Beyond Fact-Checking: How the EU is Targeting Russian Cyber Infrastructure and Hybrid Threats

That shift is already visible in practice. On July 13, the Council of the EU sanctioned nine Russian nationals and four companies connected to state-sponsored cyber operations against European critical infrastructure. The targets included hosting and infrastructure providers, malware developers and individuals linked to Russian military intelligence networks. Separately, Europol and Eurojust have helped dismantle networks associated with pro-Russian hacker groups, while European institutions have investigated attacks against transport, energy and digital infrastructure.

The language has changed because the threat has changed.

The battlefield is no longer divided into “cyber” and “information”

For years, Western governments often treated disinformation as a communications problem. The response was familiar: fact-checking, public awareness campaigns, media literacy and counter-messaging.

Those tools remain useful. They are also insufficient.

A hostile operation that spreads a fabricated story about an election and an operation that attacks a water utility may appear to belong to different categories. In practice, both can serve the same strategic purpose: weaken public trust, create political pressure and make democratic institutions appear incapable of protecting their citizens.

The Russian model has increasingly blurred those boundaries. Cyberattacks against critical infrastructure can generate fear and political disruption. Information operations can amplify the consequences of a technical attack. A fabricated narrative can create the conditions for social polarisation before a political crisis, while a cyberattack can give that narrative emotional force afterwards.

The distinction between the two is therefore becoming less useful to security planners.

The EU’s response is beginning to reflect that reality. Strategic communications, cybersecurity, intelligence and foreign policy are being drawn into a common architecture. The Rapid Alert System is intended to facilitate the exchange of information on both cyber and foreign information threats. Analytical methods are being standardised across EU member states and with partners including the G7 and NATO. Specialised training is being developed for defence and security personnel.

This is not simply a larger communications department.

It is the gradual construction of a cognitive defence system.

Why sanctions are moving closer to the infrastructure

The July 13 measures are significant because they target more than visible hackers.

Among those sanctioned were Media Land LLC and its owner Alexander Volosovik, NL Cloud and LLC “Impuls”, as well as developers associated with LummaC2, Trickbot and Conti ransomware. The list reaches into the infrastructure that allows malicious operations to function.

That matters because the modern cyber ecosystem depends on layers of commercial technology. Attackers require servers, hosting, malware development, distribution networks and financial channels. The people carrying out an operation may be difficult to identify, replaceable or operating under aliases. The infrastructure supporting them is often more vulnerable to legal and financial pressure.

Sanctioning a hosting company does not eliminate a state's cyber capability. It does, however, increase the cost and complexity of maintaining it.

The same logic applies to proxy hacker groups. Z-Pentest, associated with the Cyber Army of Russia Reborn and Russian military intelligence, has been linked to attacks on critical infrastructure, including a December 2024 attack against a Danish water supply company. NoName057(16), another pro-Russian network, repeatedly targeted European transport and energy sectors.

The significance of such groups lies partly in the ambiguity they create. States can operate through networks that appear criminal, ideological or loosely organised. The result is a form of deniability that complicates conventional deterrence.

The European response is increasingly designed to remove that ambiguity by following the infrastructure rather than waiting for a perfect public confession.

The GRU's advantage has been the space between institutions

One of Russia's strengths in hybrid operations has been the ability to exploit the gaps between national systems.

A cyber investigation may begin in one country. The infrastructure may be located in another. The operator may be connected to a military intelligence service. The victim may be a private company. The political consequences may emerge somewhere else entirely.

Traditional bureaucracies are not designed for this kind of operation. Police, intelligence services, foreign ministries and election authorities often have different mandates, legal standards and information channels.

That is why the growing role of Europol, Eurojust and CERT-EU matters more than any individual sanction.

The emerging model is based on shortening the distance between detection, attribution and action. A hostile network identified by technical investigators can become the subject of a cross-border criminal investigation. Evidence can support sanctions. Financial restrictions can be imposed on the companies providing infrastructure. Diplomatic institutions can warn partners and coordinate public communication.

The process remains legally complicated. It is also slower than the adversary would prefer.

