Adversary Intelligence — 2026-07-13

EU and UK Sanction Russian FSB and GRU Cyberespionage Networks Over Years-Long Campaign

BLUFJoint EU-UK designation of FSB and GRU commercial proxies establishes a reusable attribution template but imposes minimal operational cost on networks already insulated from Western financial systems.

The European Union sanctioned nine individuals and four entities on Monday over a cyberespionage campaign it attributed to FSB Center 16 and the hacker group known as Turla, Secret Blizzard or Waterbug, with EU foreign policy chief Kaja Kallas citing targeting of France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland dating to 2010 123. The EU and UK jointly attributed a December attack on Poland's energy grid, which risked leaving 500,000 people without power, to the FSB 134. The UK separately sanctioned 24 individuals and entities, naming GRU officials Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko for directing cyber and hybrid operations, and citing GRU Unit 29155's recruitment of hackers through the firm OOO Impuls, which the EU also sanctioned along with GRU officer Yevgeny Bashev 34. UK Foreign Secretary Yvette Cooper said the measures also target operators of the Lumma Stealer malware, which the UK National Crime Agency says produced at least 2,100 UK victims in the past six months, and 10 individuals tied to the media outlet Rybar LLC 4. Germany and France said they would summon Russia's ambassador over the attacks 3.

Analysis
The first joint EU-UK cyber sanctions package formalizes state attribution while extending punitive measures beyond intelligence officers to the criminal and commercial proxies, OOO Impuls, Lumma Stealer operators, Rybar, that the FSB and GRU rely on for deniability, though sourcing rests on the two governments' own designations, corroborated but not independently verified by CyberScoop and AP accounts. Asset freezes and travel bans carry little direct operational effect against services already largely excluded from Western financial systems, so the measures function primarily as a diplomatic signal, reinforced by Germany's and France's ambassador summonses. The rhetoric may be aimed as much at reassuring domestic and allied audiences as at degrading FSB or GRU capability, since named individuals sit outside EU and UK jurisdiction. The package also sets a template EU and UK partners could reuse for coordinated attribution after future infrastructure intrusions.

4 sources

EU, UK sanction Russian cyberespionage networks over destructive attacks - CyberScoop
Cyber/Russia: Statement by the High Representative on behalf of the European Union denouncing Russia's malicious cyber ecosystem - Council of the EU
EU and Britain Target Russian Intelligence Officers Over a Major Cyberspying Campaign - Associated Press (via US News)
UK and EU strike Russian cyber networks with new sanctions - UK Government (GOV.UK)