The European Union and the United Kingdom have jointly sanctioned dozens of Russian individuals and entities, accusing Russia of coordinating a network of hacking groups responsible for cyberattacks across Europe. Here is what cybersecurity professionals need to know.

The Joint Sanctions Package

On July 13, 2026, the Council of the European Union announced sanctions on nine individuals and four entities, while the UK separately sanctioned 24 individuals and entities. This marks the first joint EU-UK cyber sanctions package since Brexit.

EU Sanctions Targets

The EU sanctions include GRU intelligence officers, cybercriminals, self-proclaimed hacktivists, and private companies that contribute to Russia's efforts to destabilize the EU and its member states.

The Council of the EU publicly identified the 16th Centre of Russia's Federal Security Service (FSB) as controlling several cyber threat groups, including the notorious Turla hacking group. Officials said the unit has spent years targeting government networks and critical infrastructure across France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland since 2010.

UK Sanctions Targets

Britain sanctioned:

• Senior GRU figures Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko, who directed cyber and hybrid operations
• Members of the IMPULS company, accused of recruiting hackers from Russian universities
• Individuals tied to the Lumma Stealer malware operation, linked to at least 2,100 domestic UK victims over six months
• Ten people connected to Rybar LLC for spreading anti-Ukraine narratives and alleged election interference in Moldova and Armenia

The Context: Cyberattacks on Critical Infrastructure

The sanctions follow a series of significant cyber incidents attributed to Russian state-backed groups:

Polish Energy Grid Attack

A cyberattack in late December 2025 hit dozens of entities in Poland's power grid, damaging key operational technology (OT) equipment beyond repair. The incident was attributed to the Russian state-backed hacking group Sandworm, which attempted to deploy the destructive DynoWiper data-wiping malware.

More recently, Poland blocked a cyberattack targeting the IT infrastructure of the National Centre for Nuclear Research (NCBJ).

Turla Espionage Campaigns

The FSB's 16th Centre, through Turla, has run cyberespionage campaigns against government and defense targets for over 15 years. Turla hackers were linked to a failed strike targeting Poland's critical infrastructure, including energy grid organizations such as heat and power plants, which could have cut power to roughly 500,000 people during winter.

Notable Threat Groups Named

Group	Associated Unit	Primary Targets
Turla	FSB 16th Centre	Government, defense, critical infrastructure
Sandworm	GRU	Energy grid, OT systems
Various hacktivists	Russian-linked	EU member states, critical infrastructure

What This Means for Security Teams

1. Monitor sanctioned entities , block domains, IPs, and certificates associated with sanctioned individuals and companies
2. Update threat intelligence feeds , the sanctions publicly name groups (Turla, Sandworm) that should be in every organization's threat model
3. Lumma Stealer is active , this info-stealer malware has caused at least 2,100 UK victims; ensure endpoint detection covers Lumma signatures
4. OT/ICS security is critical , the Polish energy grid attack demonstrates that OT infrastructure remains a primary target
5. Hacktivist groups are cover for state actors , the sanctions explicitly link self-proclaimed hacktivists to Russian state direction

Frequently Asked Questions

What is the significance of this joint sanctions package? This is the first joint EU-UK cyber sanctions package since Brexit, signaling unified Western response to Russian cyber aggression.

Which Russian hacking groups are affected? Turla (FSB 16th Centre), Sandworm (GRU), Lumma Stealer operators, and various hacktivist groups linked to Russian state direction.

What is Lumma Stealer? Lumma Stealer is an information-stealing malware that targets credentials, cryptocurrency wallets, and browser data. The UK linked it to at least 2,100 domestic victims.

How can organizations protect against Turla and Sandworm? Implement behavior-based detection, monitor for living-off-the-land techniques, segment OT networks from IT, and apply threat intelligence feeds covering these groups' known TTPs.

What is the 16th Centre of the FSB? It is a unit of Russia's Federal Security Service that controls multiple cyber threat groups, most notably the Turla hacking group, conducting cyberespionage since at least 2010.

Key Takeaways

• The EU and UK jointly sanctioned over 30 Russian individuals and entities in an unprecedented coordinated cyber sanctions package
• The FSB's 16th Centre was publicly named as controlling Turla and other threat groups targeting European critical infrastructure
• Sandworm was linked to the failed DynoWiper attack on Poland's energy grid
• Lumma Stealer malware has caused at least 2,100 victims in the UK alone
• Security teams should update threat intelligence and monitor for the sanctioned groups' activity

The sanctions represent a significant escalation in the West's response to Russian cyber operations. By publicly naming the FSB unit controlling Turla and linking hacktivist groups to state direction, the EU and UK have provided security teams with new intelligence to defend against these persistent threats.

---

Source: BleepingComputer; Council of the European Union; UK Government