But the architecture is beginning to resemble the threat itself: networked rather than compartmentalised.

The democratic line is disruption, not control of thought

The EU's move toward offensive countermeasures inevitably raises a difficult question. If democracies begin to dismantle information networks, sanction media organisations and block hostile infrastructure, how do they avoid becoming versions of the regimes they oppose?

The answer cannot be that every intervention is automatically legitimate because it is directed against Russia.

The distinction has to be institutional and legal. Democratic countermeasures are supposed to target identifiable foreign interference, covert operations, cyber infrastructure and actors engaged in hostile activity. They must be subject to legal procedures, attribution standards and political scrutiny.

That is fundamentally different from an authoritarian state controlling the information space to eliminate domestic dissent.

The difference is not cosmetic. It is the strategic advantage democracies are trying to preserve.

France's Viginum model and public attribution initiatives such as the “French Response” accounts represent one approach: expose and attribute foreign manipulation rather than secretly manufacture an alternative reality. The European media sector is developing its own response. The European Alliance of News Agencies has an anti-disinformation committee, chaired since 2024 by Ukrinform Director General Serhiy Cherevaty, and has already suspended TASS while campaigning for its permanent expulsion.

The institutional challenge is to defend an open information environment without pretending that openness requires passivity.

Ukraine and the eastern flank have been warning Europe for years

For Ukraine, this transformation is not theoretical.

The country has spent years dealing with Russian narratives that changed according to the political environment. The 2014 invasion was framed as an internal Ukrainian conflict. After 2022, the war was recast as an existential confrontation supposedly forced upon Russia by the West. Elsewhere, Moscow has adapted its messages to local political environments, seeking to weaken transatlantic unity in Europe while using anti-colonial language in parts of the Global South.

The targets have not been limited to Ukraine. Russian influence operations have been linked to campaigns surrounding the Paris Olympic and Paralympic Games, elections in Moldova and Romania, German farmer protests and conflicts in the Middle East.

Frontline states have consequently become laboratories for the broader European response.

Ukraine has developed its own international communication initiatives, including the Ukrainian Communication Group in Warsaw, while Romanian officials have been part of the emerging regional conversation about strategic communication. The experience of countries exposed to Russian operations gives them a practical understanding of the problem that Western institutions often acquired only after an attack had already occurred.

The irony is that the states most frequently described as vulnerable are increasingly helping define the defence system.

The money problem will not disappear

There is a more uncomfortable reality behind the new strategy: the EU is trying to confront an industrial operation with far fewer resources.

Russia spends more than €1 billion annually on state-controlled propaganda outlets alone, excluding covert intelligence and influence budgets. European strategic communications resources are estimated to be at least a hundred times smaller.

No institutional reform can erase that disparity overnight.

The European answer, therefore, cannot simply be to produce more content. It has to make the adversary's infrastructure more expensive, less reliable and more exposed. That is the logic behind sanctions, takedowns, legal cooperation and the targeting of commercial enablers.

A smaller budget can sometimes be offset by better coordination.

But only up to a point.

The EU's broader sanctions campaign is already placing growing economic pressure on Russia and increasing its dependence on China. The more difficult it becomes for Russian operators to access Western financial systems, hosting infrastructure and commercial technology, the more expensive the hybrid apparatus becomes to maintain.

That does not mean the operations will stop. It may mean they become more decentralised, more criminalised and harder to attribute.

Europe is beginning to treat the information space as territory

The deepest change is conceptual.

For much of the digital era, Western governments behaved as though information space was fundamentally civilian and cybersecurity was primarily a technical matter. The war in Ukraine has made that separation increasingly impossible to sustain.

A water network can be attacked through cyberspace. An election can be influenced through covert digital operations. A media ecosystem can be manipulated by state-controlled outlets and proxy networks. A cloud platform hosting European institutions can become a target even when its internal systems remain uncompromised.

These are different operations. They belong to the same strategic environment.

The EU's move toward offensive disruption is an admission that defending that environment requires more than telling citizens which claims are false. It requires making hostile operations harder to launch in the first place.

That is a far more consequential undertaking than fact-checking.