The UK has sanctioned Russian military intelligence units and officers that it said were behind preparations for a 2022 bomb attack on a theatre in southern Ukraine that killed hundreds of civilians.
Britain’s foreign ministry said it sanctioned 18 officers working for Russian military intelligence, known as the GRU, along with three units.
Hundreds feared trapped in Ukraine theatre
It said the officers were also accused of targeting the family of a former Russian spy who was later poisoned in the UK with a nerve agent.
More than 70 different attacks since 2022 have been attributed to Russia by Western officials, who said the goal was to sow chaos across Europe, undermine European societies, and erode support for Ukraine.
The Associated Press has tracked the alleged sabotage and disruption, ranging from cyber attacks and propaganda to arson and attempted assassination.
Britain’s Foreign, Commonwealth and Development Office said part of that campaign likely included accessing CCTV cameras near military facilities, ports, train stations, and border crossings in Ukraine, Moldova, and 11 NATO countries — including in the US — to track foreign aid shipments to Ukraine.
“GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens,” UK Foreign Secretary David Lammy said.
Unit that attacked theatre ‘highly sophisticated’
On March 15, 2022, shortly after Russia invaded Ukraine, Unit 26165 carried out online reconnaissance on civilian bomb shelters in Mariupol, southern Ukraine, and in Kharkiv in eastern Ukraine, the FCDO said.
One of the targets was the Mariupol theatre, where civilians sheltering from Russian bombs had painted the word “children” on the exterior, in the hope of sparing them.
The next day, the theatre was hit by Russian air strikes that killed many people, including children, according to an Associated Press investigation.
Loading…
Ukrainian officials said as many as 300 people may have been killed in the bombing.
In 2013, officers from the same unit used malware to target email accounts belonging to the daughter of former Russian spy Sergei Skripal, the foreign ministry said.
In 2018, Skripal and his daughter Yulia were poisoned with the nerve agent Novichok in the English city of Salisbury, in an attack the British government said was organised by Russian intelligence.
The FCDO said Unit 26165 was a “highly sophisticated, well-established cyber actor which conducts both advanced intelligence gathering and hack-and-leak operations” that target Ukraine, European, and NATO nations.
It said Unit 26165 was likely behind operations to target organisations in the UK, Netherlands, and Switzerland investigating the poisoning of the Skripals in 2018.
Another unit — Unit 74455 — also attempted to disrupt investigations into the attack on the Skripals in 2018 by attempting cyber intrusions on the British foreign ministry and the UK’s Defence, Science and Technology laboratory, the ministry said.
Locals fear Mariupol will never recover
Unit 26165 has been conducting cyber operations against the West for at least a decade, and the ministry said it was also likely behind the hack on the Democratic National Committee and Democratic Congressional Campaign Committee in the US in 2016, on French President Emmanuel Macron’s election campaign in 2017, and on the 2024 Paris Olympic Games.
The UK’s National Cyber Security Center said the GRU was also behind malware specifically designed to enable access to Microsoft user accounts hosted in the cloud.
Friday’s sanctions also targeted African Initiative, which the foreign ministry said employed Russian intelligence officers to carry out information operations in Africa, including undermining public health programs and destabilising various countries.
Although targeting GRU officers with sanctions was likely to have limited effect, the foreign ministry said the goal was to raise awareness of Russia’s campaign and raise the cost to individuals working for its services, including making it harder for them to travel.
The FCDO gave no details, but its sanctions normally involve asset freezes and travel bans.