Adversary Intelligence — 2026-07-15

EU Sanctions Nine Individuals and Four Entities Over Yearslong Russian Cyber-Espionage Campaign

BLUFJoint EU-UK designation of state officers and criminal intermediaries as a single accountability chain establishes a coordination template that raises the cost of Russian cyber operations across both jurisdictions.

The Council of the European Union sanctioned nine individuals and four entities on Monday for a years-long Russian cyber-espionage campaign, imposing asset freezes and travel bans 1. Targets include Bullet Proof Hosting provider Media Land LLC and owner Alexander Volosovik, its sister company ML.Cloud, hacktivist group Z-Pentest and leaders Yuliya Pankratova and Denis Degtyarenko of CARR, GRU Unit 29155 contractor LLC 'Impuls' and owner Evgeniy Bashev, malware developers Maksim Voronin, Maksim Gordienko and Vitaly Kovalev, and GRU Special Operations Service deputy commander Ivan Kasyanenko 1. The EEAS said the action publicly attributes cyber operations against EU states and partners to Russia's FSB 16th Centre and was coordinated for the first time with the United Kingdom's parallel sanctions regime 12. Germany's Foreign Office summoned the Russian ambassador over the attacks, and the Council said operations tied to the targets occurred in at least nine member states including France, Poland and the Netherlands 3.

Analysis
The joint EU-UK designation, sourced primarily from convergent Council and EEAS statements rather than independent corroboration, sets a coordination template Brussels and London can replicate against future Russian cyber operations, raising the cost of using bulletproof-hosting infrastructure like Media Land to shield ransomware and phishing campaigns. Formal attribution to FSB's 16th Centre creates a public record other states can cite, while Berlin's summons opens a bilateral track distinct from the EU's collective process. Treating GRU contractors, hacktivist leaders and malware developers under one sanctions net signals Brussels now views criminal intermediaries and state officers as a single accountability chain. The timing alongside the Paris Coalition of the Willing summit suggests the package also functions as diplomatic signaling ahead of Ukraine security-guarantee talks. Read alongside same-day NSA/CISA/FBI and Dutch AIVD/MIVD disclosures, it maps Center 16's broader operational footprint.

3 sources

Russian cyber-attacks and destabilising activities: Council sanctions nine individuals and four entities - Council of the European Union (Consilium)
Exposing Russia's malicious cyber ecosystem: the EU adopts its biggest cyber sanctions package - European External Action Service (EEAS)
EU sanctions nine people over alleged Russian cyber-spying campaign - Al Jazeera