The United Kingdom has announced a new round of sanctions targeting three units of Russia’s military intelligence agency, the GRU, along with 18 of their operatives, in response to a pattern of malicious cyber activity, espionage, and attempted assassinations directed at the UK, Ukraine, and other European allies.
The measures, unveiled by the Foreign, Commonwealth and Development Office (FCDO), aim to hold the Kremlin accountable for what officials described as a “prolonged campaign of hybrid threats,” including cyberwarfare and covert attacks intended to destabilize Western democracies and support Russia’s ongoing aggression in Ukraine.
Sanctioned Entities
The UK is targeting three GRU units known for high-profile cyber and paramilitary operations:
- Unit 29155, also cited under threat actor aliases such as Cadet Blizzard, Bleeding Bear, and DEV-0586, is linked to assassination attempts and sabotage actions across Europe, including the 2018 Salisbury poisonings.
- Unit 26165, commonly referred to as Fancy Bear or Blue Delta, is allegedly responsible for extensive cyber espionage and reconnaissance campaigns, especially in support of Russian military operations in Ukraine.
- Unit 74455, known as Voodoo Bear or Sandworm, has been associated with destructive cyberattacks, particularly in Ukraine, and is accused of developing and deploying malware targeting civilian infrastructure.
Eighteen individual operatives associated with these units have been named under the UK’s Global Human Rights Sanctions regime. These sanctions include asset freezes and travel bans, and bar UK individuals and entities from engaging in any financial dealings with them.
Allegations of Cyber Warfare and Assassination
According to UK officials, the sanctioned operatives conducted wide-ranging cyber campaigns designed to disrupt political institutions, attack energy and telecommunications sectors, and gather intelligence on defense and diplomatic priorities.
The UK attributes to them several high-profile operations, including:
- Longstanding cyberattacks on UK critical infrastructure and democratic institutions
- Deployment of advanced malware such as X-Agent, WhisperGate, and Authentic Antics to infiltrate and destabilize targeted systems
- Information-gathering missions used to support missile strikes during the war in Ukraine, including the 2022 bombing of Mariupol’s theatre, resulting in significant civilian casualties
Notably, Unit 29155 was previously linked to the attempted assassination of former Russian spy Sergei Skripal and his daughter in Salisbury. The government now reveals that this operation was preceded by a cyber campaign, including malware attacks on Yulia Skripal’s personal devices years before the poisoning.
