France has publicly accused Russia’s GRU military intelligence agency of orchestrating a series of cyber attacks on government ministries, defence contractors, think tanks, and other institutions since 2021, in what it described as a campaign to destabilise the country.
In a statement issued Tuesday, France’s foreign ministry identified the culprit as GRU unit APT28, a hacking group based in Rostov-on-Don, southern Russia. While Western nations have previously linked APT28 to Russian state actors, this marks the first time Paris has explicitly named the Russian government based on its own intelligence findings.
“These destabilising activities are unacceptable and unworthy of a permanent member of the United Nations Security Council,” the ministry said. “Alongside its partners, France is determined to use all means at its disposal to anticipate, deter, and respond to Russia’s malicious behaviour in cyberspace.”
According to France’s National Cybersecurity Agency (ANSSI), APT28—active globally since at least 2004—has targeted strategic sectors across Europe and North America in cyberespionage operations.
The group is also blamed for historic attacks in France, including the 2015 TV5 Monde hack and the 2017 presidential election interference, during which emails linked to Emmanuel Macron’s campaign were leaked and circulated with disinformation.
ANSSI reported a sharp rise in cyber attacks by Russian actors in 2024, with around 4,000 incidents logged—a 15% increase from the previous year. Targets have included French ministries, local authorities, aerospace and defence companies, and entities in the financial sector. The most recent attack attributed to APT28 occurred in December.
French officials said the decision to go public was intended to inform the public amid ongoing political uncertainty at home and rising tensions surrounding Russia’s war in Ukraine.
The accusation follows similar claims from Germany in May 2024, when Berlin accused APT28 of targeting its defence and aerospace sectors. At the time, Russia’s embassy in Berlin dismissed the allegations as an “unfriendly step” aimed at stirring anti-Russian sentiment.
