Vladimir Putin has appointed Andrei Kozlov as an aide to the secretary of Russia’s Security Council, former Defense Minister Sergei Shoigu. Kozlov comes from cybersecurity structures linked to the state defense corporation Rostec and, according to leaked data, held a classified security clearance issued through Military Unit 26165. He succeeded General Pavel Konovalchik, who held the post until March and was also linked to the same GRU unit. The Insider previously established that Military Unit 26165 is connected to the hacker group Fancy Bear/APT28, which has been accused of hacking the Emmanuel Macron campaign’s headquarters, the U.S. Democratic Party, NATO, WADA, and Russian journalists.
The Insider confirmed that the newly appointed aide to the Security Council secretary is Andrei Gennadyevich Kozlov, who was previously linked to information security structures close to Russian state defense corporation Rostec. A woman who answered a phone number listed in corporate registries confirmed Kozlov’s appointment and said she would forward The Insider’s request for clarification about his biography.
According to the records in the corporate database SPARK, Kozlov headed the RUSIB Association, which brings together organizations working in information security, from May 2024 to April 2026. Earlier, in November and December 2022, he served as acting general director of RT-Information Security, or RT-IB, previously known as IB Reform. The company is Rostec’s cybersecurity center and is responsible for protecting the state corporation’s information systems and those of its affiliated organizations.
RT-IB describes itself as a directly managed Rostec organization and the “single center of expertise for technological support of the corporate information security system” of the state corporation and its subsidiaries.
The company says it protects critical information infrastructure, monitors and responds to computer incidents, conducts penetration testing and carries out information security audits. Its listed clients include Rostec, the United Aircraft Corporation and Uralvagonzavod. RT-IB also holds an FSB license for work involving cryptographic tools and an FSTEC license for the technical protection of confidential information.
Materials published by the Russian Engineering Union also identified Kozlov as first deputy general director of IB Reform. In 2022, he spoke at a conference on protecting critical information infrastructure at defense industry enterprises and cooperating with GosSOPKA, Russia’s state system for detecting and mitigating computer attacks.
IB Reform, later renamed RT-IB, is under U.S. sanctions. The OFAC database lists it as Joint Stock Company Information Security Reform on the SDN List under the Russia-related Executive Order 14024 sanctions program. The designation cites the company’s information security activities and notes the risk of secondary sanctions.
Leaked border-crossing and flight records reviewed by The Insider show that Kozlov visited Iran in 2021 and stayed in the country for close to a week.
Kozlov’s predecessor, Pavel Konovalchik, was dismissed as aide to the Security Council secretary in March 2026. The Insider previously reported that in the early 2010s, he commanded the GRU’s 180th Separate Special-Purpose Radio Reconnaissance Brigade near St. Petersburg and was also linked to the GRU’s 85th Special Service Center, Military Unit 26165. U.S. authorities accused personnel from that unit of hacking Democratic Party servers in 2016, while cybersecurity researchers have linked it to the Fancy Bear/APT28 group. Ukrainian and Russian sources have also tied Konovalchik to the Defense Ministry’s so-called information operations troops.
