The EU and UK have jointly sanctioned Russia's cyber apparatus for the first time — targeting the machine behind the hacking, not just the hackers operating it.
The EU designated nine individuals and four entities. The UK's list went further, reaching 24 targets. EU High Representative Kaja Kallas did not frame the action around a specific breach or a named group. She condemned an ecosystem — intelligence services and the organizational layers that recruit, fund, and protect Russian state hackers, including the FSB-linked Turla operation.
Prior sanction rounds have followed a predictable pattern: a Russian group carries out an attack, Western governments name individuals, and little changes. State-sponsored operatives rarely hold foreign bank accounts or book flights to countries where the designations bite. Going after agencies and entities — the structures that enable state hacking — is a different theory of pressure, aimed at the bureaucratic infrastructure, not the people on the keyboard.
Russia has absorbed years of individual designations without adjusting its cyber posture; this round at least asks a harder question.