EU imposes sanctions on GRU officers over ‘Fancy Bear’ cyberattacks
The Council of the European Union has imposed sanctions on two Russian citizens and a military intelligence center due to cyberattacks targeting Germany’s parliament in 2015 and the Organization for the Prohibition of Chemical Weapons (OPCW) in 2018. This was announced in the latest volume of the Official Journal of the European Union. The United Kingdom announced plans to enforce these sanctions, as well.
The sanctions were imposed upon:
- Igor Kostyukov, Head of the Main Directorate of the General Staff of Russia’s Armed Forces (the GU/GRU)
- Dmitry Badin, GRU officer
- The 85th Main Center for Special Services (GtsSS) of the GRU, also known as “military unit 26165” (codenamed “Fancy Bear”)
“Fancy Bear” is a group of hackers, also known by the codenames APT28 and Strontium. Former special counsel for the U.S. Justice Department Robert Mueller, who was leading the investigation into Russian interference in the 2016 American presidential elections, previously spoke about the group’s connection to Russia’s GRU. The group was accused of hacking the servers of the Democratic National Committee (DNC) and the email of former U.S. State Secretary Hillary Clinton. According to Microsoft, the hackers tried to attack voters in the United States ahead of the midterm elections in 2018, and they targeted 16 national and international sports and anti-doping organizations in September 2019.
Those included on the sanctions list are banned from entering the EU and the UK. Their assets in the EU and the UK have also been frozen.
According to the EU, Igor Kostyukov is responsible for a number of cyberattacks carried out by GRU unit 26165 and Dmitry Badin was involved in the cyberattack on the German parliament (the Bundestag) as an officer in this unit. The EU stated that the GRU hackers attacked Germany’s parliament in April–May 2015 and stole a significant amount of data. Their actions also affected the email accounts of several lawmakers and Chancellor Angela Merkel. The attack affected the operations of the parliament’s information system for several days.
Germany’s Attorney General had called for the arrest of Dmitry Badin in connection with the cyberattack on the Bundestag previously, the German newspaper Suddeutsche Zeitung reported back in May. German prosecutors actually identified two hackers involved in the attacks, but were only able to gather sufficient evidence on Badin.
In 2018, the U.S. accused Badin of coordinating the actions of GRU officers who were involved in interfering in the 2016 presidential elections. He was also charged with hacking the computer systems of the World Anti-Doping Agency, FIFA, World Athletics, and other international organizations.
The EU also holds Kostyukov responsible for an attempted cyberattack aimed at hacking into the OPCW’s Wi-Fi network in the Netherlands in April 2018.
This is the second time the EU has announced sanctions on GRU Head Igor Kostyukov. Brussels imposed sanctions against him in 2019 over the 2018 Novichok poisoning of ex-GRU colonel Sergey Skripal and his daughter Yulia.
Read more about the GRU
- U.S. Justice Department charges six Russian military intelligence officers in connection with worldwide cyberattacks
- ‘Accessible only to State authorities’ Here’s how the EU explained its decision to sanction high-level Russian officials over Navalny’s poisoning
- What is the GRU? Who gets recruited to be a spy? Why are they exposed so often? Here are the most important things you should know about Russia’s intelligence community
Text by Alexander Baklanov
Translation by Eilish Hart
The GRU
The Main Directorate of the General Staff of Russia’s Armed Forces (GU) was known as the Main Intelligence Directorate (GRU) until 2010. The military intelligence service was renamed within the framework of a Defense Ministry reform. However, Russia’s military intelligence is still referred to as the GRU both domestically and abroad.
Fancy Bear
Fancy bear is a group of hackers, also known by the codenames APT28 and Strontium. Former special counsel for the U.S. Justice Department Robert Mueller, who was leading the investigation into Russian interference in the 2016 American presidential elections, previously spoke about the group’s connection to Russia’s GRU. The group was accused of hacking the servers of the Democratic National Committee (DNC) and the email of former U.S. State Secretary Hillary Clinton. According to Microsoft, the hackers tried to attack voters in the United States ahead of the midterm elections in 2018, and they
The Skripal poisonings
In March 2018, former GRU colonel Sergey Skripal — who was convicted of spying for Great Britain — was poisoned with a Novichok-type nerve agent in Salisbury, England, along with daughter Yulia. According to the British authorities, Russia’s intelligence services organized the assassination attempt. Moscow categorically denies any involvement in the incident. While both Skripals survived the attack, a woman named Dawn Sturgess died several months later after coming into contact with the poison accidentally.