRU cyber units, known as 26165 and 74455, hacked into the servers of the Democratic National Committee and the Clinton campaign, and then published embarrassing internal communications.
Last year, Robert Mueller, the special counsel overseeing the inquiry into Russian interference in the 2016 elections, indicted more than a dozen officers from those units, though all still remain at large.
Western intelligence agencies first identified the unit after the failed 2016 coup in Montenegro, which involved a plot by two unit officers to kill the country's prime minister and seize the parliament building.
But officials began to grasp the unit's specific agenda of disruption only after the March 2018 poisoning of Sergei Skripal, a former GRU officer who had betrayed Russia by spying for the British. Skripal and his daughter, Yulia, fell grievously ill after exposure to a highly toxic nerve agent but survived.
The poisoning led to a geopolitical standoff, with more than 20 nations, including the United States, expelling 150 Russian diplomats in a show of solidarity with Britain.
Ultimately, British authorities exposed two suspects, who had traveled under aliases but were later identified by the investigative site Bellingcat as Col. Anatoly V. Chepiga and Alexander Mishkin. Six months after the poisoning, British prosecutors charged both men with transporting the nerve agent to Skripal's home in Salisbury, England, and smearing it on his front door.
But the operation was more complex than officials revealed at the time.
Exactly a year before the poisoning, three Unit 29155 operatives traveled to Britain, possibly for a practice run, two European officials said. One was Mishkin. A second man used the alias Sergei Pavlov. Intelligence officials believe the third operative, who used the alias Sergei Fedotov, oversaw the mission.
Soon, officials established that two of these officers — the men using the names Fedotov and Pavlov — had been part of a team that attempted to poison Bulgarian arms dealer Emilian Gebrev in 2015.
The team would twice try to kill Gebrev, once in Sofia, the capital, and again a month later at his home on the Black Sea.
Although little is known about Unit 29155 itself, there are clues in public Russian records that suggest links to the Kremlin's broader hybrid strategy.
A 2012 directive from the Russian Defense Ministry assigned bonuses to three units for "special achievements in military service." One was Unit 29155. Another was Unit 74455, which was involved in the 2016 election interference. The third was Unit 99450, whose officers are believed to have been involved in the annexation of the Crimean Peninsula in 2014.
A retired GRU officer with knowledge of Unit 29155 said that it specialized in preparing for "diversionary" missions, "in groups or individually — bombings, murders, anything."
"They were serious guys who served there," the retired officer said. "They were officers who worked undercover and as international agents."