EU and UK Impose Parallel Sanctions Over Russian Cyber Campaign

The European Union and the United Kingdom announced parallel sanctions on July 13, 2026, against Russian intelligence-linked officers, hackers and companies accused of supporting cyberespionage, sabotage and wider hybrid operations across Europe.

The action marked the first time the EU and UK imposed cyber sanctions simultaneously under their respective regimes. The measures were not imposed by NATO, but they add to the alliance’s broader work with European governments and other partners on cyber defense and critical-infrastructure resilience.

Separate EU and UK sanctions packages

The EU sanctioned nine individuals and four entities under its cyber and destabilizing-activity regimes. The Council of the EU said the targets included people and organizations connected to malware, hacktivist campaigns, Russian military intelligence and technical support for attacks against critical infrastructure.

The United Kingdom announced a separate package covering 24 individuals and entities. British officials included Russian intelligence figures, cybercriminal proxies, people linked to the Lumma Stealer malware and individuals associated with Rybar, which Britain accused of helping spread deceptive narratives and interfere in European elections.

The two packages overlap in some places but should not be treated as one list. The EU and UK imposed their own designations and described different parts of the alleged Russian cyber ecosystem.

What officials attributed to Russia

EU and French officials identified Russia’s Federal Security Service, or FSB, Centre 16 as a central actor in cyber operations targeting European governments and strategic organizations. France said the unit used the intrusion set known as TURLA in campaigns against French government, defense-related and judicial networks.

EU officials said activity connected to the broader ecosystem reached France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland, among other countries. The cases involved different types of activity, including cyberespionage, disruptive attacks, hacktivist operations and support from criminal or proxy networks. Officials have not said that every country experienced the same type of incident.

Why Poland’s energy grid is central

Britain and EU partners also attributed a failed December 2025 attack on Poland’s energy grid to FSB Centre 16. British officials said the operation did not succeed but could have caused electricity losses affecting about 500,000 people during winter.

That distinction matters. The official statements describe a failed attack and a potential consequence, not a completed blackout. The case nevertheless illustrates why European governments are treating cyber operations against energy, water, heating and communications systems as security issues rather than isolated computer crimes.

What organizations are being urged to do

A parallel advisory from the United Kingdom’s National Cyber Security Centre and agencies from 12 countries warned that Russian intelligence actors have searched for poorly configured routers and other exposed network devices. The advisory urged organizations in communications, defense, energy, finance, government and health care to strengthen passwords, restrict administrative access, disable legacy network-management protocols and use stronger protections such as SNMPv3.

For NATO members, the immediate change is a more coordinated enforcement and defense posture. Sanctions are intended to raise financial and travel costs for named targets, while public attribution helps governments warn operators and coordinate responses. Neither measure guarantees that future attacks will be prevented, and Russia has not accepted the accusations. The next test will be whether allied governments can turn shared warnings into better protection for the civilian systems on which daily life depends.

Sources

• Council of the European Union sanctions announcement
• UK government sanctions announcement
• UK National Cyber Security Centre advisory
• Associated Press report