EU and Britain target Russian intelligence officers over a major cyberspying campaign

BRUSSELS — The European Union and Britain on Monday imposed sanctions on Russian military intelligence officers, hackers and private companies, denouncing what they described as a yearslong cyberespionage campaign to undermine governments in Europe.

The EU decision affects nine people and four entities accused of links to an online spying network that the bloc said has targeted governments and carried out sabotage operations against critical infrastructure like heating and power plants since 2010. Britain slapped sanctions on 24 people and entities.

EU foreign policy chief Kaja Kallas said those hit by the sanctions “contribute to Russia’s efforts to destabilize the EU, its member states and international partners.”

France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland, “among others,” have fallen prey to the network, she said in a statement.

Germany summoned Russia's ambassador, and French Foreign Minister Jean-Noël Barrot said Paris intends to call in Russia's envoy in the coming days. He told French BFM television that the aim of the cyberactivities is “either to capture information, or sabotage the operation, for example, of railway infrastructures, as it was the case in Poland.”

The EU focused its sanctions, which are mostly asset freezes and travel bans, on the 16th Center of Russia’s Federal Security Service, or FSB. Kallas said the FSB has been “controlling a variety of cyberthreat groups,” and said it “has conducted a wide range of malicious cyberactivities with growing severity.”

Some countries have accused Russia of using cyberattacks and propaganda to interfere with elections.

In April, Sweden said a pro-Russian group with links to Russia’s security and intelligence services was behind a cyberattack on a heating plant last year. The announcement followed warnings from officials in Poland, Norway, Denmark and Latvia that Russia is attacking critical infrastructure across Europe.

With its sanctions, the EU notably targeted a member of Russia's GRU military intelligence agency, Yevgeny Bashev, and a company it says he runs, Impuls.

“The company provides technical and material support to cyberattacks and attempted cyberattacks conducted by GRU Unit 29155,” the sanctions notification said. It said the actions of Impuls “constitute an external threat” to EU member countries and have had “a significant effect” on an unnamed country outside the bloc.

Britain said Impuls recruited hackers and cyber specialists from Russian universities and academies. It slapped sanctions on Bashev as well as three other senior GRU officials “for their role in directing GRU cyber and hybrid threat operations.”

Britain believes Russian intelligence agencies “have tasked cybercriminals to collect intelligence to support Russia’s military and foreign policy objectives, threatening security across Europe.”