TL;DR
The EU and UK have issued their first joint cyber sanctions package against Russia, with the EU listing nine individuals and four entities and the UK listing 24. The EU publicly attributed the Turla espionage group to FSB Centre 16, and both attributed December’s attack on Poland’s energy grid, which could have cut power to 500,000 people in winter, to the same unit. The framing is the news: Brussels is targeting an entire “ecosystem” of spies, criminals, hacktivists, and front companies rather than individual hacking groups.
The European Union and the United Kingdom have jointly sanctioned Russia’s cyber apparatus for the first time. The EU listed nine individuals and four entities, while the UK went further with 24, Politico reports.
The language is what matters here. The EU’s High Representative Kaja Kallas denounced not a group but an ecosystem, spanning intelligence services, criminal gangs, self-declared hacktivists, and private companies.
That is a deliberate shift. Europe has decided the distinction between Russian state hackers and Russian criminals is a fiction worth abandoning.
Naming Turla’s owner
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
The Council statement publicly attributes the long-running Turla group to Centre 16 of Russia’s Federal Security Service. Turla, also tracked as Secret Blizzard and Waterbug, is among the most persistent espionage operations in the world.
Its European campaign is dated back to 2010, beginning with French government networks. Since then it has been linked to intrusions in Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland.
Attributing a group to a specific FSB directorate is not a small step. It converts a threat-intelligence label into a formal accusation against a named arm of the Russian state.
The Poland attack
The sharpest allegation concerns the grid. The UK and EU member states have attributed December’s attack on Poland’s energy network to FSB Centre 16.
The attack failed, but the stated intent is chilling. It could have cut electricity to 500,000 people in the depths of winter.
Poland has been the testing ground for a while. Hackers previously breached Polish water treatment plants, reaching the control systems for pumps and chemical dosing.
The recruitment pipeline
The most novel target is a company. The UK sanctioned OOO IMPULS, alleging the GRU’s Unit 29155 used it to recruit hackers and cyber specialists from universities and academies across Russia.
That is the ecosystem made concrete. A front firm, staffed from the higher education system, feeding talent into a military intelligence unit.
Three GRU leadership figures were named for directing these operations, Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko. Sanctioning the managers rather than only the operators is the point.
Criminals as instruments of the state
The package also reaches ordinary cybercrime. The UK sanctioned people behind Lumma Stealer, an infostealer, and says Russia used credentials it harvested for espionage.
The scale is domestic and unglamorous. The National Crime Agency counts at least 2,100 Lumma Stealer victims in the UK in six months alone.
Britain also listed ten people at Rybar LLC, a state-resourced media outfit accused of spreading false narratives about Ukraine and meddling in elections in Moldova and Armenia. Disinformation and intrusion are being treated as one campaign, not two.
Europe has seen the proxy model before, having seized 800 servers tied to Russian-linked hackers in a Dutch operation. Sanctions are now chasing the same plumbing.
Does any of this work
Scepticism is warranted. Asset freezes and travel bans mean little to GRU officers who were never planning a holiday in Brussels, and Russia routinely denies all such allegations.
The value is elsewhere. Public attribution raises the cost of the criminal side of the ecosystem, where people do hold assets, do travel, and do want to get paid.
The pressure is real because the damage is. Russian hackers were blamed for the Jaguar Land Rover breach that cost the UK economy $2.5bn, which is a serious number for an attack on a carmaker.
And European institutions remain exposed, from a cyberattack on the EU Parliament to a broader wave of attacks on European governments. Naming your attacker is not the same as stopping them.
Germany and France are summoning Russia’s ambassadors. That, and a longer sanctions list, is what Europe has to work with.
