EU and UK sanction Russian intelligence officers and companies over decade-long cyber campaign

The European Union and the United Kingdom imposed coordinated sanctions on Monday against Russian military intelligence officers, hackers and private companies, formally accusing Moscow of a years-long cyberespionage campaign designed to undermine governments and sabotage critical infrastructure across Europe. The EU measures hit nine individuals and four entities linked to the 16th Center of the Federal Security Service (FSB), while Britain went further, targeting 24 people and entities connected to the GRU's Unit 29155 and its front company, Impuls.

Two sanctions regimes, one target

The dual announcements represent the most concerted European response to date against Russian state-sponsored cyber operations. The EU's listing, adopted by the Council on 13 July, focuses on the FSB's 16th Center, which Kaja Kallas, the bloc's high representative for foreign affairs, said has been "controlling a variety of cyberthreat groups" and conducting "a wide range of malicious cyberactivities with growing severity" since 2010. The British package, unveiled in parallel by the Foreign, Commonwealth and Development Office, names three senior GRU officers alongside Yevgeny Bashev and details how Impuls recruits cyber specialists from Russian universities and academies to support Unit 29155's operations.

Both regimes rely primarily on asset freezes and travel bans. The EU's legal act identifies the 16th Center itself as an entity, a step that goes beyond naming individual officers and signals an institutional designation. Britain's statement goes further in operational detail, asserting that Russian intelligence agencies "have tasked cybercriminals to collect intelligence to support Russia's military and foreign policy objectives, threatening security across Europe".

The anatomy of Impuls and Unit 29155

Yevgeny Bashev sits at the intersection of the two sanctions lists. The EU sanctions notification describes him as a member of the GRU who runs Impuls, a company that "provides technical and material support to cyberattacks and attempted cyberattacks conducted by GRU Unit 29155." The notification adds that Impuls's actions "constitute an external threat" to EU member countries and have had "a significant effect" on an unnamed country outside the bloc. Britain's designation is more explicit: it says Impuls "recruited hackers and cyber specialists from Russian universities and academies" and that Bashev and three other senior GRU officials directed "GRU cyber and hybrid threat operations."

Unit 29155 is not new to Western intelligence. The sub-unit of the GRU has been linked by multiple governments to the 2018 Salisbury nerve-agent attack, the 2014 ammunition depot explosion in the Czech Republic, and a string of cyber intrusions against political organisations and anti-doping agencies. Monday's sanctions mark the first time the EU has publicly tied the 16th Center of the FSB, a separate service from the GRU, to a sustained campaign against European critical infrastructure, suggesting a division of labour between Russia's intelligence agencies that European security services have long suspected.

Critical infrastructure in the crosshairs

The list of affected countries reads like a roll-call of the EU's eastern and northern flank: France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland, "among others," according to Kallas. The targets have included heating and power plants, railway signalling systems and government networks. In April, Sweden's security service attributed a 2025 cyberattack on a district heating plant to a pro-Russian group with links to the FSB and GRU. That disclosure followed public warnings from Poland, Norway, Denmark and Latvia that Russian actors were actively probing and compromising industrial control systems across the region.

Jean-Noël Barrot, France's foreign minister, told BFM television that the aim of the cyber activities is "either to capture information, or sabotage the operation, for example, of railway infrastructures, as it was the case in Poland." He confirmed Paris intends to summon Russia's ambassador in the coming days. Germany moved first, calling in the Russian envoy on Monday morning. The Dutch foreign ministry issued a separate statement noting that the Netherlands had been targeted "repeatedly" and that the sanctions were "a necessary and proportionate response."

A decade of escalation

The EU's decision to anchor the sanctions in activity dating back to 2010 reflects a deliberate legal strategy. By establishing a continuous pattern, the Council avoids the need to attribute each individual intrusion to a specific actor in real time, a forensic burden that has hampered previous responses. The 16th Center's role, as described in the legal act, is one of coordination: it "controls a variety of cyberthreat groups" and directs them against a shifting target set that has expanded from government ministries to energy grids and transport networks.

This evolution mirrors what Western intelligence agencies have documented privately for years. A 2023 joint advisory from the UK's National Cyber Security Centre, the US Cybersecurity and Infrastructure Security Agency and the NSA described a "multi-year campaign" by Russian state actors against critical infrastructure worldwide, noting that the FSB and GRU often operated in parallel, sometimes against the same targets. Monday's sanctions make that assessment public and legally actionable under the EU's cyber sanctions framework, which was adopted in 2019 and first used in 2020 against Russian, Chinese and North Korean actors.

Diplomatic fallout and the limits of sanctions

Russia's foreign ministry has not yet issued a formal response, but previous EU cyber designations have been met with reciprocal listings of European officials and denials of state involvement. The practical effect of asset freezes on intelligence officers who hold no declared assets in Europe is negligible; the travel bans are similarly symbolic, given that GRU and FSB officers rarely travel to the West under their true identities. The value lies in the signal to third countries and private sector partners: entities that do business with Impuls or provide infrastructure to the 16th Center now face clear legal exposure.

There is also a NATO dimension. The alliance's 2023 Vilnius summit communiqué declared that a cyber attack could trigger Article 5, and the 2024 Washington summit established a new Cyber Defence Centre of Excellence in Tallinn. Monday's sanctions feed into that architecture by creating a shared evidence base that allies can reference in future collective statements. The UK's participation, no longer an EU member but aligned on the designation, demonstrates that the post-Brexit security partnership functions on hard intelligence issues.

What comes next

The immediate test is whether the designations alter Russian behaviour. Past experience suggests they will not stop the operations, but they may force a rotation of infrastructure and personas, a cost in operational security that accumulates over time. The EU's legal act includes a review clause: the Council will reassess the listings in twelve months, with the option to add subordinate units of the 16th Center or additional front companies identified by member states' intelligence services. Britain has signalled it will update its own list on a rolling basis. The next concrete milestone is the EU-UK security dialogue scheduled for October 2026 in Brussels, where both sides are expected to present a joint threat assessment covering the second half of the year. If the pattern holds, that assessment will name new infrastructure, and the sanctions lists will grow accordingly.