EU and UK Sanction Russian Cyber Actors Over Alleged Operations Across Europe
Summary
The EU and UK imposed sanctions on Russian individuals and entities over alleged cyber and hybrid operations, citing GRU and FSB-linked actors, Turla, Sandworm and Lumma Stealer, as well as attacks targeting European critical infrastructure.
Key points
- The EU sanctioned nine individuals and four entities; the UK separately sanctioned 24 individuals and entities, including senior GRU figures.
- UK authorities linked people sanctioned over the Lumma Stealer operation to at least 2,100 victims in the UK over six months.
- The EU identified the FSB’s 16th Centre as controlling several cyber threat groups, including Turla, and said its campaigns targeted government and defense networks.
- Officials linked Turla to a failed recent strike targeting Polish critical infrastructure that could have cut power to roughly 500,000 people.
- Separately, a late-December attack on Poland’s power grid damaged operational technology equipment beyond repair but did not disrupt power; the incident was attributed to Sandworm, which reportedly attempted to deploy DynoWiper.
Article Details
- Event Type
- The European Union and the United Kingdom imposed sanctions on Russian individuals and entities over alleged cyber and hybrid operations.
- Impact
- The EU sanctioned nine individuals and four entities; the UK separately sanctioned 24 individuals and entities. Authorities linked the Lumma Stealer operation to at least 2,100 victims in the UK over six months. A failed attack attributed to Sandworm damaged Polish power-grid operational technology beyond repair but did not disrupt power; officials said it could have affected roughly 500,000 people.
MITRE ATT&CK
Threat Actors
FSB’s 16th CentreThe EU identified the unit as controlling several cyber threat groups, including Turla, and linked it to years of targeting government networks and critical infrastructure.GRUThe article links GRU officers to cyber operations; UK officials said named senior GRU figures directed cyber and hybrid operations.Ivan KasyanenkoUK officials said he directed cyber and hybrid operations; he was included in UK sanctions.Ivan SeninUK officials said he directed cyber and hybrid operations; he was included in UK sanctions.SandwormThe article says the group was later attributed responsibility for a cyberattack on Poland’s power grid and attempted deployment of DynoWiper.TurlaThe article says the group was controlled by the FSB’s 16th Centre and targeted government and critical infrastructure. Turla hackers were also linked to a failed attack on Poland’s critical infrastructure.Vyacheslav StafeyevUK officials said he directed cyber and hybrid operations; he was included in UK sanctions.
Malware
DYNOWIPERThe incident was later attributed to the Russian state-backed hacking group Sandworm, which attempted to deploy the destructive DynoWiper data-wiping malware and disable compromised devices.Lumma StealerOfficials linked the measures to GRU officers, the FSB’s 16th Centre, Turla, Sandworm, Lumma Stealer, and attacks on critical infrastructure in countries including Poland, France, Germany, and Finland.
Countries
Austriagovernment networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government and defense targetsCyprushas spent years targeting government networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns againstFinlandOfficials linked the measures to GRU officers, the FSB’s 16th Centre, Turla, Sandworm, Lumma Stealer, and attacks on critical infrastructure in countries including Poland, France, Germany, and Finland.FranceOfficials linked the measures to GRU officers, the FSB’s 16th Centre, Turla, Sandworm, Lumma Stealer, and attacks on critical infrastructure in countries including Poland, France, Germany, and Finland.GermanyOfficials linked the measures to GRU officers, the FSB’s 16th Centre, Turla, Sandworm, Lumma Stealer, and attacks on critical infrastructure in countries including Poland, France, Germany, and Finland.PolandOfficials linked the measures to GRU officers, the FSB’s 16th Centre, Turla, Sandworm, Lumma Stealer, and attacks on critical infrastructure in countries including Poland, France, Germany, and Finland.Romaniaand critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government and defense targets since 2010.RussiaThe European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities and accused Russia of coordinating a network of hacking groups responsible for attacks across Europe.Slovakianetworks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government and defense targets sincethe Netherlandsyears targeting government networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government andUnited KingdomThe UK separately sanctioned 24 individuals and entities, including senior GRU figures.
Industries
DefenseAustria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government and defense targets since 2010.Energyhackers were also linked to a recent failed strike targeting Poland’s critical infrastructure, including energy grid organizations such as heat and power plants, which could have cut power to roughly 500,000 peopleGovernmentOfficials said the unit has spent years targeting government networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionageNuclear researchPoland also blocked a cyberattack targeting the IT infrastructure of the National Centre for Nuclear Research (NCBJ), the country’s main government nuclear research institute specializing in nuclear physics,