Foreign Secretary David Lammy Unveils Decisive Sanctions Targeting GRU Operations in UK and Abroad
The UK has escalated its cyberdefense strategy by publicly naming and sanctioning 18 Russian intelligence operatives linked to a sweeping array of state-sponsored cyber-attacks and covert influence operations. Foreign Secretary David Lammy announced the move on Friday, describing it as part of a broader push to protect British infrastructure, institutions, and citizens from Russia’s escalating hybrid warfare campaign.
Among the most chilling revelations: two of the sanctioned spies were directly involved in planting spyware on a device used by Yulia Skripal, years before the 2018 novichok poisoning that nearly killed her and her father, ex-Russian agent Sergei Skripal, in Salisbury.
Lammy stated the decision was not only about deterrence but transparency:
“GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty, and threaten the safety of British citizens. The Kremlin should be in no doubt — we see what they’re doing in the shadows and we will not tolerate it.”
Hacking, Poison, and Propaganda: The Web of Russian Operations
X-Agent Spyware and the Salisbury Connection
The espionage operation that has drawn international focus involved X-Agent, a sophisticated spyware program linked to Fancy Bear, a notorious hacking collective with ties to Russia’s GRU Unit 26165. This unit has now been specifically targeted with UK sanctions.
Lammy confirmed the spyware had been planted on a device used by Yulia Skripal in 2013, five years before the high-profile chemical weapon attack in Salisbury, which the UK previously attributed to Russian state actors. While the Skripals narrowly survived, the attack had fatal consequences for British citizen Dawn Sturgess, who died after being exposed to the nerve agent from a discarded perfume bottle.
From Salisbury to Mariupol: GRU’s Global Campaign
In addition to the UK-targeted operations, the GRU operatives are also believed to have played a role in coordinating cyber and ground intelligence for the bombing of the Mariupol theatre in Ukraine, where hundreds of civilians — including children — were killed.
The GRU’s broader cyber campaign has allegedly targeted:
-
UK media organizations
-
Telecom infrastructure
-
Political and democratic institutions
-
Critical national energy systems
“This is not just about cyber espionage,” said Lammy. “It’s about deliberate destabilisation, disinformation, and, in some cases, facilitating war crimes.”
Sanctions Strategy Evolves: From Politicians to Spies
Asset Freezes and Travel Bans Hit Kremlin’s Secret Army
In a strategic evolution from earlier rounds of sanctions focused primarily on Russian politicians and oligarchs, the UK is now directly targeting intelligence operatives and covert cyber units.
The 18 spies named in this round will face:
-
Asset freezes in the UK and partner jurisdictions
-
Travel bans preventing entry into the UK or use of UK-linked transit systems
-
Public exposure, increasing operational risk for Russian intelligence networks
The African Initiative: Kremlin Disinformation in West Africa
Beyond the cyber threat, the UK is also imposing sanctions on a Russian-linked entity called the African Initiative, accused of spreading disinformation about health in West African nations. British officials suggest this is part of a Kremlin tactic to destabilize regions vulnerable to public health crises, furthering Russia’s global influence by sowing chaos and undermining trust in institutions.
Economic Warfare: Russia’s War Chest Under Siege
$450 Billion in Russian War Funds Frozen or Blocked
The Foreign Office estimates that since the start of the full-scale invasion of Ukraine in February 2022, the UK and its allies have choked off at least $450 billion (£340bn) in Russian state funds through a combination of sanctions, export controls, and asset seizures.
In a statement referencing President Trump’s proposed ceasefire and Ukrainian President Zelenskyy’s endorsement of the plan, Lammy said:
“Putin refuses to comply with international pressure. This aggressive cyber campaign shows he is doubling down on asymmetric warfare. We are matching that escalation with decisive, defensive action.”
Lammy also reiterated that the post-Cold War era is over:
“The age of naivety is finished. We’re dealing with a mafia state that exports instability as a political weapon. Keeping the British people safe means confronting that reality with clarity and resolve.”
Implications for Business, Defense, and Civil Society
What CEOs and Leaders Should Know
With the UK now clearly naming and sanctioning individual foreign intelligence agents, this signals a new phase in global cyber policy — one where national defense is no longer confined to soldiers and missiles, but includes data, infrastructure, and public trust.
Key takeaways for business leaders and policymakers:
-
Cybersecurity is now national security: Corporate networks are potential targets and should be hardened accordingly.
-
Sanctioned entities can appear as suppliers, investors, or partners: Perform thorough due diligence.
-
Public-private coordination is key: The UK government is increasingly sharing threat intelligence with tech firms, energy companies, and media outlets.
-
The legal landscape is evolving: Direct naming of foreign spies sets precedent for international cooperation and legal retaliation.
“Ironclad” Support for Ukraine and Europe
David Lammy concluded his announcement by affirming the UK’s “ironclad” support for Ukraine and European stability, doubling down on Britain’s place as a bulwark against Russian aggression.
“Putin’s hybrid threats and aggression will never break our resolve. The UK and our allies stand united — for freedom, for democracy, and for the security of every citizen on this continent.”
As the Kremlin’s covert operatives are dragged into the light, Britain’s message is clear: The shadows are shrinking, and Moscow’s silent war will not go unanswered.