Back Lemonde.Fr

France sanctions Russian elite cyberespionage unit 'Turla'

Lemonde.Fr • July 13, 2026

The Russian ambassador in Paris will be summoned in the coming days, and France will impose sanctions against "nine individuals and four entities" responsible for carrying out offensive cyber operations against French targets, announced Foreign Minister Jean-Noël Barrot on Monday, July 13, on BFM-TV .

The digital spying campaigns targeted "public and private entities in the government, diplomatic, defense, research, technology, education, media, and energy sectors, as well as individuals worldwide," according to the National Agency for the Security of Information Systems (ANSSI), which oversees digital security for the French state and leads the cyber crisis coordination center (C4).

According to a statement released Monday by the French foreign ministry , the Russian state- hackers have previously targeted "internet messaging accounts of the Ministry of the Armed Forces since 2017, as well as the network of the Ministry for Europe and Foreign Affairs at the French embassy in Moscow in 2018." More recently, the same group attacked "a research institute working on sensitive technologies for the French defense industry," which led to "the exfiltration of a significant volume of data."

Investigations led by the C4 attributed responsibility for this campaign to a group of hackers linked to the 16 th Center of the FSB, Russia's domestic intelligence service, and more specifically to its Unit 61240, which is tasked with targeting France. Cybersecurity experts refer to this group as "Turla." The group also conducted numerous sophisticated cyberespionage campaigns against Ukraine and other Eastern European countries, as cybersecurity experts from Google noted in a 2022 blog post .

According to the French foreign ministry, Turla "recently conducted several sabotage-oriented cyberattacks against the water sanitation system and the energy sector" in Poland. At the end of 2025, Polish authorities faced sophisticated attacks aimed at disrupting the operation of several companies in the energy sector, notably using a "wiper," a form of malware designed to erase data on a computer network. These attacks were initially attributed to Sandworm , another Russian group linked to the military intelligence service (GRU).

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EU Sanctions Russia Over Ongoing Cyber Espionage Campaign The European Union has condemned and sanctioned Russia for a prolonged cyber espionage campaign targeting its member states. The campaign, orchestrated by the 16th Centre of the FSB, has involved infiltrating government networks and sabotaging critical infrastructure across multiple countries, including France, Germany, Poland, and Finland. The attacks have been linked to the Turla group and have been ongoing since at least 2010. In response to these activities, the EU has imposed sanctions on nine individuals and four entities involved in these operations. The attacks have caused significant disruptions and financial losses, with specific incidents reported against Poland's energy infrastructure. France's Foreign Minister announced plans to summon the Russian ambassador in light of these developments. The UK has also joined the EU in imposing sanctions, targeting a total of 24 individuals and entities associated with Russian intelligence operations. 125 sources 78

Extracted Entities

France sanctions Russian elite cyberespionage unit 'Turla'

The full story

Extracted Entities

APT Groups (2)

Attack Types (2)

Companies (1)

Countries (4)

Industries (3)

MITRE ATT&CK (1)