The European Union on Monday imposed sanctions on Russian military intelligence officers, hackers and private companies over what it described as a yearslong cyberespionage campaign to undermine governments in Europe. Nine people and four entities were targeted. The bloc’s answer to covert state hacking was the familiar one: asset freezes, travel bans, and a fresh round of diplomatic theatre while ordinary people are left to live with the fallout of rival intelligence machines.
Brussels Meets the Security State
The EU said the network had hit governments and carried out sabotage operations against critical infrastructure, including heating and power plants, since 2010. Britain joined in with sanctions on 24 people and entities. Kaja Kallas, the EU foreign policy chief, said those hit by the sanctions “contribute to Russia’s efforts to destabilize the EU, its member states and international partners.” That’s the language of the Brussels apparatus when states start throwing digital punches at each other: destabilization, threats, partners, security. The people who actually depend on heating, power and public services get mentioned only when infrastructure is already under attack.
France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland, “among others,” had fallen prey to the network, Kallas said. Germany summoned Russia’s ambassador, and French Foreign Minister Jean-Noël Barrot said Paris intended to call in Russia’s envoy in the coming days. Barrot told French BFM television that the aim of the cyberactivities is “either to capture information, or sabotage the operation, for example, of railway infrastructures, as it was [the case in Poland].” Railways, heating plants, power plants. The state’s prized arteries, exposed as vulnerable in the same breath that officials posture about control.
The Intelligence Services at Work
The EU focused its sanctions, mostly asset freezes and travel bans, on the 16th Center of Russia’s Federal Security Service, or FSB. Kallas said the FSB has been “controlling a variety of cyberthreat groups” and had conducted “a wide range of malicious cyberactivities with growing severity.” The bloc said a unit within the FSB was responsible for directing the activities of the state-backed hacking group Turla, which has targeted governments, critical infrastructure and strategic industries across Europe. The FSB orchestrated attacks by cybercriminals, private companies and so-called hacktivists, causing disruptions and financial losses.
That’s the machinery on display. Not a rogue corner of the system, but the system itself: intelligence services, private companies, criminal intermediaries and patriotic branding all folded together into one obedient chain of command. The state calls it defense. The rest of society gets the bill.
The EU also targeted a member of Russia’s GRU military intelligence agency, Yevgeny Bashev, and a company it says he runs, Impuls. The sanctions notification said Impuls provides technical and material support to cyberattacks and attempted cyberattacks conducted by GRU Unit 29155. It said the actions of Impuls “constitute an external threat” to EU member countries and have had “a significant effect” on an unnamed country outside the bloc. Britain said Impuls recruited hackers and cyber specialists from Russian universities and academies. It also sanctioned Bashev and three other senior GRU officials “for their role in directing GRU cyber and hybrid threat operations.” Britain said Russian intelligence agencies “have tasked cybercriminals to collect intelligence to support Russia’s military and foreign policy objectives, threatening security across Europe.”
Who Gets Hit, Who Gets Protected
According to the French government, Turla compromised unclassified email systems at the Defense Ministry in 2017, breached the French embassy in Moscow the following year and stole industrial secrets from a high-tech company in 2025. French officials also accused the group of hijacking third-party infrastructure, including offensive cyber capabilities linked to Iran, to conceal the origin of its operations. The EU said the FSB unit was also behind a sabotage operation targeting critical infrastructure in Poland, including combined heating and power plants.
Monday’s sanctions also affect Russian technology companies supporting the intelligence services, including Advanced System Technology, or AST, and NPP Gamma, which will now be barred from doing business in the EU. AST had previously been sanctioned by the United States in 2021. The sanctions regime keeps expanding, the intelligence services keep adapting, and the public keeps being told this is all about stability. Meanwhile, the same states that police borders, criminalize movement and wrap themselves in democratic language are perfectly comfortable running their own shadow wars through ministries, embassies and corporate fronts. Different flag. Same machinery.