UK and EU sanctions connect Russian hackers to the state

Tears up the long-standing diplomatic fiction

The UK and European Union have announced a joint sanctions package against the Russian cybercrime ecosystem.

Instead of only targeting individual hackers, the EU has sanctioned nine people and four entities, while the UK has sanctioned a combination of 24.

The move deliberately ignores the long-standing pretence that Russian cybercrime is divorced from the government, specifically calling out “the Russian state and its criminal networks.”

GRU (Russia’s foreign military intelligence agency) intelligence officers are among the sanctioned figures, including those in senior leadership such as Senior Officer Guards General-Major Vyacheslav Stafeyev, GRU 29155 Officer Ivan Senin and Senior Officer Ivan Kasyanenko.

In its sanctions announcement, the UK writes that GRU Unit 29155 “worked with cybercriminals, including the company IMPULS, to recruit hackers and cyber specialists from universities and academies across Russia.”

Also included are cybercriminals, self-proclaimed hacktivists and “private companies that contribute to Russia’s efforts to destabilise the EU, its member states and international partners,” the EU announced.

These companies include OOO IMPULS, Advanced System Technology, NPP Gamma and Rybar LLC. Rybar is a media company allegedly resourced by the Russian state. It is accused of spreading disinformation about Ukraine and interfering in European elections, including in Moldova and Armenia.

The sanctioned parties are “responsible for orchestrating cyber-attacks, interfering in elections and spreading malicious anti-Ukraine narratives across Europe.”

FSB unit named as Russia’s cybercrime control room

Alongside the sanctions, the UK and EU have jointly named the 16^th Centre of Russia’s Federal Security Service (FSB) as directly controlling a number of cybercrime groups, including Turla.

A recent attack on Poland's energy grid has now been attributed to the 16^th Centre, as well as cyber activities targeting governments in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland.

French Minister of Foreign Affairs and Europe, Jean-Noël Barrot, said the government will summon the Russian ambassador over the accusations, and Germany has announced a similar move.

Computing says:

The sanctions’ actual effect is likely to be limited; Russia infamously does not extradite cybercriminals, and GRU officers are unlikely to be fazed by a travel ban (although some proxy groups may be irritated by the related asset freeze).

The real message is in the UK and EU abandoning the diplomatic fiction that the Russian state and cybercriminals were not working together. This sends a message that the time for plausible deniability is over and makes future action easier to justify.