Adversary Intelligence — 2026-07-17

EU Identifies FSB 16th Centre Behind TURLA Cyber Operations and Poland Energy Sector Sabotage in First Coordinated Sanctions With UK

BLUFNaming the 16th Centre without designating it as a sanctioned entity preserves an escalation lever Brussels and London can pull if Russian infrastructure sabotage continues.

The EU's High Representative on Monday issued a statement identifying the FSB's 16th Centre as the force behind the TURLA hacking group and a broader espionage and sabotage campaign against the bloc, its member states and international partners, naming France, Germany, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland as additional targets alongside Poland 1. The statement blamed the 16th Centre specifically for disruptive sabotage against Poland's combined heat and power plants and other critical infrastructure, an attack that came close to blacking out roughly half a million people last winter 12. In response, the EU imposed sanctions, including asset freezes and travel bans, on nine individuals and four entities tied to Russia's cyber campaigns, among them GRU officers, hacktivists, cybercriminals and private companies 1. The Record reported the package as the first coordinated cyber sanctions jointly issued by the UK and EU, covering more than 30 individuals and entities combined, with the UK separately sanctioning the operators behind the Lumma Stealer malware and ten individuals tied to the pro-Kremlin Rybar military blog 2.

Analysis
The EU and UK's decision to name the 16th Centre by title rather than merely sanctioning its proxies treats public attribution itself as a pressure tool separate from the sanctions list, and folding hacktivists, cybercriminals and private firms into the same package alongside GRU officers formalizes recognition that Moscow blends state and non-state actors to preserve deniability. Leaving the unit named but undesignated keeps an escalation option open should further sabotage against European energy or industrial infrastructure be traced to it. This reverses an expectation that Brussels and London would avoid direct attribution, though the sourcing rests on the Council's own statement with only secondary summaries corroborating it, and the 16th Centre's activity in France reportedly dating to 2010 suggests the announcement may simply be publicizing an existing intelligence assessment to justify the sanctions rather than surfacing a new discovery.

3 sources

EU condemns Russia malicious cyber ecosystem, identifies FSB 16th Centre behind TURLA operations - Industrial Cyber
Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions - The Record from Recorded Future News
Cyber / Russia: Statement by the High Representative on behalf of the European Union denouncing Russia's malicious cyber ecosystem targeting the EU, its member states and international partners - Council of the European Union