The first joint EU-UK cyber sanctions package targets Russian military intelligence officers and a support company linked to a decade-long sabotage and espionage campaign against European critical infrastructure.
Intelligence Lead
The European Union and United Kingdom on 13 July issued their first joint cyber sanctions package, targeting Russian military intelligence (GRU) officers, a support company, and cybercriminal networks tied to a sabotage and espionage campaign against European critical infrastructure dating to 2010. The action formally attributes a foiled attack on Poland's energy grid — one capable of leaving roughly 500,000 people without power in winter conditions — to Russia's FSB Centre 16, and names GRU Unit 29155 as the operational core of a wider hybrid warfare effort spanning at least a dozen European countries.
Situation Report
The Council of the European Union sanctioned nine individuals and four entities, while the UK separately designated 24 individuals and entities, including senior GRU figures Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko, whom British officials say directed cyber and hybrid operations against European targets. Among the designated entities is Impuls, a Russian company that officials say provided technical and material support to cyberattacks and attempted cyberattacks conducted by GRU Unit 29155.
French officials confirmed the campaign involved sabotage and espionage operations across roughly a dozen European countries, targeting government ministries, service operators, and critical infrastructure, including rail systems in Poland. UK and EU officials jointly attributed a separate attack on Poland's energy grid to Russia's FSB Centre 16, assessing that had it succeeded, it could have cut power to approximately 500,000 Polish citizens during winter conditions.
Background & Context
GRU Unit 29155 has previously been linked by Western intelligence services to sabotage operations, assassination attempts, and destabilization campaigns across Europe, including the 2014 Vrbětice munitions depot explosion in the Czech Republic and an attempted coup in Montenegro. Its re-emergence in this sanctions package, alongside a previously unattributed FSB unit, indicates Russian intelligence services are running parallel, compartmentalized infrastructure-targeting operations rather than a single centralized campaign. The joint EU-UK format is itself notable: this is the first coordinated cyber sanctions package between the two since the UK's departure from the EU, suggesting an institutional response track that outlasts individual national attribution statements.
Analysis & Assessment
The sanctions are assessed with high confidence to represent an escalation in the West's public attribution posture rather than a new phase of Russian operations — the underlying campaign has been running since 2010, and this action largely catches up official response to activity intelligence services have tracked for years.
The joint UK-EU designation format is significant in its own right: it signals an intent to harmonize sanctions regimes and close jurisdictional gaps that have historically allowed sanctioned individuals and shell entities to route operations through less-aligned member states. The attribution of the Poland grid plot to FSB Centre 16, distinct from the GRU's Unit 29155, indicates at least two separate Russian intelligence services are independently targeting European critical infrastructure with overlapping objectives — likely reflecting institutional competition within the Russian intelligence community as much as coordinated strategy. Sanctions of this kind rarely alter operational behavior in the near term; the more consequential effect will be diplomatic, further narrowing the space for normalized EU-Russia relations regardless of how the broader European security picture develops.