France directly accuses Russia of decade-long cyber sabotage campaign

Cyberattack

France has formally accused Russia of orchestrating a decade-long campaign of cyberattacks aimed at destabilising French institutions and sowing public discord. In a statement issued Tuesday, the French Foreign Ministry attributed a series of major incidents—including the 2015 fake Islamic State television broadcast hijack and the 2017 Macron email leaks—to APT28, a cyber-espionage group linked to Russia’s military intelligence agency, the GRU.

APT28, also known as Fancy Bear, is notorious for its role in the 2016 US election interference. According to French officials, the group deployed the same disruptive tactics in France, including leaking Emmanuel Macron’s campaign emails just before the 2017 election to influence public opinion. The television broadcast hijack, which came shortly after the Bataclan terror attacks, was allegedly intended to incite national panic by faking an ISIS takeover.

President Emmanuel Macron, speaking the day before the announcement, said France and its allies, including the US under Donald Trump, would apply more pressure on Russia in the coming days. He also revealed plans for a new friendship treaty with Poland focused on fighting election interference and coordinated disinformation campaigns.

This is the first time France has publicly pointed the finger at a foreign intelligence agency for a cyberattack—a move that signals a shift in diplomatic posture amid heightened tensions over Russia’s war in Ukraine. With no sign of Russian President Vladimir Putin backing down from occupied Ukrainian territory, EU countries increasingly see Russian cyberwarfare as a pressing threat to their national and electoral security.

The French government claims the GRU significantly escalated its attacks in 2021, targeting entities across finance, defense, aerospace, media, and organisations tied to the 2024 Paris Olympics. France also disclosed the geographical location of one APT28 unit, underscoring its ability to trace Russian cyber incursions and counteract them.