EU and UK Hit Russian Spy Hackers With Joint Sanctions

Key points

• The European Union sanctioned nine individuals and four entities linked to Russian cyberattacks.
• The United Kingdom separately sanctioned 24 people and entities, including three senior officers of Russia's GRU military intelligence agency.
• UK authorities linked the Lumma Stealer password-stealing malware to at least 2,100 British victims over six months.
• The EU publicly named Russia's FSB 16th Centre as the unit running the Turla hacking group, which has targeted European governments since 2010.
• A recent Turla operation against Polish energy firms could have cut electricity to roughly 500,000 people in winter, officials said.

Brussels and London have moved in lockstep to sanction dozens of Russians accused of running state hackers and criminal proxies against Europe. The Council of the EU named nine individuals and four entities. Britain went further, listing 24 in total.

UK officials named three senior GRU figures, Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko, as directors of cyber and "hybrid" operations, meaning combined hacking, sabotage and influence campaigns. FSB Centre 16 has come up before: our July story on router hijacking at hospitals and banks was the first time we reported that unit by name, drawing on a nine-country joint advisory.

Who exactly is being punished?

Several distinct groups are in the frame.

Senior GRU officers stand at the top. Below them sits IMPULS, a Russian firm that UK authorities say recruits hackers from university campuses. Then there are individuals tied to Lumma Stealer, malware that lifts passwords and banking credentials from infected machines; British investigators linked it to at least 2,100 domestic victims across six months. Finally, ten people connected to Rybar LLC face designation for spreading anti-Ukraine content and alleged election interference in Moldova and Armenia.

For anyone running a business in the UK, Lumma Stealer is the most immediate concern here. Two thousand victims in six months is not a background noise number.

What does the FSB have to do with it?

The EU took the unusual step of publicly attributing the 16th Centre of Russia's Federal Security Service, the FSB, as the controlling unit behind several known hacking crews, Turla chief among them.

Turla's been picking locks on government and defence networks since 2010. Targets span France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. We've tracked the group's recent activity closely: in late June we covered a previously undocumented Windows implant Turla used against Ukrainian military and Italian diplomatic targets.

Should ordinary people be worried?

Poland's power grid is the sharpest example of what's at stake.

Turla hackers were tied to a failed strike on Polish energy companies, including heat and power plants. Officials said success could have left roughly 500,000 people without electricity mid-winter. A separate attack in late December 2024, attributed to another Kremlin-linked group called Sandworm, physically destroyed operational technology equipment at Polish grid operators using data-wiping malware called DynoWiper. Wiper malware does what it sounds like: it erases the software keeping industrial systems alive, and you can't just reboot your way out.

Poland also recently blocked an attempted intrusion at the National Centre for Nuclear Research, the country's main nuclear physics institute.

What happens next?

Sanctions freeze assets and ban travel. They don't stop anyone from typing.

But naming a specific FSB unit and specific officers publicly tells Russian intelligence that their cover is thinner than believed. These designations land as Brussels finalises a broader cybersecurity law, proposed in January 2025, aimed at hospitals, energy companies and other essential services. In March 2025 the EU sanctioned three Chinese and Iranian companies over comparable attacks on member states.

For anyone caught up in the Lumma Stealer fallout: change passwords, enable two-factor authentication and watch your bank statements. Unglamorous advice, but it's what actually helps.