Finland has summoned Russia’s ambassador after European governments accused Russian intelligence services of directing a cyber campaign against state institutions, companies and critical infrastructure across the continent.
Foreign Minister Elina Valtonen announced the diplomatic action on Monday as the European Union and Britain imposed coordinated sanctions on Russian officers, companies and alleged cybercriminals.
“Finland condemns Russia’s malicious cyber activity and the misuse of the cyber environment,” Valtonen wrote on X.
France and Germany also announced plans to summon Russian ambassadors over the allegations.
The EU said Russia’s Federal Security Service, known as the FSB, had conducted cyber operations against member states and international partners for several years. The bloc linked the activity to espionage, attempts to enter government networks and preparations for attacks on critical services.
Finland, France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia and Romania were among the countries named as targets.
European authorities attributed parts of the campaign to the FSB’s Centre 16, a unit Western intelligence services have linked to malware operations and network intrusions.
Finland’s Security and Intelligence Service, Supo, and Finnish military intelligence issued their own warning about Russian cyber espionage on Monday. Supo said Russian intelligence services had spent years mapping weaknesses in Finnish organisations and attempting to exploit security gaps.
The agency said the activity in Finland had focused on foreign and security policy decision-making, critical infrastructure companies, technology firms and organisations connected with support for Ukraine.
Russian operators had also sought information about products and research with possible military or defence use, Supo said.
The Finnish security service assessed that the purpose of the operations ranged from gathering classified information to preparing possible sabotage. It said Russia had not attempted to disable Finnish critical infrastructure through cyber attacks and described such action as unlikely under present conditions.
Supo said attempted cyber espionage remained continuous but had caused limited damage. Security measures adopted by companies and intervention by public authorities had reduced the effect of most incidents.
The EU imposed sanctions on nine people and four entities in response to the campaign. The measures include asset freezes and travel restrictions.
The sanctioned targets include officers linked to Russia’s GRU military intelligence service, alleged cybercrime operators and private companies accused of supporting Russian attempts to destabilise European countries and Ukraine.
Britain added 24 people and organisations to its sanctions list. The British government described the measures as its first joint cyber sanctions package with the EU.
The UK sanctions include senior GRU figures Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko. Britain accused them of directing cyber and hybrid operations.
The British Foreign Office said a cyber branch of GRU Unit 29155 worked with criminal groups and the Russian company IMPULS to recruit hackers and cyber specialists from universities and training institutions.
The UK and EU also attributed an attempted attack on Poland’s energy system during the winter of 2025 to FSB Centre 16.
British officials said the operation failed but risked cutting electricity supplies to as many as 500,000 people during cold weather.
Russia has rejected previous Western allegations that it directs cyber attacks against European states.
UK Foreign Secretary Yvette Cooper said the sanctions targeted networks used by the Russian state to support military and foreign policy aims.
“These sanctions strike at the core of the cybercriminal networks propping up the Russian state’s aggression, and the UK and EU are sending a clear message that Russia cannot hide behind its use of these proxy groups,” Cooper said.
HT