France, UK and EU Sanction Russia Over Cyber Campaign

France announced on Monday that it will summon the Russian ambassador and impose sanctions against nine individuals and four entities in response to a widespread Russian cyberattack campaign targeting at least ten European countries. The United Kingdom and the European Union joined France in a coordinated sanctions response, marking one of the most significant collective Western actions against Russian cyber operations.

Coordinated Western Response

French Foreign Minister Jean-Noël Barrot announced the measures on BFMTV/RMC, stating that Paris would summon the Russian ambassador “in the coming days” over a “vast cyber campaign” conducted by Russia for sabotage and espionage purposes. “We are going to publicly condemn a widespread cyber campaign carried out by Russia against at least 10 European countries,” Barrot said, as reported by RTBF.

According to the French Foreign Ministry, the cyber campaign was orchestrated by the 16th Centre of the Russian Federal Security Service (FSB), specifically Unit 61240, which has conducted cyber espionage against French strategic governmental entities since 2010 and targeted the defence industry in February 2025.

UK and EU Sanctions Package

The UK Government announced sanctions against 24 individuals and entities linked to Russian Intelligence Services, including GRU senior leadership figures Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko. UK Foreign Secretary Yvette Cooper said the sanctions “strike at the core of the cybercriminal networks propping up the Russian state’s aggression,” adding that “the UK and EU are sending a clear message that Russia cannot hide behind its use of these proxy groups.”

The UK and EU jointly attributed the December 2025 attack on Poland’s energy grid to Russia’s FSB Centre 16. The coordinated attack targeted approximately 30 distributed energy resource sites, including combined heat and power facilities, wind and solar dispatch systems. The attack failed but could have caused 500,000 citizens to lose electricity in winter.

The EU imposed sanctions on nine individuals and four entities over Russia’s “malicious cyber ecosystem,” including GRU intelligence officers, cybercriminals, and private companies. Germany also joined France in summoning the Russian ambassador to Berlin over the same cyberattacks.

A Decade-Long Campaign

The French Foreign Ministry detailed a pattern of Russian cyber aggression dating back years. The FSB 16th Centre has targeted email accounts belonging to the French Ministry for the Armed Forces since 2017, the network of the French Embassy in Moscow in 2018, and a judicial sector entity’s server in 2019. In February 2025, a French research institute working for the defence industry was targeted, resulting in the exfiltration of a significant amount of sensitive data.

The targeted countries include France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, according to the EU statement. The cyber campaign targeted ministries, businesses, and operators with the goal of either capturing information or sabotaging operations, including railway infrastructure as occurred in Poland.

The UK also revealed that Russia has used stolen credentials from the “Lumma Stealer” malware — an information-stealing program first appearing in 2022 that targets cryptocurrency wallets, browser extensions, and two-factor authentication credentials — to conduct cyber espionage operations globally. According to the National Crime Agency, at least 2,100 Lumma Stealer victims have been identified in the UK within the last six months.

The Actors Behind the Attacks

The coordinated Western response targets a multi-year Russian cyber campaign involving multiple state actors. The FSB 16th Centre, also tracked as TURLA, Secret Blizzard, and Snake, is one of Russia’s most sophisticated and longest-running cyber-espionage operations, active for over a decade. The GRU’s Unit 29155, originally known for physical sabotage and assassination operations including the Salisbury poisonings, has branched into cyber operations, working with cybercriminals including the company IMPULS to recruit hackers from Russian universities.

Broader Hybrid Warfare Context

These cyber operations are part of a broader Russian hybrid warfare strategy that includes information manipulation campaigns, interference in democratic processes, airspace violations, and sabotage of critical infrastructure. The EU adopted a dedicated sanctions regime against Russian hybrid threats in June 2026.

The sanctions announcements coincided with a major summit in Paris where President Emmanuel Macron hosted over 20 leaders of the “Coalition of the Willing” for Ukraine talks, focused on air and missile defence cooperation.

Analysis and Implications

This coordinated response marks the first joint UK-EU cyber sanctions package, demonstrating continued security cooperation between the two post-Brexit. The public attribution of specific attacks, particularly the Poland energy grid incident, provides concrete evidence of Russian targeting of critical civilian infrastructure. The sanctions also expose Russia’s use of criminal proxies, including cybercriminal groups and companies like IMPULS recruited from Russian universities.

The French Foreign Ministry condemned the attacks in the strongest terms, stating that “Russia’s malicious cyber activities are unacceptable and unworthy of a permanent member of the United Nations Security Council.” France specifically noted its determination to respond to cyber threats ahead of the 2027 elections. The technical services of France’s Cyber Crisis Coordination Centre (C4) published a joint report detailing the TURLA intrusion set.

These actions confirm that Russia is intensifying its hybrid operations against Europe as its conventional war in Ukraine continues. The EU adopted a dedicated sanctions regime against Russian hybrid threats in June 2026, and NATO has been developing new strategies to counter hybrid aggression. To date, the UK has sanctioned over 3,400 targets behind Russia’s war effort.

What to Watch For

The coming days will reveal Russia’s response to the ambassador summons and sanctions. Questions remain over whether the United States will join these measures, given reports of a bipartisan Senate deal on new Russia sanctions, and how the EU’s 21st sanctions package, still under negotiation, will complement these cyber-specific measures.