UK sanctions Russian intelligence officers who targeted Mariupol theater and family of poisoned spy

LONDON — The U.K. on Friday sanctioned Russian military intelligence units and officers it said were behind preparations for a 2022 bomb attack on a theater in southern Ukraine that killed hundreds of civilians.

Britain's foreign ministry said it sanctioned 18 officers working for Russian military intelligence, known as the GRU, along with three units. It said the officers were also accused of targeting the family of a former Russian spy who was later poisoned in the U.K. with a nerve agent.

More than 70 different attacks since 2022 have been attributed to Russia by Western officials who say the goal is to sow chaos across Europe, undermine European societies and support for Ukraine. The Associated Press has tracked the alleged sabotage and disruption, ranging from cyberattacks and propaganda to arson and attempted assassination.

Britain's Foreign, Commonwealth and Development Office said part of that campaign likely included accessing CCTV cameras near military facilities, ports, train stations and border crossings in Ukraine, Moldova and 11 NATO countries — including in the U.S — to track foreign aid shipments to Ukraine.

''GRU spies are running a campaign to destabilize Europe, undermine Ukraine's sovereignty and threaten the safety of British citizens," U.K. Foreign Secretary David Lammy said.

On March 15, 2022, shortly after Russia invaded Ukraine, Unit 26165 carried out online reconnaissance on civilian bomb shelters in Mariupol, southern Ukraine and in Kharkiv, eastern Ukraine, the FCDO said. One of the targets was the Mariupol theater where civilians sheltering from Russian bombs had painted the word ''children'' outside in the hope of sparing them.

The next day, the theater was hit by Russian airstrikes which killed around 600 people, including many children, according to an Associated Press investigation.

In 2013, officers from the same unit used malware to target email accounts belonging to the daughter of former Russian spy Sergei Skripal, the foreign ministry said. In 2018, Skripal and his daughter Yulia were poisoned with the nerve agent Novichok in the English city of Salisbury, in an attack the British government said was organized by Russian intelligence.

The FCDO said Unit 26165 is a ''highly sophisticated well-established cyber actor which conducts both advanced intelligence gathering and hack and leak operations,'' which target Ukraine, European and NATO nations.

It said Unit 26165 was likely behind operations to target organizations in the U.K, Netherlands and Switzerland investigating the poisoning of the Skripals in 2018.

Another unit — Unit 74455 — also attempted to disrupt investigations into the attack on the Skripals in 2018 by attempting cyber intrusions on the British foreign ministry and the U.K.'s Defense, Science and Technology laboratory, the ministry said.

Unit 26165 has been conducting cyber operations against the West for at least a decade and the ministry said it was also likely behind the hack on the Democratic National Committee and Democratic Congressional Campaign Committee in the U.S in 2016, on French President Emmanuel Macron's election campaign in 2017 and on the 2024 Paris Olympic Games.

The U.K's National Cyber Security Center said Friday that the GRU was also behind malware specifically designed to enable access to Microsoft user accounts hosted in the cloud.

Friday's sanctions also targeted African Initiative, which the foreign ministry said employed Russian intelligence officers to carry out information operations in Africa including undermining public health programs and destabilizing various countries.

Although targeting GRU officers with sanctions is likely to have limited effect, the foreign ministry said the goal is to raise awareness of Russia's campaign and raise the cost to individuals working for its services, including making it harder for them to travel.

The FCDO gave no details but its sanctions normally involve asset freezes and travel bans.