EU imposes sanctions on Russian actors over cyberattacks and sabotage

Note: The German original of that clause reads: „die Verantwortlichen für weltweite Sabotage- und Spionagekampagnen zur Rechenschaft zu ziehen, die teils bis 2010 zurückreichen." The source contains a redundant/garbled fragment; preserving it verbatim:

„die Verantwortlichen für weltweite Sabotage- und Spionagekampagnen zur Rechenschaft zu ziehen, die teils bis 2010 zurückreichen."

The new measures include entry bans and the freezing of assets. "Die neuen Maßnahmen umfassen Einreiseverbote und das Einfrieren von Vermögenswerten." The legal basis is the EU cyber sanctions regime, first used in 2020 against officers of Russia's military intelligence service GRU — in response to NotPetya and the cyberattack on the Bundestag.

Scale of the attacks in Europe

According to the EU, the affected countries are Germany, France, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. "Zu den betroffenen Staaten zählen Deutschland, Frankreich, Polen, Zypern, die Niederlande, Österreich, die Slowakei, Rumänien und Finnland." "Hierzulande richteten sich die Angriffe vor allem gegen staatliche Einrichtungen," the German government said with regard to Germany. The Foreign Ministry did not name specific examples and pointed out that the attribution is based on intelligence findings.

In Poland, the FSB unit is said to have carried out sabotage operations against combined heat and power plants and rail networks. According to this, the operations targeted critical infrastructure such as cogeneration facilities. In France, the Turla group infiltrated the French embassy in Moscow as early as 2018 and compromised unclassified email systems of the Ministry of Defense in 2017; in 2025 it conducted industrial espionage against a high-tech company.

France's Foreign Minister Jean-Noël Barrot announced that the Russian ambassador would be summoned. "Frankreichs Außenminister Jean-Noël Barrot kündigte an, den russischen Botschafter einzubestellen." The Foreign Ministry in Berlin also summoned the Russian ambassador. The ministry stated on the platform X that cyberattacks against Germany, EU partners and Ukraine are unacceptable.

Affected companies and private actors

On the sanctions list, alongside FSB officers, are the Russian technology companies Advanced System Technology (AST) and NPP Gamma. "So dürfen Advanced System Technology (AST) und NPP Gamma künftig keine Geschäfte mehr in EU-Eigentum tätigen." "AST war bereits 2021 von den USA sanktioniert worden." In addition, cybercriminals, hackers and private firms that support Russia's efforts at destabilization are being targeted.

The EU announced that it intends to expand international cooperation, "plant die EU die internationale Zusammenarbeit auszubauen – vor allem mit der NATO". At the same time, it calls on all states, including Russia, to comply with the UN framework for responsible state behavior in cyberspace and to respect international law.

Coordination with the United Kingdom and NATO

The United Kingdom imposed parallel sanctions against 24 individuals and organizations linked to Russian intelligence services. "die EU verweist auf die enge Abstimmung mit Großbritannien, das parallel ebenfalls Sanktionen gegen 24 mit russischen Geheimdiensten verbundene Personen und Organisationen verhängte." Previously, the sanctions list had already been expanded, among other things, because of attacks on Estonia as well as Russian sabotage and disinformation campaigns.

To cover their tracks, the attackers are said to have used infrastructure in third states such as Iran. "Zur Verschleierung sollen die Angreifer Infrastruktur in Drittstaaten wie dem Iran genutzt haben." The EU speaks in this context of a "cyber ecosystem" of state and non-state actors that the FSB uses for its operations.

Overall, the EU paints the picture of a coordinated, years-long campaign. The FSB is accused of carrying out malicious cyberattacks for years, "Ziele seien die EU, ihre Mitgliedstaaten sowie internationale Partner, insbesondere die Ukraine." With the new sanctions, the EU says it wants to send a clear signal, without the diplomatic channels to Moscow — including the summoning of ambassadors — being closed.