France Attributes Major Cyberespionage Campaign to Russia

France’s Cyber Crisis Coordination Centre (C4) has formally blamed Turla, a group linked to Russia’s FSB, for several attacks targeting sensitive French organisations, including government ministries, since 2014.

On 13 July 2026, the Cyber Crisis Coordination Centre (C4), which brings together ANSSI, COMCYBER, the DGA, the DGSE and the DGSI, formally attributed to Russia a series of cyberespionage operations conducted since 2014 against sensitive French institutions. The statement specifically points to Turla, a group linked to the FSB’s 16th Centre, part of the Russian Federation’s domestic intelligence service.

Active since at least 2004, Turla is also known as Secret Blizzard, Venomous Bear and Waterbug. According to the C4, the FSB’s 16th Centre, also referred to as Military Unit 71330, operates eleven interception centres across Russia. One of them, Unit 61240, located near Saint Petersburg, is reportedly responsible for targeting France.

According to the C4, between 2014 and 2025 Turla targeted several French ministries, the French Embassy in Moscow and a technology company. These activities have been the subject of two formal attribution statements: one issued by the Minister for Europe and Foreign Affairs on behalf of France, and the other by the European Union’s High Representative on behalf of the EU Member States.

The announcement reflects a shift in Western diplomatic doctrine, with governments now increasingly willing to publicly attribute cyber operations to foreign states.