Adversary Intelligence — 2026-07-14

Turla Hackers Exploit SharePoint Flaw to Access Thousands of French Government and Defense User Accounts

BLUFParis's second public attribution of Russian state hacking in three months establishes a cadence that pressures EU partners to match with coordinated restrictive measures or risk appearing passive.

France's Cyber Crisis Coordination Center (C4), joined by the Ministry for Europe and Foreign Affairs and the EU's High Representative for Foreign Affairs, formally attributed a long-running cyber-espionage campaign to the Turla intrusion set, operated by the FSB's 16th Center, on Monday 12. C4 members, including ANSSI, COMCYBER, the DGA, DGSE and DGSI, found the campaign active in France since at least 2004, with intermediate and final victims spanning ministries and the diplomatic, defense, justice and technology sectors 12. Investigators cited specific incidents: compromise of Ministry of Armed Forces email accounts since 2017, a 2018 breach of the Foreign Affairs Ministry network at the French embassy in Moscow, a 2019 SharePoint-linked intrusion at a justice-sector continuing-education server that may have exposed data on several thousand user accounts, and a 2025 compromise at an advanced-technology entity 23. C4 also identified associations, individuals and private companies used as intermediate infrastructure in the campaign 2.

Analysis
Joint French-EU attribution of Turla to the FSB's 16th Center converts a two-decade collection problem into a diplomatic instrument, mirroring the escalatory template Paris used against the GRU's APT28 in April 2025. Naming the unit exposes tradecraft, complicates FSB reuse of compromised justice, defense, and technology infrastructure, and signals that French services track its offensive units in real time, though the coordinated CERT-FR/ANSSI and COMCYBER statements leave convergence structural rather than cross-sourced, with trade press merely restating the official account. The timing may reflect broader EU hybrid-threat signaling toward Moscow rather than response to a specific new intrusion, given the campaign reportedly ran undetected since 2004. Whether Paris follows with sanctions, expulsions, or EU-level restrictive measures remains unresolved, and no indicators yet show how the FSB will adapt its infrastructure model.

4 sources

Ciblage et compromission d'entités françaises au moyen du mode opératoire d'attaque Turla - CERT-FR (ANSSI)
Ciblage et compromission d'entités françaises au moyen du mode opératoire d'attaque Turla : la France et l'Union Européenne dénoncent les actions de la Russie - Ministère des Armées (COMCYBER)
Turla Hackers Exploit SharePoint Flaw to Access Thousands of French User Accounts - Cyber Security News
Russian FSB-Linked Turla Hackers Target French Ministries, Embassies, and Defense Entities - GBHackers