The European Union and the United Kingdom sanctioned Russian intelligence officers, hackers and private companies on July 13 over a cyberespionage campaign Brussels says has targeted European governments and critical infrastructure since 2010. The EU imposed asset freezes and travel bans on nine individuals and four entities, while Britain sanctioned 24 people and organizations in what officials described as the first coordinated EU-UK package targeting Russian cyber operations.
Both governments identified the FSB’s 16th Center – Russia’s signals intelligence directorate – as the hub of the campaign rather than an informal network of proxy hackers. According to EU officials, the unit has been linked to cyberattacks against government institutions and critical infrastructure across Europe. French Foreign Minister Jean-Noël Barrot said it was also responsible for the December 2025 cyberattack on Poland’s energy grid, which could have disrupted electricity supplies for up to 500,000 people, as well as operations targeting railway infrastructure. The EU said France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland have all been affected.
The sanctions were announced alongside the Paris summit that launched the 10-nation FREYJA Integrated Anti-Ballistic Missile Coalition, underscoring Europe’s increasingly integrated approach to Russian threats. European governments are treating cyberattacks, sabotage and attacks on civilian infrastructure as part of the same strategic challenge posed by Russia’s military aggression, rather than as separate security issues.
The legal framework is significant as well. By applying the EU’s hybrid sanctions regime to FSB-directed cyber and sabotage operations, Brussels and London have formally attributed activities long conducted through deniable intermediaries to the Russian state itself, reducing Moscow’s ability to portray such attacks as the work of independent criminal or hacktivist groups.
