European governments sanctioned Russian individuals and organizations Monday over what they said was a years-long campaign of cyberespionage from Turla and other Russian government-led “destructive attacks” against the bloc.

Monday’s confrontation of Moscow included action from the European Union, its individual member governments and the United Kingdom. It mostly took aim at Center 16 of Russia’s Federal Security Service (FSB) over its control of the cyber threat group known by a list of names including Turla, Secret Blizzard and Waterbug.

“Cybercriminals, self-proclaimed hacktivists and private companies linked to Russia, including actors operating under its instructions, direction or control, have also carried out, enabled and facilitated a wide range of malicious activities,” European Union High Representative Kaja Kallas said in a statement.

The EU called out Russia for the Turla campaign that dated back to 2010 in France with targeting of the government there, and has also featured activity against Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania and Finland. It made special mention of blaming the FSB for last December’s attacks on Poland’s energy grid, which left half a million people without heat.

In all, the European Union sanctioned nine Russian individuals and four entities. While the EU didn’t name them, Kallas’s statement said it also included officers of Russia’s Main Intelligence Directorate of the General Staff (GRU).

The United Kingdom’s cyber sanctions, the first it’s done in coordination with the EU, featured a longer list of 24 individuals and entities. The U.K. named GRU senior leadership figures Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko for their alleged hybrid cyberattacks in conjunction with cybercriminals and recruitment of hackers across Russian universities. The U.K. also sanctioned individuals behind Lumma Stealer, the target of an international takedown last year.

“These sanctions strike at the core of the cybercriminal networks propping up the Russian state’s aggression, and the UK and EU are sending a clear message that Russia cannot hide behind its use of these proxy groups,” Foreign Secretary, Yvette Cooper, said in a news release that mentioned “destructive attacks” by Russia. “From directing criminals to targeting businesses, and striking Poland’s energy grid in the depths of winter, the Russian state is sinking to new lows in its attempts to undermine European security.”

At least two European governments, Germany and France, said they would be summoning Russia’s ambassadors in their nations over the attacks.

Also Monday, the European Union announced sanctions against the company behind Russia’s messaging app, Max, citing its use of surveillance features to clamp down on dissent. And separately, 13 nations including the United States issued a warning on Monday about Russian government hackers targeting routers to carry out critical infrastructure attacks.

Russia routinely denies allegations of responsibility for any malicious cyber activity.

The post Europe strikes out against Russia’s Turla over espionage, ‘destructive attacks’ appeared first on CyberScoop.

Russian state-sponsored hackers are breaking into critical infrastructure around the world by exploiting poorly configured and vulnerable networking devices, authorities from the United States and 12 additional countries said in a joint cybersecurity advisory Monday.

Officials once again urged defenders to take more preventative measures to thwart attacks from the Russian Federal Security Service Center 16, which has been actively targeting critical infrastructure for more than a decade. The hackers are also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra.

“This is an ongoing issue that has impacted various U.S. and foreign networks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in a statement.

The state-sponsored attackers scan the internet for vulnerable routers using default or weak passwords, and have also exploited vulnerabilities in Cisco devices, Cisco’s Smart Install feature and web portals to take over network devices. 

Two of the Cisco vulnerabilities exploited by the Russian FSB Center 16 hackers are quite old, including CVE-2008-4128 and CVE-2018-0171. 

Officials shared technical details of the threat group’s activities and advised network defenders to disable Cisco Smart Install on all devices, use stronger modes of authentication and passwords, monitor for unusual credentials and logins using local accounts. 

The joint advisory comes nearly a year after the FBI issued a similar alert about the same group targeting end-of-life networking devices running Cisco Smart Install. 

On Monday, the European Union blamed Russia’s FSB Center 16 for a December 2025 attack on Poland’s energy grid. The United Kingdom, also on Monday, sanctioned 24 individuals and entities allegedly involved in various attacks attributed to Russian intelligence services.

“From directing criminals to targeting businesses, and striking Poland’s energy grid in the depths of winter, the Russian state is sinking to new lows in its attempts to undermine European security,” Yvette Cooper, foreign security of the United Kingdom, said in a statement. 

Other countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.

The post Officials once again warn defenders that Russian hackers are targeting network devices appeared first on CyberScoop.