The European Union has accused Russia of using a “malicious cyber ecosystem” of state and non-state actors to target the EU, its member states and international partners, and announced new sanctions on 13 people and entities, the organisation said.
The EU and its member states said Russia was “leveraging” a network that includes intelligence services, cybercriminal groups, “hacktivists” and private companies.
In a statement issued on behalf of the EU, the bloc named the 16th Centre of Russia’s Federal Security Service (FSB) as controlling a range of cyber threat groups, including one known as TURLA.
The EU said the FSB had for years carried out cyber operations of “growing severity” affecting EU countries and international partners, “notably Ukraine”.
Those activities have included infiltrating government networks and sabotaging critical infrastructure — such as services and systems considered essential to a country’s functioning — according to the EU statement.
The EU said countries targeted include France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland.
In France, the EU said the FSB’s 16th Centre has conducted cyber espionage against strategic government entities since 2010 and against the defence industry in 2025.
In Germany, it said the same FSB unit has targeted government entities.
In Poland, the EU said the 16th Centre recently carried out “disruptive sabotage operations” against critical infrastructure, including combined heating and power plants.
### Sanctions announced against individuals and entities
The EU said it was imposing restrictive measures on nine individuals and four entities in response to the alleged malicious cyber activities.
Those sanctioned include GRU intelligence officers, along with cybercriminals, self-proclaimed hacktivists and private companies that the EU said contribute to Russia’s efforts to destabilise the EU, its member states and international partners.
The bloc said it welcomed “close coordination” with the United Kingdom in assessing what it described as growing convergence between state and non-state cyber actors.
The EU said it would continue strengthening co-operation with international partners, including NATO, and reiterated that states should follow the UN framework on responsible behaviour in cyberspace and respect international law.
