EU and UK sanction Russian FSB cyber unit for sabotage across Europe; Poland power grid targeted, Romania affected
The EU and UK on July 13 sanctioned individuals and entities linked to Russia’s FSB Center 16, which controls the Turla hacking group, after cyber attacks that targeted Poland’s power grid, French government systems and other European states including Romania. NATO warned of a response, and Germany summoned Moscow’s ambassador.
Who is behind the attacks
The cyber campaign is run by Unit 16 of the Russian Federal Security Service (FSB), which directs the Advanced Persistent Threat group known as Turla. The European Council states that FSB Center 16 has controlled a range of cyber-threat actors for years, deploying an ecosystem that includes state intelligence, criminal groups, hacktivists and private companies. The Turla group has been active since at least 2004 and is described by Romanian authorities as being among the most sophisticated globally, specializing in long-term compromise of governments, diplomacy, militaries, education, research and pharmaceutical targets.
Scale of the campaign
According to the EU, Unit 16 has been conducting cyber espionage against French strategic government entities since 2010 and targeted the French defence industry in 2025. In Germany, government bodies were hit. The most disruptive attempt came in Poland, where the unit staged a sabotage operation against critical infrastructure, including combined heat and power plants. The UK said the attack failed but could have left 500,000 people without electricity in midwinter. Romania, Cyprus, the Netherlands, Austria, Slovakia and Finland were also among the affected EU states. Romania’s Foreign Ministry confirmed that the Noname platform was used in several cyber attacks against Romanian public-institution websites, prompting Bucharest to propose its own EU sanctions for the first time under the bloc’s cyber sanctions regime.
- FSB Center 16 launches cyber espionage against French government entities
- Espionage expands to the French defence industry
- Sabotage attempt on Polish critical infrastructure fails; 500,000 at risk of losing electricity
- EU and UK sanction 13 entities and 24 individuals; Germany summons Russian ambassador; NATO warns of response; Romania proposes Noname platform sanctions
Coordinated international response
The EU imposed restrictive measures on nine individuals and four entities, while the United Kingdom sanctioned 24 persons and entities linked to Russian intelligence. Both actions were publicly coordinated. Germany summoned the Russian ambassador in Berlin to denounce the campaign, describing it as a campaign of malicious cyber activities attributed to Moscow and led by the Turla actor. EU foreign policy chief Kaja Kallas said the Council firmly condemned Russia’s behaviour and its exploitation of a hostile cyber ecosystem. UK foreign secretary Yvette Cooper added that the Russian state was plumbing new depths of depravity in its attempts to undermine European security.
We firmly condemn Russia’s behaviour.
Whether it is directing criminals against companies or hitting the Polish energy grid in the middle of winter, the Russian state is plumbing new depths of depravity in its attempts to undermine European security.
NATO’s warning
NATO issued a statement on July 13 condemning the persistent malicious cyber activities and calling for Russia to cease the destabilising actions, which it said violated agreed international norms for responsible state behaviour in cyberspace. The alliance stressed it had strengthened its cyber posture, integrating cyber effects into its operations, missions and activities. It warned that it was prepared to use the full range of capabilities to deter, defend and counter cyber threats, and would respond at a time and in a manner of its choosing, consistent with international law. NATO also reaffirmed its unity and solidarity with affected allies and its continued support for Ukraine.
We are prepared to use the full range of capabilities to deter, defend and counter the full spectrum of cyber threats. We are prepared to respond to these threats at the time and in the manner we will choose, in accordance with international law.
Romania’s role
President Nicusor Dan posted that Romania firmly condemned the hostile cyber activities conducted by FSB-controlled groups, which had targeted EU member states, NATO allies and partners, including Romania. He called the attacks part of a broader hybrid campaign designed to undermine democratic stability, fuel societal divisions between allies and test the cohesion of the EU and NATO. At the Foreign Affairs Council in Brussels, foreign minister Oana Țoiu presented a proposal, already legally vetted at EU level, to sanction the Noname platform. It is the first time Romania has initiated a listing under the EU cyber sanctions mechanism, and EU member states will now examine the proposal before any restrictive measures are adopted.
Such attacks, targeting public institutions, critical infrastructure and sensitive information, are unacceptable. They are part of a broader hybrid campaign aimed at undermining the stability of our democracies, fuelling divisions in society and between allies, and testing the cohesion of the European Union and NATO.
