Adversary Intelligence — 2026-07-17

EU Sanctions GRU Unit 29155 Officers, Russian Hacktivists and Hosting Firms Over Cyberattacks on Critical Infrastructure in Coordinated Action With UK

BLUFCoordinated EU-UK sanctions consolidate state and criminal cyber actors into a unified target set, establishing a joint attribution framework whose deterrent value still outpaces its enforcement reach.

The Council of the European Union sanctioned nine individuals and four entities on Monday over cyberattacks and destabilization activity against the bloc and its members, acting simultaneously with the UK for the first time under their respective cyber sanctions regimes 12. Listings include bulletproof hosting provider Media Land LLC and owner Alexander Volosovik, whose infrastructure enabled LockBit, EvilCorp and BlackBasta ransomware operations, and hacktivist group Z-Pentest, which struck a Danish water utility in December 2024 1. Also sanctioned are GRU Unit 29155 members Evgeniy Bashev and Roman Puntus, linked to the WhisperGate attacks on Ukraine and transport-sector intrusions in EU states, plus three individuals tied to the LummaC2, Trickbot and Conti malware families 1. The remaining two entities are ML.Cloud, Media Land's sister hosting firm, and Impuls LLC, owned by Bashev and accused of supplying technical and material support to GRU Unit 29155 operations; among the nine individuals are CARR (Cyber Army of Russia Reborn) leader Yuliya Pankratova and hacker Denis Degtyarenko, whose group spun off Z-Pentest amid a dispute over GRU funding 1.

Analysis
The joint EU-UK action institutionalizes a coordination mechanism treating GRU Unit 29155 officers, bulletproof hosting operators, and ransomware-adjacent malware developers as a single target set rather than separate criminal and military tracks. Naming Bashev and Puntus alongside Impuls LLC exposes the commercial front company GRU cyber operations use for cover and payment, while the simultaneous FSB 16th Centre attribution extends the framework to a second Russian intelligence organ and its TURLA operations. Consilium's press release is the sole primary account; Industrial Cyber and BleepingComputer merely amplify it without independent sourcing. Asset freezes and travel bans carry limited reach against Russia-based principals who never transit EU or UK jurisdiction, so the measures function primarily as attribution and diplomatic signaling rather than operational disruption, leaving Media Land's hosting infrastructure and Unit 29155's tasking largely unconstrained.

3 sources

EU sanctions Russian GRU officers, hacktivists and hosting firms over cyberattacks on critical infrastructure - Industrial Cyber
EU sanctions Russian GRU military hackers over cyberattacks - BleepingComputer
Russian cyber-attacks and destabilising activities: Council sanctions nine individuals and four entities - Council of the European Union (Consilium)