ROMANIA · CYBER ATTRIBUTION
Romania’s Foreign Ministry says the FSB 16th Centre-controlled group conducted hostile cyber activity against the country. It does not publish the targets, date, method or effects. On the same day, the European Union and the United Kingdom exposed mechanisms through which Russian intelligence services expand their capacity: private companies, university recruitment, credentials stolen by criminal malware and ostensibly autonomous groups.
The attributions and relationships presented here are governmental findings and sanctions reasons published on 13 July 2026; they are not judicial determinations.
Open the dossierTHE ROMANIA FILE
The Romanian statement places the country inside the Turla campaign and describes possible objectives of the wider Russian ecosystem, from sensitive-data exfiltration to disruption of critical infrastructure. It does not say what happened in Romania. The gap between attribution and incident transparency is the immediate public-interest issue.
INCIDENT FILE · ROMANIA
No Romanian institutions, companies, sectors or individuals are identified.
No entry date, dwell time or discovery date is provided.
No vulnerabilities, access vectors, infrastructure or technical indicators are published.
It is unknown whether data was taken, systems were affected or services were disrupted.
CAPACITY ARCHITECTURE
The public documents describe interfaces between intelligence services, companies, criminals and threat groups. Each pathway produces something different: personnel, access or the ability to operate through intermediaries.
Choose a pathway
These are parallel pathways. The published material does not establish that IMPULS recruitment, Lumma exploitation and FSB 16th Centre operations belonged to one command chain.
A company formally separate from the state turns universities into a recruitment pool for a GRU unit.
Officers fund and coordinate capability expansion.
Operational cover, infrastructure, payments and links to external networks.
The pool from which hackers and cyber specialists are recruited.
Recruits working under experienced handlers.
Additional capacity and operations whose state connection is obscured behind a company.
NINE STATES, DIFFERENT RESOLUTION
The EU statement lists nine states targeted by the FSB’s 16th Centre. It provides examples for France, Germany and Poland. For the other six, including Romania, it publishes only the names. Romania’s national statement adds confirmation of Turla activity without operational detail.
Espionage against government entities since 2010; defence industry in 2025.
Government entities targeted.
Disruptive sabotage against critical infrastructure, including combined heat and power.
No operational example in the EU statement.
No operational example in the EU statement.
No operational example in the EU statement.
No operational example in the EU statement.
The Foreign Ministry confirms hostile Turla activity; target, date, method and effect remain undisclosed.
No operational example in the EU statement.
THE WORDING TEST
The United Kingdom and CERT Polska describe the same attempted sabotage of 29 December 2025 with different emphases. Read together, they show what happened and which calculation remains unpublished.
The British government says the failed attack could have left 500,000 citizens without electricity in the depths of winter.
CERT Polska says the combined heat and power plant supplied heat to almost half a million customers. The attempt to disrupt heat failed, while attacks on renewable sites did not stop electricity production.
SANCTIONS REGISTER
The UK and EU lists overlap. A name-by-name comparison finds eight shared designations and 29 distinct targets. The EU total of 13 comes from two legal acts: eight people and four entities under the cyber-attacks regime, plus Ivan Kasyanenko under the destabilising-activities regime.
THE PUBLIC EVIDENCE CHAIN
The 13 July package provides a more detailed picture than an APT label. Each layer adds precision, while the underlying intelligence material remains classified.
The EU and United Kingdom publish coordinated attributions; NATO takes note of them and condemns Russia’s cyber activity.
The FSB 16th Centre, GRU units and senior figures appear in official documents.
IMPULS, Lumma developers, hackers and influence networks are tied to concrete functions.
University recruitment, reuse of stolen credentials and attempted energy sabotage.
Intelligence reports, complete indicators, victim files and some impact calculations are not published.
TERMS
A cluster tracked over time through behaviour, infrastructure and tooling. The label does not always denote one stable team.
Malware that extracts passwords, cookies, crypto wallets and other data from a compromised device.
A person or organisation used for capability, access or cover without formally appearing as part of the state.
SOURCES AND STATUS
Ministerul Afacerilor Externe al României
Confirmation that Romania was targeted by hostile APT Turla activity and description of the state and non-state ecosystem.
13 iulie 2026
Consiliul Uniunii Europene
Attribution to the FSB 16th Centre, the list of nine states and the EU political sanctions total.
13 July 2026
Foreign, Commonwealth & Development Office
The 24 UK designations, reuse of Lumma credentials, the 2,100-victim figure and the Poland estimate.
13 July 2026
Guvernul Regatului Unit
IMPULS’s role, recruitment from universities and publicly identified officers and recruits.
updated 13 July 2026
Jurnalul Oficial al Uniunii Europene
Eight people and four entities, with listing reasons for IMPULS, Lumma, hosting infrastructure and hacktivist groups.
13 July 2026
Jurnalul Oficial al Uniunii Europene
The separate listing of Ivan Kasyanenko under the destabilising-activities regime.
13 July 2026
CERT Polska
Technical description of attacks on renewable sites, a manufacturing company and a combined heat and power plant.
30 January 2026
Consiliul Nord-Atlantic
Allied condemnation, solidarity with affected states and NATO’s acknowledgement of the UK and EU statements.
13 July 2026
AGERPRES, pe baza informațiilor MAE
Romania’s separate sanctions proposal and its unfinished procedural status.
13 iulie 2026
This dossier synthesises official statements, sanctions instruments and a technical incident report. Listing reasons describe findings by competent authorities and are not judicial determinations. The total of 29 distinct targets results from matching the UK and EU public lists by name. PEOPLE, ACCESS and INTERMEDIARIES are editorial labels organising mechanisms presented separately in the sources.