ABSTRACT. Distinguishing between state and non-state actors within Russia is often difficult, especially when these actors actively collaborate, cooperate, and condone criminal activity that pose a threat to the security of Georgia and the entire western society. This article covers principal cyber groups, directly or indirectly connected to the Russian special services or state institutions, their responsibilities, motivation, and attack methods before a full-scale invasion of Ukraine. This knowledge will help us build efficient cyber defense models established in Georgian defense institutions.