France and EU Attribute Turla Cyberattacks to Russian FSB 16th Center
On July 13, 2026, France, the EU, and NATO formally attributed a long-running cyber-espionage campaign using the Turla method to Russia’s FSB 16th Center. Since the 2010s, Turla has compromised French ministries, diplomatic missions (including the Moscow embassy in 2018), justice and tech sectors, and targeted Ukraine, NATO, and EU entities. Poland also faced critical infrastructure attacks. The EU imposed sanctions on linked criminal groups. The attribution aims to hold Russia accountable amid escalating hybrid warfare.
Editorial responsibility
- No named human review is recorded for this page.
- Reports are grouped by semantic similarity and deterministic rules. Language models may assist titles, summaries, translation and cross-source analysis; the page itself is projected from evidence records.
- Current automated evidence projection
Cross-source coverage
Wire timeline
Europe Exposes Russia's Cyber War Ecosystem
On July 13, the European Union, France, and NATO publicly attributed a wide-ranging Russian cyber campaign to the Federal Security Service's 16th Centre (military unit 71330). The campaign involves an ecosystem of intelligence services, military units, criminal groups, proxy hackers, and private companies working toward strategic pressure against Europe and Ukraine. France identified the TURLA intrusion set, active since 2004, used for espionage against governmental, diplomatic, defense, and energy targets. Specific attacks include compromise of French Ministry of Armed Forces emails (2017), French Embassy in Moscow network (2018), and a justice-sector server (2019). Poland reported cyberattacks on critical infrastructure including water sanitation and energy sectors. The EU imposed sanctions on entities linked to TrickBot, Conti, and other groups. The analysis highlights Russia's distributed interception system across 11 centers, including Kaliningrad, posing a threat to NATO's eastern flank.
Europe Exposes Russia's Cyber War Ecosystem
On July 13, the European Union, France, and NATO publicly attributed a wide-ranging Russian cyber campaign to the Federal Security Service's 16th Centre (military unit 71330). The coordinated denunciation reveals that Moscow has built an ecosystem integrating intelligence services, military units, criminal groups, proxy hackers, and private companies to pressure Europe and Ukraine. France detailed specific attacks since 2017, including compromises of the Ministry of Armed Forces, the French Embassy in Moscow, and a justice-sector server. The TURLA intrusion set, active since 2004, targets governmental, diplomatic, defense, and energy sectors. Poland was identified as a recent target of cyberattacks with sabotage objectives against water sanitation and energy infrastructure. The EU response includes sanctions against entities linked to TrickBot, Conti, and other malicious tools. The analysis highlights Russia's distributed interception system across eleven centers, including a key unit in Kaliningrad threatening NATO's eastern flank.
Europe Exposes Russia's Cyber War Ecosystem
On July 13, the European Union, France, and NATO publicly attributed a wide-ranging Russian cyber campaign to the Federal Security Service's 16th Centre (military unit 71330). The coordinated denunciation reveals that Moscow has built an ecosystem where intelligence services, military units, criminal groups, proxy hackers, malware developers, and private companies collaborate to pressure Europe and Ukraine. France's detailed report identifies the TURLA intrusion set, active since 2004, and lists 11 interception centers across Russia, including a key unit in Kaliningrad. Concrete examples include compromises of French Ministry of Armed Forces emails since 2017, the French Embassy in Moscow in 2018, and a justice-sector server in 2019. Poland was targeted with cyberattacks on water sanitation and energy infrastructure. The EU sanctions package targets entities linked to TrickBot, Conti, Wizard Spider, and other groups. The analysis frames cyber operations as one instrument within a wider hybrid campaign against Europe.
Show 2 older updatesHide older updates
France and EU Attribute Turla Cyber Attacks on French Entities to Russian FSB 16th Center
On July 13, 2026, France and the European Union formally attributed a series of malicious cyber activities and cyber-espionage campaigns targeting French, Ukrainian, NATO, and EU entities to the 16th Center of the Russian Federal Security Service (FSB). The attribution, led by France's Cyber Crisis Coordination Center (C4) with contributions from ANSSI, DGA, COMCYBER, DGSE, and DGSI, focuses on the use of the Turla attack method (TTP). Since the 2010s, Turla has been used to compromise French ministries (Defense, Foreign Affairs), diplomatic missions (including the French embassy in Moscow in 2018), justice sector entities, and technology firms. The announcement follows a similar attribution of APT28 to Russia's GRU in April 2025. France stated the action aims to hold Russia accountable and raise awareness of the ongoing hybrid cyber threat.
France and EU Attribute Turla Cyberattacks on French Entities to Russian FSB 16th Center
On July 13, 2026, France and the European Union formally attributed a long-running campaign of malicious cyber activities and cyber-espionage targeting French public and private entities to the 16th Center of the Russian Federal Security Service (FSB). The campaign, using the Turla attack method (TTP), has been observed since the 2010s, particularly affecting the diplomacy, defense, justice, and technology sectors. The attribution was led by France's Cyber Crisis Coordination Center (C4), which includes ANSSI, COMCYBER, the DGA, DGSE, and DGSI. This follows a similar attribution in April 2025 of the APT28 method to Russia's GRU. The announcement aims to remind Russia of its responsibilities, signal French monitoring of Russian offensive cyber operations, and raise awareness of the Russian cyber threat amid an intensification of hybrid attacks against France, Ukraine, NATO, and the EU.