UK and EU designate 24 Russian cyber and information-operations targets under sanctions
UK financial institutions must screen and block the 24 newly designated Russian cyber and information-operations targets, freeze their UK assets, and avoid facilitating any ransomware payment to them
Change
On 13 July 2026 the UK and EU designated 24 individuals and entities behind Russian cyber and hybrid operations — the first joint UK-EU cyber sanctions package — including GRU leaders Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko, the company IMPULS, Lumma Stealer operators, and 10 people behind the media company Rybar LLC. The targets are added to the UK Sanctions List with asset freezes and dealing prohibitions administered by OFSI.
Why it matters
The package consolidates cyber and information-operations designations: GRU unit leadership and the IMPULS recruiting company, the Lumma Stealer credential-harvesting network, and the Rybar LLC media operation used for election interference in Moldova and Armenia. All are added to the UK Sanctions List, freezing UK-jurisdiction assets and prohibiting dealings by UK persons. A distinct compliance exposure runs through ransomware: making or facilitating a payment to any designated party carries civil or criminal penalties, so incident-response and ransom-payment decisioning must screen against the new listings, not only routine payment flows.
Implications
- — Sanctions-screening teams at UK banks, payment providers and their correspondent-banking functions must add all 24 designated individuals and entities — including Vyacheslav Stafeyev, Ivan Senin, Ivan Kasyanenko, IMPULS, the Lumma Stealer operators and the 10 Rybar LLC individuals — to name-and-identifier filters before the next funds-transfer cycle, and block or reject matching transactions, since dealing with a designated person breaches UK sanctions on a strict basis.
- — Firms must freeze any UK-jurisdiction funds or economic resources held for the designated parties and refrain from making funds or resources available to them, reporting to OFSI as required — the asset freeze takes effect on listing and applies regardless of transaction size.
- — Incident-response, cyber-insurance and ransom-decisioning teams must screen any prospective ransomware payment against the updated UK Sanctions List, because making or facilitating a payment to a designated person (including via Lumma Stealer-linked or other listed actors) exposes those involved to civil or criminal penalties under OFSI's sanctions-and-ransomware guidance.
Who is affected
- — Sanctions-screening and correspondent-banking teams at UK financial institutions and payment providers
- — Compliance and financial-crime functions responsible for UK Sanctions List screening
- — Incident-response, cyber-insurance and ransom-payment decisioning teams exposed to ransomware payments
What to watch
- — Effective: 13 July 2026 — the designations apply on listing; UK assets are frozen and dealing prohibitions and ransomware-payment exposure are in force from this date.