France directly calls out Russian military intelligence hackers
The government of France has formally called out Russia for using military cyber units to meddle in French elections and conduct cyberattacks against the country.
Image by Getty Images/Sean Gallup.
The government of France has formally called out Russia for using military cyber units to meddle in French elections and conduct cyberattacks against the country.
A statement, a slick video, and a detailed report – with a trio of announcements, France has finally done what it never chose to do in the past.
It directly accused Russian military intelligence (GRU) of carrying out an intricate cyberattack on Emmanuel Macron’s first presidential campaign in 2017 (known as "Macron leaks”) and of several other infamous hacks in recent years.
According to French authorities, a GRU hacking group known as APT28 (Fancy Bear) hacked broadcaster TV5 in 2015 and tried to disrupt the 2024 Olympic and Paralympic Games in Paris.
“These destabilizing activities are unacceptable and unworthy of a permanent member of the UN Security Council. They are also contrary to the United Nations standards on the responsible behaviour of states in cyberspace, to which Russia has subscribed,” the Foreign Ministry said in a statement.
The ministry also posted a fancy explanatory video on social media, with the country’s head of diplomacy, Jean-Noël Barrot, stating that the GRU has targeted around 10 French entities since 2021.
Le service de renseignement militaire russe (GRU) déploie depuis plusieurs années contre la France un mode opératoire cyber-offensif appelé APT28. Il a ciblé une dizaine d’entités françaises depuis 2021.
undefined Jean-Noël Barrot (@jnbarrot) April 29, 2025
Dans le cyberespace, la France observe, bloque et combat ses adversaires. pic.twitter.com/9NUdyG9hxa
Finally, Paris has detailed these intrusions in a report (PDF) by ANSSI, the French cybersecurity agency, and its partners at the Cyber Crisis Coordination Center.
“From the reconnaissance phase to the exfiltration of data, operators of the APT28 intrusion set heavily rely on low-cost and ready-to-use outsourced infrastructure. Such infrastructure may be made up of rented servers, free hosting services, VPN services, and temporary e-mail address creation services,” reads the thorough report.
“The use of such services provides greater flexibility in the creation and administration of new resources, and enhances stealth.”
APT28 has been accused of carrying out dozens of cyberattacks around the world, including on the 2016 US election, where it was accused of aiding Donald Trump, as well as hacking email accounts belonging to Chancellor Olaf Scholz's Social Democratic Party in 2022 and 2023.
Various Western governments have in recent years called out the GRU for “unacceptable” cyber meddling. In May 2024, Germany summoned the Russian envoy over APT28’s cyberespionage campaign.
However, this is the first time the French government has directly thrown accusations against a Russian military entity.
One can only speculate why the policy has suddenly changed, but France has been trying to play the leader of liberal democracies now that the Trump administration is pulling the US out of international politics.