Russia continues expanding cyber terrorism against France
France on Tuesday publicly accused Russia’s military intelligence agency, the GRU, of orchestrating cyberattacks against a dozen French targets over the past decade. These included an organization involved in the 2024 Paris Olympics and President Emmanuel Macron’s 2017 election campaign.
Since 2021, a GRU-affiliated unit has targeted several French entities across the defense, financial, and economic sectors, according to the foreign ministry.
“France strongly condemns the actions of Russia’s military intelligence agency, which has used the APT28 cyber group to carry out multiple attacks against French interests,” the ministry stated.
Foreign Minister Jean-Noël Barrot confirmed the official attribution of these cyberattacks to the GRU for the first time, saying on X (formerly Twitter) that the agency had been conducting operations against France for years using APT28, also known as Fancy Bear.
APT28 has been linked to numerous high-profile cyberattacks around the world, including interference in the 2016 U.S. election, where it leaked emails from the Democratic Party and Hillary Clinton’s campaign.
In France, the group was responsible for hacking Macron’s 2017 presidential campaign, leaking thousands of documents just 24 hours before the vote. “APT28 was behind a large-scale hacking campaign designed to create confusion and manipulate public opinion,” the foreign ministry said in a video shared by Barrot. The effort ultimately failed to influence the outcome, with Macron winning a decisive second-round victory over far-right candidate Marine Le Pen.
The video also noted that since 2021, APT28 has attacked public services, private companies, and at least one organization involved in the upcoming Paris Olympic and Paralympic Games. The media sector remains one of the group’s preferred targets. In 2015, APT28, posing as Islamic State terrorists, hacked the French-language TV channel TV5 Monde in an attempt to incite panic and manipulate public opinion, the ministry said.
APT28’s activities are not limited to France. German and other intelligence services warned in 2024 of the group’s continued cyber operations across NATO countries. France’s foreign ministry stated the group is also attacking its international partners and has intensified efforts against Ukrainian infrastructure since Russia’s invasion in February 2022.
Poland, a strong backer of Ukraine, recently warned of potential Russian interference in its upcoming presidential election on May 18 through cyberattacks and disinformation.
France and Poland are scheduled to sign a “friendship treaty” on May 9—the same day Russian President Vladimir Putin is expected to lead a major military parade in Moscow commemorating the end of World War II.
“Together with its partners, France is committed to using all available means to anticipate, deter, and respond to malicious Russian activity in cyberspace,” the foreign ministry concluded.