Loading story…
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to Conti, TrickBot, Wizard Spider, LockBit, EvilCorp, BlackBasta, the Lumma infostealer, and the pro-Russian Cyber Army of Russia Reborn. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of GRU Unit 29155.
The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to Unit 29155, while the EU action also cites links to the WhisperGate campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The European Union imposed new sanctions on eight individuals for alleged involvement in Russian-linked cyberattacks and cybercrime. Those named include alleged figures tied to Conti, bulletproof hosting, the Cyber Army of Russia Reborn, Lumma, and GRU Unit 29155.
The UK government published a profile detailing GRU cyber and hybrid threat operations, including activity attributed to Russian military intelligence units.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB **Centre 16**. Officials said the failed operation could have cut electricity to as many as **500,000 people** during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s **16th Centre** as controlling several threat groups, including **Turla**, and cited a failed attack on Poland’s critical infrastructure. The sanctions cover **24 individuals and entities**, including GRU leaders **Vyacheslav Stafeyev**, **Ivan Senin**, and **Ivan Kasyanenko**, as well as **IMPULS**, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to **Lumma Stealer**, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least **2,100 UK victims** in six months, and **10 people linked to Rybar LLC**, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Jul 15, 2026
The United Kingdom has imposed new sanctions on several Russian and Chinese organizations and individuals accused of conducting cyberattacks and influence operations aimed at undermining Western democracies. Foreign Secretary Yvette Cooper announced these measures, which target Russian influence networks such as the Telegram channel Ryber, Pravfond, and the Centre for Geopolitical Expertise, as well as Chinese technology companies i-Soon and Integrity Technology Group. The sanctions are part of a broader effort to counter hybrid security threats, including disinformation campaigns and cyber operations, with the UK calling for enhanced multilateral cooperation across Europe to address these evolving challenges. In a related address, Cooper emphasized the growing sophistication and democratization of tools used by hostile foreign states, particularly Russia, to conduct information warfare and hybrid attacks targeting critical infrastructure and democratic institutions. She highlighted recent examples of Russian disinformation campaigns, such as the Doppelgänger operation and attempts to undermine political stability in Moldova and Africa through fake news and deepfakes. The UK government is urging European partners to strengthen collaboration and resilience against these persistent and complex threats to national and regional security.
Jun 29, 2026
The **EU Council** imposed sanctions on **three entities and two individuals** over cyberattacks targeting EU member states and partners. The measures include **asset freezes**, a ban on EU persons and companies providing funds or economic resources to those listed, and **travel bans** for the individuals. The action expands the EU cyber sanctions regime to **19 individuals and 7 entities**, underscoring a coordinated response to persistent malicious cyber activity affecting Europe. The sanctioned parties include China-based **Integrity Technology Group**, which the Council said provided products used to compromise devices in EU member states and worldwide, contributing to the hacking of **more than 65,000 devices across six member states** between 2022 and 2023. Also listed were **Anxun Information Technology** and its two co-founders for providing hacking services targeting **critical infrastructure and critical functions** in member states and third countries. The Iranian company **Emennet Pasargad** was sanctioned for accessing a **French subscriber database** and offering it for sale on the dark web, compromising **advertising billboards** to spread disinformation during the **2024 Paris Olympic Games**, and breaching a **Swedish SMS service** affecting a large number of EU citizens.
Jun 29, 2026