EU sanctions Russian intelligence officers, hackers and firms over yearslong cyberespionage campaign targeting bloc

The European Union on Monday imposed sanctions on Russian military intelligence officers, suspected hackers and private companies accused of carrying out a yearslong cyberespionage campaign, according to a report published by The Washington Times. The EU said the activity was aimed at undermining the bloc and described the campaign as persistent and coordinated rather than isolated incidents.

The measures were announced as the EU continues to expand its use of restrictive tools in response to cybersecurity threats and state-linked hostile operations. In its characterization of the case, the EU framed the campaign as part of a broader effort to gain access to sensitive information and disrupt the bloc’s ability to function securely.

The EU’s action targeted a mix of alleged state-linked personnel and third parties, including individuals described as intelligence officers and actors described as hackers. It also included private entities that the EU said supported or enabled the cyber operations, a move that indicates the bloc’s intent to treat cyber activity as a networked enterprise rather than the work of disconnected individuals.

While the report did not detail each specific designation, the EU’s decision reflects a wider pattern in European sanctions policy: pairing individual accountability with pressure on companies that may provide infrastructure, services, or operational support to sanctioned actors. The inclusion of companies alongside officers and hackers indicates the EU is seeking to limit both the human and technical components of the alleged operation.

The alleged campaign was described in EU terms as yearslong, meaning it likely involved sustained access attempts and repeated compromises over time. European officials have frequently argued that such long-duration activity increases the risk of ongoing data theft and intelligence collection, along with longer-term consequences for critical institutions and private-sector entities that handle sensitive information.

The sanctions take effect following the EU process for adopting restrictive measures. Once listed, designated individuals and entities are subject to the EU’s applicable restrictive measures, which typically include restrictions tied to financial transactions and movement, though the report did not specify the precise legal instruments for each listed party.

The EU’s next steps will depend on how the designations are implemented and challenged, including any legal proceedings that designated parties may pursue. For organizations operating across EU jurisdictions, the EU action also increases compliance expectations, as firms often adjust screening and cybersecurity controls when new state-linked cyber threat designations are published.

The case arrives amid heightened focus across governments on cyber operations attributed to foreign intelligence services. By issuing sanctions aimed at both alleged officers and supporting private actors, the EU is indicating that it intends to treat cyberespionage as a direct security and sovereignty issue requiring government-level deterrence and enforcement.