Loading story…
The United Kingdom has imposed new sanctions on several Russian and Chinese organizations and individuals accused of conducting cyberattacks and influence operations aimed at undermining Western democracies. Foreign Secretary Yvette Cooper announced these measures, which target Russian influence networks such as the Telegram channel Ryber, Pravfond, and the Centre for Geopolitical Expertise, as well as Chinese technology companies i-Soon and Integrity Technology Group. The sanctions are part of a broader effort to counter hybrid security threats, including disinformation campaigns and cyber operations, with the UK calling for enhanced multilateral cooperation across Europe to address these evolving challenges.
In a related address, Cooper emphasized the growing sophistication and democratization of tools used by hostile foreign states, particularly Russia, to conduct information warfare and hybrid attacks targeting critical infrastructure and democratic institutions. She highlighted recent examples of Russian disinformation campaigns, such as the Doppelgänger operation and attempts to undermine political stability in Moldova and Africa through fake news and deepfakes. The UK government is urging European partners to strengthen collaboration and resilience against these persistent and complex threats to national and regional security.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The British government imposed new sanctions on multiple Russian and Chinese organizations and individuals accused of cyberattacks and information warfare against the West, including Ryber, Mikhail Zvinchuk, Pravfond, the Centre for Geopolitical Expertise, i-Soon, and Integrity Technology Group. The measures freeze assets and restrict access to the UK financial system as part of a wider effort to counter hybrid threats to European security and democracy.
UK Foreign Secretary Yvette Cooper urged closer collaboration with European partners to counter escalating information warfare and hybrid attacks targeting critical infrastructure and democratic institutions. Her remarks highlighted Russia's role in campaigns such as Doppelgänger and warned that AI-enabled disinformation is lowering the barrier for influence operations.
The UK recently imposed additional sanctions on Russia's GRU after evidence linked it directly to the 2018 Salisbury nerve agent poisonings. The move was cited as part of a broader response to hostile Russian hybrid activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB **Centre 16**. Officials said the failed operation could have cut electricity to as many as **500,000 people** during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s **16th Centre** as controlling several threat groups, including **Turla**, and cited a failed attack on Poland’s critical infrastructure. The sanctions cover **24 individuals and entities**, including GRU leaders **Vyacheslav Stafeyev**, **Ivan Senin**, and **Ivan Kasyanenko**, as well as **IMPULS**, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to **Lumma Stealer**, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least **2,100 UK victims** in six months, and **10 people linked to Rybar LLC**, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Jul 15, 2026
European Commission President Ursula von der Leyen publicly warned that Russia is conducting a coordinated hybrid warfare campaign against Europe, combining cyberattacks, sabotage, and disinformation to destabilize the European Union and weaken its support for Ukraine. In a speech before the European Parliament in Strasbourg, von der Leyen cited a surge in security incidents attributed to Russian state-backed actors, including the violation of Estonian airspace by Russian MiG jets and the appearance of drones over critical infrastructure in Belgium, Poland, Romania, Denmark, and Germany. The United Kingdom, though not an EU member, also reported drone incidents near civilian and military sites, prompting the deployment of a counter-drone unit to Denmark during major European summits. Von der Leyen highlighted that these incidents are not isolated but part of a deliberate and escalating campaign designed to test the EU’s resolve and unity. She referenced specific examples such as undersea cable cuts, cyberattacks that paralyzed airports and logistics hubs, and malign influence campaigns targeting European elections. The European Commission president emphasized that these actions are calculated to remain in a "grey zone" of deniability, making attribution and response more complex. She called for urgent action, urging EU leaders to develop a strategic plan in close coordination with NATO to counter these threats. The blueprint for a pan-European security response was presented to EU leaders at a recent summit in Copenhagen. Von der Leyen stressed the need for greater vigilance, technological readiness, and unity among EU member states to deter further aggression and protect European sovereignty. The campaign is seen as a direct attempt to divide the EU and undermine its support for Ukraine amid ongoing conflict. The speech marked a significant escalation in the EU’s public stance on Russian hybrid threats, moving from isolated incident response to recognizing a systematic and strategic campaign. The European Commission’s warning comes amid increasing evidence of Russia’s use of both physical and cyber means to disrupt European stability. The call to action includes enhancing countermeasures against cyberattacks, protecting critical infrastructure, and strengthening information resilience against disinformation campaigns. The EU’s response is expected to involve both defensive and offensive cyber capabilities, as well as closer intelligence sharing with NATO allies. Von der Leyen’s remarks underscore the seriousness with which European leadership now views the hybrid threat landscape, and the necessity for a unified and robust response.
Jun 29, 2026
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to **Conti**, **TrickBot**, **Wizard Spider**, **LockBit**, **EvilCorp**, **BlackBasta**, the **Lumma** infostealer, and the pro-Russian **Cyber Army of Russia Reborn**. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of **GRU Unit 29155**. The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to **Unit 29155**, while the EU action also cites links to the **WhisperGate** campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Jul 20, 2026