The European Union and the United Kingdom on Monday announced coordinated sanctions against Russian individuals and entities, while France and Germany summoned Russia’s ambassadors, in response to what Western governments describe as a years-long cyber campaign of sabotage and espionage directed at European states. The EU designated nine people and four organisations, and the UK added 24 names to its blacklist in what London called the first joint cyber sanctions package with the bloc since Britain’s departure. The measures target officers of Russia’s GRU military intelligence service and the FSB’s Centre 16, a unit that according to EU and British assessments has controlled a network of state and non-state hacking groups.

According to statements from Paris, Berlin, Brussels and London, the cyber operations affected at least nine EU member states, including France, Germany, Poland, the Netherlands and Finland. French Foreign Minister Jean-Noël Barrot said the attacks aimed “either to capture information or to sabotage operations, for example rail infrastructure, as was the case in Poland.” The British government attributed a failed attempt to disrupt Poland’s electricity grid to the FSB, noting that the operation “could have caused 500,000 citizens to lose electricity in the depths of winter.” The EU’s foreign policy chief, Kaja Kallas, described a “malicious cyber ecosystem” that ranged from intelligence officers to cybercriminal groups and private companies, and that had caused disruptions and financial losses.

Viewed from European capitals, the sanctions and diplomatic démarches represent a calibrated escalation in the response to hybrid threats that officials say have intensified alongside Russia’s war in Ukraine. The UK also sanctioned individuals linked to the Rybar media network, which it accuses of spreading anti-Ukraine disinformation and interfering in elections in Moldova and Armenia, as well as operators of the Lumma Stealer malware used to harvest credentials for espionage. The announcements were timed to coincide with a summit in Paris of the “coalition of the willing” supporting Ukraine, reinforcing the link between the cyber campaign and the broader confrontation with Moscow.

Moscow, through its foreign ministry and state media, has rejected the allegations as unfounded. Russian outlets reported the summons of ambassadors and the new sanctions, while recalling that President Vladimir Putin earlier this year described European accusations of sabotage and cyberattacks as an attempt to justify aggressive plans against Russia. The Russian side has not presented a detailed technical rebuttal but has consistently denied state involvement in the incidents cited by Western governments.

The dossier remains active. The EU is preparing a 21st package of sanctions against Russia, with additional designations expected in the coming weeks. Both Paris and Berlin have indicated that the summoned ambassadors will be told that further cyber operations will be met with additional restrictive measures, while Western cyber defence agencies continue to monitor the threat groups attributed to Russian intelligence services.