EU adopts largest-ever cyber sanctions package against Russia

TALLINN - The European Union on Monday approved its most extensive package of cyber sanctions against Russia to date at the Foreign Affairs Council.

Eight individuals and four entities, whose malicious activities in cyberspace have directly harmed the economies, public services, and critical infrastructure of member states, were added to the EU's cyber sanctions framework. Under the hybrid sanctions regime, one officer from Russia's military intelligence (GRU), linked to targeted cyberattacks against the EU, was also added to the list.

Foreign Minister Margus Tsahkna emphasized that hybrid operations, including cyberattacks, are a central tool of Russia's strategic influence activities. To carry out such extensive and coordinated cyber activities, the Russian regime uses, among other things, state-backed cyber groups that operate in the interests of Russia's special services and military structures, performing intelligence and preparatory tasks both in peacetime and during full-scale military conflicts.

"Russia's imperialist ambitions are not limited to Ukraine," Tsahkna said. "The growing volume and aggressiveness of cyberattacks led by Russia's military intelligence (GRU) and the Federal Security Service (FSB) clearly show a malicious pattern aimed at testing the resilience of Western countries, undermining social stability, weakening support for Ukraine, and increasing Russia's influence in Europe. The cyber sanctions package approved today-which includes Russian intelligence officers, cybercriminals, GRU-affiliated hacktivists, and companies that have enabled or supported Russia's strategic goals-significantly raises the cost of malicious cyber activity and sends a clear message to the aggressor: every attempt to manipulate our societies will have real, tangible consequences."

The package also includes the 16th Center of Russia's Federal Security Service (FSB), which has been attributed with attacks against Polish energy infrastructure, including wind and solar power plants, a thermal power station, and several industrial facilities.

"As Russia finds it increasingly difficult to continue its military operations in Ukraine, its intelligence services have tasked cybercriminals with gathering intelligence to support Russia's military and foreign policy objectives. This jeopardizes the security of all of Europe," Tsahkna noted.

The minister stressed that international law applies to all countries in cyberspace as well, and all of Russia's violations of international law-including subversive activities in countries supporting Ukraine-must be held accountable. "Clear rules apply in cyberspace, and every violation must receive a fitting punishment."

According to Tsahkna, Estonia will continue to counter Russia's cyber activities and implement coordinated countermeasures together with its EU and NATO allies, including the United Kingdom.

"The EU's cyber sanctions list now includes 27 individuals and 11 entities. We will identify, attribute, and expose everyone responsible for malicious cyber activities or for supporting Russian operations. Close cooperation with our allies allows us to more quickly identify attack vectors, share technical information, and jointly strengthen our cyber defense capabilities."

In addition to the cyber and hybrid sanctions, the European Union imposed sanctions on eight Russian citizens and one entity under the global human rights regime. Five technology companies and four executives whose activities have enabled extensive state control and violations of citizens' rights were also added to the list. Sanctions were also imposed on seven individuals responsible for the torture or execution of Ukrainian prisoners of war and civilians in Russian prison colonies.