Intelligence officials have confirmed a fresh espionage operation in Italy, linking the Russian Main Intelligence Directorate, the GRU, to a spy ring allegedly directed from the Russian embassy in Rome. Colonel Mikhail Ostrovsky, a GRU officer, is said to have led the effort, which targeted sensitive military technology and operational plans — in particular, information about NATO air defense systems supplied to Ukraine.
The case highlights the GRU’s continued focus on acquiring technical specifications that could help Russian forces counter those weapons on the battlefield. The operation fits a pattern European security services have tracked for years: using diplomatic cover to run agent networks. In this instance, the Russian embassy in Rome served as the command node for the intelligence-gathering effort.
The GRU’s interest in NATO air defense systems is strategically significant for Moscow. These systems are critical to Ukraine’s ability to protect its airspace, and any compromise of their technical data could have direct consequences on the front lines, potentially reducing the effectiveness of equipment sent to Kyiv.
The GRU’s Long Reach: From Moscow to European Capitals
Founded in 1918, the GRU is headquartered in Moscow and serves as Russia’s primary military intelligence agency. It is a component of the General Staff of the Russian Federation and operates independently from other Russian security services.
Unlike its counterparts, the GRU maintains its own special forces units and runs both traditional human intelligence networks and offensive cyber operations. Its mission is to collect intelligence worldwide and conduct covert action on behalf of the Russian military. The agency survived the dissolution of the Soviet Union in 1991 and rebuilt its overseas presence by the early 2000s, concentrating on NATO member states and former Soviet republics.
Its cyber unit, known as Unit 29155, has been active in election interference and disruptive hacking campaigns. European intelligence services have long tracked GRU activity, but the 2022 invasion of Ukraine spurred a fresh wave of operations.
Since then, the GRU has intensified efforts to steal technical specifications for Western weaponry, particularly air defense systems. European nations have uncovered multiple GRU-linked networks in recent years, though counterintelligence successes have not eliminated the threat. In Austria in 2023, a former Austrian military officer was arrested for passing NATO secrets to Russia.
In Germany in 2024, a defense ministry employee was charged with espionage linked to the GRU. The Netherlands acted in 2023, expelling four Russian diplomats accused of attempting to recruit informants.
Beyond traditional espionage, the GRU is known for cyber intrusions, including the 2015 hack of the German Bundestag and the 2016 interference in the US presidential election. These operations reveal a consistent pattern: the GRU treats embassy posts as cover for intelligence gathering, and its aggressive approach has persisted despite heightened scrutiny.
Why the Italian Case Matters for NATO and Ukraine
The GRU’s targeting of air defense systems supplied to Ukraine represents a strategic priority for Moscow. Such systems are vital to Ukraine’s ability to defend its skies from Russian missiles and aircraft.
If Russian forces obtain technical data on these systems, they could adjust tactics or develop countermeasures, potentially eroding Ukraine’s defensive advantage. The Italian operation underscores that the GRU views the theft of military technology as a core mission, even when operating under the watch of allied intelligence agencies. European intelligence services have become more adept at detecting and disrupting GRU networks, but the Italian case demonstrates that the challenge is far from over.
The agency’s continued operations, despite increased awareness and counterintelligence efforts, suggest the GRU remains a persistent and adaptable threat. For European readers, the pattern matters because compromised military technology could reduce the effectiveness of equipment sent to Ukraine, and because the GRU routinely uses diplomatic cover to conduct espionage across the continent.
The agency’s history, dating back to the Soviet era, shows a tradition of compartmentalization and aggressiveness that persists today. The GRU emerged from the Cold War with a reputation for running deep-cover agent networks independent of the KGB. That tradition continued after the Soviet collapse.
By the early 2000s, the agency had rebuilt its presence abroad. The current series of operations reflects a strategic shift since the 2022 invasion of Ukraine.
European security services have in recent years arrested or expelled GRU-linked operatives in multiple countries, but each new case confirms that the agency maintains both the capability and the will to pursue intelligence objectives despite the risks. The Italian operation adds a new chapter to this ongoing story, demonstrating that the GRU’s targeting of NATO technology and its willingness to operate from embassy cover remain hallmarks of its approach.
