Britain, EU impose first joint cyber sanctions on Russian networks

Britain on Monday imposed sanctions on 24 individuals and entities linked to Russian cyber and hybrid operations, in the first joint UK-EU cyber sanctions package. The move named senior GRU figures Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko, and extended beyond intelligence officers to cybercriminals and proxy networks that British officials say help Moscow sow disorder across Europe.

The most striking allegation centered on Poland. Britain and the European Union attributed an attack on the country’s energy grid to Russia’s FSB Centre 16, and London said the strike could have left 500,000 people without electricity in the depths of winter. British officials also said GRU Unit 29155 had worked with cybercriminals, including a company called IMPULS, to recruit hackers and cyber specialists from universities and academies across Russia. London further sanctioned people behind Lumma Stealer malware, which it said allowed cybercriminals to harvest sensitive information from compromised devices at scale.

The European Union imposed restrictive measures on nine individuals and four entities, and described Russia’s cyber ecosystem as a mix of intelligence services, cybercriminals, hacktivists and private companies. Brussels said the FSB’s 16th Centre had targeted France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. It said cyber espionage against French government entities dated back to 2010, while attacks on the French defense industry continued in 2025.

The package highlighted the enforcement problem at the heart of Europe’s cyber response. Sanctions can freeze assets, restrict travel and publicly identify operators, but they do not by themselves dismantle the infrastructure that launches intrusions, disinformation or sabotage. British and EU officials framed the action as more than symbolic because it tied cybercriminals directly to military and intelligence structures, raising the political cost of operating through cutouts and front companies.

Russia’s embassy in London rejected the sanctions as unlawful and accused Britain of relying on unsubstantiated claims about cyberattacks, disinformation and interference in political processes. The backlash underscored the same contest the measures seek to answer: Western governments are now treating cyber activity not as isolated nuisance behavior, but as a strategic campaign against infrastructure, elections and public confidence.