On Tuesday, France's foreign ministry publicly accused Russia's GRU military intelligence agency of carrying out cyberattacks against multiple French entities, including ministries, defence companies, and think tanks, since 2021, to destabilise France. The ministry pointed to the GRU unit APT28, which is believed to be based in Rostov-on-Don, Russia. While other Western countries have made similar accusations before, this is the first time France has directly blamed the Russian state based on its own intelligence. The ministry also noted that APT28's cyberattacks on France date back to 2015, when the TV station TV5 Monde was hacked and taken offline, a cyberattack that suspected Islamic State militants initially claimed.

France has blamed APT28 for the recent cyberattack and a previous incident during the 2017 presidential election when Emmanuel Macron's campaign emails were leaked and paired with false information. A report by France’s national cybersecurity agency, ANSSI, stated that APT28 has been trying to gather strategic intelligence from organisations across Europe and North America. Officials said they chose to make this information public to maintain transparency amid ongoing political uncertainty and Russia’s invasion of Ukraine. The Russian embassy in Paris has not commented on the matter.

According to ANSSI, there was a noticeable rise last year in cyberattacks targeting French government bodies, local authorities, defence and aerospace companies, think tanks, and financial institutions. The agency reported that the most recent attack by APT28 occurred in December. In 2024, around 4,000 cyber incidents have been linked to Russian groups, marking a 15% increase compared to the previous year in 2023.

“These destabilising activities are unacceptable and unworthy of a permanent member of the United Nations Security Council,” the foreign ministry voiced. Added, “Alongside its partners, France is determined to use all means at its disposal to anticipate, deter and respond to Russia’s malicious behaviour in cyberspace.”

Cybersecurity experts say APT28 has been conducting cyberespionage operations globally since at least 2004. In May 2024, Germany alleged that the group targeted its defence sector, aerospace companies, the ruling political party, and similar entities in other nations with cyber attacks. During the time, the Russian embassy in Berlin described the allegations as “another unfriendly step aimed at inciting anti-Russian sentiments in Germany.”