The European Union on 14 July 2026 issued a statement denouncing Russia's malicious cyber ecosystem and imposing restrictive measures on nine individuals and four entities linked to cyber activities targeting the EU, its member states, and international partners. The statement, issued by the High Representative on behalf of the EU, specifically exposes the 16th Centre of Russia's Federal Security Service (FSB) as controlling cyber threat groups including TURLA, which have conducted cyber espionage, infiltration of governmental networks, and sabotage of critical infrastructure across several EU member states, notably France, Germany, Poland, and others.
The EU's measures target GRU intelligence officers, cybercriminals, self-proclaimed hacktivists, and private companies that contribute to Russia's destabilisation efforts. The EU also welcomed close coordination with the United Kingdom in assessing the growing convergence between non-state and state actors, and pledged to strengthen cooperation with international partners, including NATO, to uphold a free, open, stable, and secure cyberspace. The statement underscores the EU's determination to impose costs on those responsible and calls on all states, including Russia, to adhere to the United Nations framework of responsible state behaviour in cyberspace.
The sanctions and condemnation mark a significant escalation in the EU's response to Russian cyber activities, impacting stakeholders such as EU member states' national security agencies, which will benefit from increased coordination and sanctions enforcement; Russian state and non-state cyber actors, who face asset freezes and travel bans; EU critical infrastructure operators, which may see reduced cyber threats but also increased compliance costs; and international partners like NATO and the UK, which gain strengthened alliances but may face diplomatic tensions with Russia.