EU sanctions against Russia over malicious cyber activities

Brussels – European Union sanctions against Russia over cyber threats were announced on behalf of the 27 Member States by the EU High Representative for Foreign Affairs and Security Policy, Kaja Kallas. In a official statement, the former Estonian prime minister, now at the helm of the EU’s diplomatic service, and the member states “condemn Russia’s malicious cyber activities and its exploitation of a cyber ecosystem comprising state and non-state actors, ranging from intelligence services to cybercrime groups, from hacktivists to private companies.” 

In particular, today (13 July), “we are exposing the 16th Centre of the Russian Federal Security Service (FSB), which controls several cyber-threat groups, including TURLA,” wrote Kallas, explaining that “for years, the FSB has carried out a wide range of malicious cyber activities, with growing severity, which have targeted the EU, its Member States, as well as international partners, notably Ukraine.” These activities have included infiltrating government networks and sabotaging critical infrastructure. Among those targeted were: France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland. “In France, the 16th Centre has been conducting cyber espionage against
strategic governmental entities since 2010 and against the defence industry in 2025,” while “in Germany, it has targeted government bodies” and, “recently, in Poland, the 16th Centre has carried out sabotage operations against critical infrastructure, including combined heating and power plants.” For the EU, these are “cybercriminals,
self-proclaimed hacktivists, and private companies linked to Russia, including entities operating under its instructions, direction or control” who “have also carried out, facilitated, and enabled numerous illegal activities.” 

In this context, “we strongly condemn Russia’s behaviour and misuse of this cyber ecosystem, which targets public services and critical infrastructure, causing disruption and financial losses.” Consequently, in response, the EU “is imposing restrictive measures on nine individuals and four entities.” These sanctions “include GRU intelligence officers, as well as cybercriminals,
self-proclaimed hacktivists, and private companies that contribute to Russia’s efforts to destabilise the EU, its Member States, and international partners.” 

In this work, the EU is not alone, but is working “in close cooperation with the United Kingdom.” Brussels and London share the assessment “of the growing convergence between non-state and state actors.” Therefore, “we will continue to strengthen cooperation with international partners, including NATO, in full respect of the agreed guiding principles, in support of a free, open, stable, and secure global cyberspace.”