Europe names the FSB: first joint EU-UK cyber sanctions land over the Poland grid attack

The malware was built for winter. According to the sanctions notices the EU and the United Kingdom published Monday, a December cyberattack on Poland’s energy infrastructure was designed to cut electricity to roughly 500,000 people in the coldest part of the year — the point at which a grid failure stops being an inconvenience and becomes a public-health problem, because the combined heat-and-power plants that warm Polish apartment blocks need the grid up to do it.

It failed. Nothing went dark. The UK government’s announcement says the attack could have caused half a million people to lose power during winter; it caused no disruption at all.

Seven months later, Europe has said who it believes built it: Centre 16 of Russia’s Federal Security Service, the FSB. The EU sanctioned nine individuals and four entities, imposing asset freezes and travel bans, while the UK designated 24 individuals and entities. Both packages landed at the same time, as one coordinated action. That simultaneity is the genuine first here: London and Brussels have issued cyber sanctions before, but never together, in lockstep, since Brexit.

“Recently in Poland, the 16th Centre has carried out disruptive sabotage operations against critical infrastructure, including combined heating and power plants,” EU High Representative Kaja Kallas said in a statement on behalf of the member states.

One directorate, many names

The EU’s statement identifies Centre 16 as the controller of threat groups that security researchers have tracked for years under separate aliases, including Turla. BleepingComputer’s Sergiu Gatlan reports that the same unit maps to clusters known as Berserk Bear, Static Tundra, Ghost Blizzard and Dragonfly, and that the Polish grid operation used a wiper called DynoWiper. The espionage campaign attributed to the unit runs back to 2010 and touched at least nine countries, among them France, Germany, Poland and the Netherlands, according to CyberScoop.

France went a step further. Foreign Minister Jean-Noël Barrot said Paris will summon Russia’s ambassador, telling reporters, per Euronews: “We will also impose sanctions on nine individuals and four entities responsible for this cyber campaign, which was orchestrated by the FSB.” Ten European nations were targeted in recent days, he said, including sabotage of Polish rail infrastructure.

Read the designation lists and they resemble a business directory more than a spy roster. Alongside three senior GRU figures named by the UK (Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko), the packages cover Vitaly Kovalev, identified as a leader of the Trickbot and Conti ransomware operations; Media Land, a “bulletproof” hosting provider, with its sister firm ML.Cloud; members of GRU Unit 29155’s cyber division; and the developers of Lumma Stealer, credential-theft malware the UK says claimed more than 2,100 British victims in six months.

What a travel ban does to a spy

The honest question: what does an asset freeze do to an FSB officer who will never open an EU bank account, or a travel ban to a GRU commander with no Provence holiday planned? Directly, probably very little.

But the package is not really aimed at the officers. The service layer around them — the hosting firms, the malware vendors, the ransomware alumni — does touch Western payment rails and Western customers, and a sanctions listing turns everyone who does business with them into a compliance risk. Joint attribution carries its own weight, too. It puts a shared public record behind claims that would otherwise live in classified briefings, and the synchronized timing tells Moscow that the post-Brexit seam it might have hoped to work isn’t there. Foreign Secretary Yvette Cooper put the theory bluntly: “These sanctions strike at the core of the cybercriminal networks propping up the Russian state’s aggression.”

Whether the core notices remains to be seen. The UK has now sanctioned more than 3,400 targets in connection with Russia’s war effort, and the attacks have not stopped.

Moscow, Euronews notes, has denied every accusation of European cyber-sabotage to date. Its ambassador in Paris will get the chance to do so again, this time in person.