Loading story…
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB Centre 16. Officials said the failed operation could have cut electricity to as many as 500,000 people during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s 16th Centre as controlling several threat groups, including Turla, and cited a failed attack on Poland’s critical infrastructure.
The sanctions cover 24 individuals and entities, including GRU leaders Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko, as well as IMPULS, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to Lumma Stealer, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least 2,100 UK victims in six months, and 10 people linked to Rybar LLC, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The UK NCSC and international partners released a joint advisory warning that sectors including energy, communications, defense, finance, government, and healthcare face elevated risk from FSB Centre 16 activity. The advisory described the actor's abuse of weak SNMP configurations and Cisco Smart Install and recommended disabling SNMPv1/v2, moving to SNMPv3 with authPriv, and disabling Cisco Smart Install.
As part of the sanctions action, the EU publicly identified the FSB's 16th Centre as controlling several threat groups, including Turla. Officials linked these Russian-linked actors to cyberespionage and sabotage activity across Europe.
The UK and EU announced a coordinated sanctions package targeting Russian state actors, proxy cybercriminals, and disinformation operators. Those sanctioned included GRU officers, IMPULS, actors tied to Lumma Stealer, and individuals linked to Rybar LLC.
A cyberattack targeting Poland's energy grid was blocked in December. UK and EU officials later said the failed operation could have left up to 500,000 people without electricity in winter.
France announced additional sanctions, published a technical report on Center 16's operations, and said it would summon the Russian ambassador. French officials said the move responded to persistent cyber espionage and sabotage activity.
The United Kingdom and European Union publicly attributed the attempted cyber sabotage against Poland's energy sector to Russia's FSB Centre 16. The attribution also tied the actor to broader targeting of government networks and critical infrastructure across Europe.
A 29 December 2025 cyberattack in Poland was reported to have used previously unseen OT-focused data-wiping malware against more than 30 wind and solar farms, a combined heat and power plant, and a manufacturing company. The attack did not disrupt electricity or heat supply.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
occrp.org
Open sourcecyberveille.ch
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourceconsilium.europa.eu
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to **Conti**, **TrickBot**, **Wizard Spider**, **LockBit**, **EvilCorp**, **BlackBasta**, the **Lumma** infostealer, and the pro-Russian **Cyber Army of Russia Reborn**. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of **GRU Unit 29155**. The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to **Unit 29155**, while the EU action also cites links to the **WhisperGate** campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Jul 20, 2026
The UK, France, the EU, and partner cyber agencies publicly attributed a broad cyber-espionage campaign to **FSB Centre 16**, linking the Russian intelligence unit to both the long-running **Turla** intrusion set and active exploitation of internet-facing routers and network devices. UK and allied authorities warned that the actor is scanning globally for poorly configured infrastructure, abusing default or weak **SNMP** credentials and known Cisco-related weaknesses such as **Smart Install** and web-management flaws to seize control of devices, with critical sectors including communications, defence, energy, financial services, government, and healthcare identified as high-risk targets. French authorities said entities in France, including ministries and organizations in the diplomatic, defence, justice, and technology sectors, were targeted and compromised using Turla tradecraft that has been active since at least 2004. The coordinated disclosures were accompanied by formal attribution statements from France and the EU, while the UK said EU member states and London also attributed the December 2025 attack on Poland’s energy grid to FSB Centre 16 and announced sanctions against 24 individuals and entities tied to Russian destructive cyber and hybrid operations. Defenders were urged to harden network devices by adopting **SNMPv3**, disabling legacy SNMP versions, enforcing strong unique passwords, and restricting access to management interfaces.
Jul 16, 2026
Polish officials reported thwarting what they described as the most serious cyberattack on the country’s energy infrastructure in years, saying the intrusion came close to causing a widespread power outage. The attempted disruption occurred in the final days of December and targeted communications links between multiple renewable energy installations—such as **solar farms** and **wind turbines**—and electricity distribution operators across large parts of Poland, in what authorities characterized as a coordinated sabotage effort. Digital Affairs Minister Krzysztof Gawkowski said the incident “very close to a blackout” appeared to be a deliberate attempt to cut power to Polish citizens and that “everything points to Russian sabotage,” though officials did not provide technical details, name a specific threat actor, or disclose the defensive measures implemented afterward. The incident reflects a broader pattern of increased Russia-linked cyber activity against Polish critical infrastructure since Russia’s 2022 invasion of Ukraine, alongside ongoing kinetic strikes on Ukraine’s energy system that Ukrainian authorities have described as creating an “unprecedented” energy crisis.
Jun 29, 2026