Some officials have theorized that the Russians may be seeking revenge on NATO forces for a 2018 battle in Syria in which the American military killed several hundred pro-Syrian forces, including numerous Russian mercenaries, as they advanced on an American outpost. Officials have also suggested that the Russians may have been trying to derail peace talks to keep the United States bogged down in Afghanistan. But the motivation remains murky.
The officials briefed on the matter said the government had assessed the operation to be the handiwork of Unit 29155, an arm of Russia’s military intelligence agency, known widely as the G.R.U. The unit is linked to the March 2018 nerve agent poisoning in Salisbury, England, of Sergei Skripal, a former G.R.U. officer who had worked for British intelligence and then defected, and his daughter.
Western intelligence officials say the unit, which has operated for more than a decade, has been charged by the Kremlin with carrying out a campaign to destabilize the West through subversion, sabotage and assassination. In addition to the 2018 poisoning, the unit was behind an attempted coup in Montenegro in 2016 and the poisoning of an arms manufacturer in Bulgaria a year earlier.
American intelligence officials say the G.R.U. was at the center of Moscow’s covert efforts to interfere in the 2016 presidential election. In the months before that election, American officials say, two G.R.U. cyberunits, known as 26165 and 74455, hacked into Democratic Party servers and then used WikiLeaks to publish embarrassing internal communications.
In part because those efforts were aimed at helping tilt the election in Mr. Trump’s favor, his handling of issues related to Russia and Mr. Putin has come under particular scrutiny. The special counsel investigation found that the Trump campaign welcomed Russia’s intervention and expected to benefit from it, but found insufficient evidence to establish that his associates had engaged in any criminal conspiracy with Moscow.
Operations involving Unit 29155 tend to be much more violent than those involving the cyberunits. Its officers are often decorated military veterans with years of service, in some cases dating to the Soviet Union’s failed war in Afghanistan in the 1980s. Never before has the unit been accused of orchestrating attacks on Western soldiers, but officials briefed on its operations say it has been active in Afghanistan for many years.
Though Russia declared the Taliban a terrorist organization in 2003, relations between them have been warming in recent years. Taliban officials have traveled to Moscow for peace talks with other prominent Afghans, including the former president, Hamid Karzai. The talks have excluded representatives from the current Afghan government as well as anyone from the United States, and at times they have seemed to work at crosscurrents with American efforts to bring an end to the conflict.