EU and UK Sanction Russian GRU Hackers Behind Decade of European Cyberattacks 

The European Union and the United Kingdom jointly sanctioned dozens of Russian intelligence officers and affiliated entities on 13 July 2026, officially naming the FSB unit that directs the Turla hacking group. The EU council blacklisted nine individuals and four entities. The UK separately sanctioned 24 individuals and entities. This is the first time the EU has formally attributed Turla’s operations to the 16th Centre of Russia’s FSB and imposed bloc-wide travel bans and asset freezes. 

I have been tracking Turla for years. This attribution matters because it connects the group responsible for some of the most persistent cyberespionage campaigns against European governments to a named unit within the FSB. The 16th Centre has been running operations since at least 2010, targeting government networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland. The timeline is not speculative. The EU published it. 

The Turla Campaigns That Forced This Response 

France will summon the Russian ambassador over the hacking campaigns. French Foreign Minister Jean-Noel Barrot stated that Turla compromised unclassified email systems at the French Defence Ministry in 2017, breached the French embassy in Moscow in 2018, and stole industrial secrets from a high-tech company in 2025. Turla also hijacked third-party infrastructure, including offensive cyber capabilities linked to Iran, to conceal its operations. 

The most dangerous campaign involved Poland. In December 2025, Sandworm (APT44), the GRU’s dedicated destructive operations unit, attempted to deploy DynoWiper malware against the Polish energy grid. The attack hit dozens of entities and damaged OT equipment beyond repair but failed to disrupt power supply. The same period saw Poland block a cyberattack targeting the National Centre for Nuclear Research. A successful strike could have cut power to 500,000 people during winter. 

Beyond Turla: The Full Scope of Sanctions 

 The UK sanctions covered a broader set of Russian malicious cyber activity. Senior GRU figures Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko were personally named. The UK also sanctioned members of IMPULS, a company accused of recruiting hackers from Russian universities, individuals tied to Lumma Stealer malware (linked to at least 2,100 UK victims over six months), and 10 people connected to Rybar LLC, a group spreading anti-Ukraine narratives and allegedly interfering in elections in Moldova and Armenia. 

The EU sanctions also hit Russian technology companies Advanced System Technology (AST) and NPP Gamma. AST was previously sanctioned by the US in 2021. These entities provided technology and infrastructure support to the hacking campaigns. 

What This Changes 

The EU publishing the FSB’s unit designation and the UK running a parallel sanctions track creates a different operating environment for Russian intelligence. Travel bans restrict officer movements across 27 member states. Asset freezes cut off financial channels. The public attribution forces allied intelligence services to coordinate defensive warnings. 

The AOG assesses that the operational impact will be moderate in the short term. Russian intelligence units operate under the assumption they are named. Alternative financial and travel routes exist. The strategic significance is the political signal: the EU is now treating offensive cyber operations by Russian state actors as a sanctions-level diplomatic issue on par with other aggressive state behavior. 

The European Commission proposed new cybersecurity legislation in January 2026 to strengthen defenses against state-backed threat groups. The sanctions announced today are the enforcement mechanism behind that legislative intent. The attribution is public. The evidence is shared. The next step belongs to network defenders. 

Sources 

Council of the EU: EU Sanctions Russian GRU Officers and FSB 16th Centre Over Cyberattacks, 13 July 2026 

UK FCDO: UK Sanctions 24 Russian Individuals and Entities Over Malicious Cyber Activity, 13 July 2026 

Politico: EU Blacklists Russian Intelligence Officers Over Hacking Campaigns, 13 July 2026 

Politico: France to Summon Russian Ambassador Over Turla Hacking Operations, 13 July 2026