France attributes Turla espionage to FSB Center 16
ANSSI and the French government formally attribute long-running Turla cyberespionage against French ministries and strategic sectors to Russia's FSB Center 16.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
ANSSI's C4 crisis coordination center reports the targeting and compromise of French entities via the Turla attack mode of operation, attributed to the 16th Center of Russia's FSB. The campaign has operated since at least 2004, conducting intelligence-collection operations against strategic entities and individuals worldwide, including France. French victims span ministries, diplomatic, defense, justice, and technology sectors.
The activity is linked to a broader Turla espionage effort against Ukraine, NATO members, and EU states that has intensified alongside Russia's invasion of Ukraine since February 2022. On 13 July 2026, France's Ministry for Europe and Foreign Affairs and the EU's High Representative for Foreign Affairs and Security Policy issued formal joint attribution statements condemning these cyber-malicious activities as state-sponsored espionage by Russia's FSB.
This is a high-confidence government attribution accompanied by diplomatic action, signaling a coordinated France-EU response to sustained Russian state cyberespionage targeting critical government and strategic sectors.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-004
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs