Russian President Vladimir Putin has appointed a former cybersecurity executive with alleged ties to a Russian military intelligence hacking unit as an aide to the secretary of Russia’s Security Council. Andrei Kozlov, the former head of a cybersecurity center within Russia’s state-owned defense conglomerate Rostec, was named an aide to Security Council Secretary Sergei Shoigu on Friday. According to leaked data published by independent Russian outlet The Insider, Kozlov held a classified security clearance under Military Unit 26165 — also known as the 85th Main Special Service Center — which Western governments and cybersecurity firms have linked to the hacking group Fancy Bear. Also tracked as APT28, BlueDelta and Forest Blizzard, the group has for years been accused of conducting cyber espionage, credential theft and influence operations targeting governments, defense contractors, logistics companies and policy organizations across Europe and the United States. Kozlov’s predecessor in the Security Council role, Pavel Konovalchik, was also reportedly linked to the same GRU unit, according to The Insider. In April, Konovalchik was appointed first deputy general director of the Russian state news agency TASS. Beofre his Security Council appointment, Kozlov worked in the Russian information security sector. Between May 2024 and April 2026, he headed an association representing local organizations working in cybersecurity and information security. Earlier, in 2022, Kozlov served as acting general director of RT-Information Security, also known as RT-IB, a cybersecurity center operated by Rostec. The company says it provides protection for critical information infrastructure, incident response services, penetration testing and cybersecurity audits. As a subsidiary of Rostec, RT-IB has been sanctioned by the U.S., EU and other Western states. Russia’s Security Council is one of the Kremlin’s most influential advisory bodies, bringing together senior officials, including the defense minister, intelligence chiefs and top military commanders, to advise Putin on national security and strategic policy matters. It is currently headed by former Defense Minister Shoigu.
Get more insights with the
Recorded Future
Intelligence Cloud.
No previous article
No new articles

Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.