The French Foreign Ministry on April 29 accused Russia's military intelligence (GRU) of escalating cyberattacks against French ministries, defense firms, and think tanks since 2021, in order to destabilize the country
France has brought charges against the GRU's APT28 unit — also known as 'Fancy Bear' — based in Rostov-on-Don in southern Russia, the ministry said in a statement. These charges are not the first by a Western nation, but it is the first time France has accused Russia, relying on its own intelligence.
According to a report by the French National Cybersecurity Agency (ANSSI), the last APT28 attack was carried out in December, and in 2024, about 4,000 cyberattacks were attributed to Russian actors, which is 15% more than in 2023.
The agency added that in 2024, the number of attacks on French ministries, local administrations, defense companies, aerospace firms, think tanks, and organizations in the financial and economic sector increased sharply.
APT28 attempted to obtain strategic intelligence from organizations across Europe and North America, according to ANSSI.
"These destabilising activities are unacceptable and unworthy of a permanent member of the United Nations Security Council," the foreign ministry said.
"Alongside its partners, France is determined to use all means at its disposal to anticipate, deter, and respond to Russia's malicious behavior in cyberspace."
APT28's first attacks on France were recorded in 2015, when TV5 Monde was taken off the air due to a hacker attack.
The ministry also claimed that APT28 was behind another cyberattack during the 2017 French presidential election, when emails related to the party and campaign of the winner, Emmanuel Macron, were merged and mixed with disinformation.
The French government decided to make this information public to keep the public informed at a time of uncertainty in domestic politics and connection with the Russian war in Ukraine, the ministry's statement read.
Russian hacker groups have engaged in various forms of cyber warfare throughout the full-scale war, including cyberattacks against Ukraine, hacks of civilian infrastructure in Europe, and interference in foreign elections.
Alisa Yurchenko
(Updated: )
