# France attributes Turla espionage to FSB Center 16

Published: 2026-07-13 · Severity: high · Sectors: government-national, defense, technology
Canonical: https://vorant.io/reports/accc8048-5da4-5647-aedc-467471b11858/france-attributes-turla-espionage-to-fsb-center-16

> ANSSI and the French government formally attribute long-running Turla cyberespionage against French ministries and strategic sectors to Russia's FSB Center 16.

ANSSI's C4 crisis coordination center reports the targeting and compromise of French entities via the Turla attack mode of operation, attributed to the 16th Center of Russia's FSB. The campaign has operated since at least 2004, conducting intelligence-collection operations against strategic entities and individuals worldwide, including France. French victims span ministries, diplomatic, defense, justice, and technology sectors.

The activity is linked to a broader Turla espionage effort against Ukraine, NATO members, and EU states that has intensified alongside Russia's invasion of Ukraine since February 2022. On 13 July 2026, France's Ministry for Europe and Foreign Affairs and the EU's High Representative for Foreign Affairs and Security Policy issued formal joint attribution statements condemning these cyber-malicious activities as state-sponsored espionage by Russia's FSB.

This is a high-confidence government attribution accompanied by diplomatic action, signaling a coordinated France-EU response to sustained Russian state cyberespionage targeting critical government and strategic sectors.

## Mentioned in this report

- Threat actors: Turla
- Campaigns: Turla

Source reporting: https://www.cert.ssi.gouv.fr/cti/CERTFR-2026-CTI-004

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/accc8048-5da4-5647-aedc-467471b11858/france-attributes-turla-espionage-to-fsb-center-16.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup