Dozens of Russian spies exposed, UK imposes largest-ever sanctions.
Dozens of Russian spies who targeted Sergei Skripal’s daughter and mounted a series of attacks on Britain have been exposed by the UK’s security services.
Two of the agents were accused of hacking Yulia Skripal’s mobile phone five years before Russia’s GRU military intelligence agency poisoned the pair with deadly Novichok nerve agent on the streets of Salisbury in 2018.
Others were said to be behind a string of covert bombings, arson attacks and damage to infrastructure on British and European soil in an attempt to derail support for Ukraine.
On Friday, the Foreign Office announced that it was sanctioning 18 spies and three GRU units as part of a crackdown on Russian President Vladimir Putin’s campaign to sow chaos on the continent.
The Telegraph understands Britain moved to sanction the Russians because officials were confident they would never travel to the UK for possible apprehension.
This is Britain’s largest-ever set of sanctions against Russian intelligence services.
Ed Bogan, a former CIA agent, told the Telegraph: “Sanctioning these GRU units in particular is crucial, given the depth and breadth of their grey zone operations across numerous countries, which often go unseen or at best, only partially understood. More light on them is needed, but more importantly, more pressure and more action against them.”
British efforts to expose the shadowy operations were supported by the US’s FBI as well as intelligence services from across the Nato military alliance.
Among the operatives named are Ivan Yermakov and Aleksey Lukashev, two senior members of GRU’s Unit 26165 of elite hackers accused of targeting Yulia Skripal’s devices before Moscow’s botched attempt to murder her father.
Authorities are keen to stress that cyber attacks not only disrupt key infrastructure but can also be used to facilitate physical attacks, such as the failed assassination attempt on Sergei Skripal.
The former Russian spy and his daughter were poisoned in one of the most brazen uses of chemical weapons on British soil in March 2018.
There remain concerns about the safety of the Skripals, although it is not thought Friday’s disclosures are linked to any renewed imminent threat to their lives.
British authorities later attributed the assassination attempts, using one of the deadliest man-made chemicals, to Russia’s military intelligence.
Yermakov and Lukashev also feature on an FBI wanted list for their alleged roles in interfering with the 2016 US presidential election, won by Donald Trump.
Unit 26165 has also been named in investigations into alleged hacks around the French presidential elections and political interference in Germany. It was responsible for the creation of “X-Agent”, a malware used to hack Yulia Skripal’s mobile phone.
The GRU intelligence officers targeted her phone with “malicious” malware known as X-Agent in 2013, five years before the assassination attempts in which an innocent British woman, Dawn Sturgess, was killed after she was poisoned with Novichok discarded by the GRU officers sent to kill Skripal.
X-Agent was developed by a Russian hacking gang known as Fancy Bear, which is linked to the GRU. It was first discovered by the West in 2015 and is used by Russia to infect Apple’s iPhones and Android devices and can activate a device’s microphone and record audio as well as harvest text messages, contact lists, photos and geolocation data.
X-Agent has been used by Russia to pinpoint the movements of Ukrainian troops on the battlefield. Yulia Skripal, who lived in Moscow, was tracked to Britain on a visit to her father in Salisbury. Two GRU agents followed her to Britain and smeared Sergei Skripal’s door handle with Novichok, a military-grade nerve agent.
British officials are confident the country’s voters would not be swayed by similar Russian disinformation attempts.
In 2022, their same unit was said to be responsible for conducting online reconnaissance to help position Russian strikes against the Mariupol theatre in Ukraine, killing hundreds of women and children who were sheltering from Putin’s invasion forces.
Outside the building in the port city, those sheltering had written the word “children” in giant Russian lettering. The theatre was later hit by Russian missiles, despite it obviously not being a military target.
The same unit was credited with hacking internet surveillance cameras between 2022 and 2024 across Bulgaria, France, Germany, Greece, Italy, Moldova, Poland, Romania, Slovakia, Ukraine, the Czech Republic and the Netherlands to monitor military assistance being sent to Kyiv.
GRU units 74455, 26165, 29155 were also hit with UK sanctions, which means businesses registered in Britain will not legally be allowed to provide them with services that could assist their sabotage campaigns.
It is alleged the Russian spies are responsible for a series of hacks and attacks on European military support for Ukraine.
British and European intelligence officers have found repeated examples of targeted attacks against port infrastructure, transport hubs, border control points and government infrastructure involved in aid shipments.
British officials fear that the GRU has used the battlefields of Ukraine as a testing ground for further development of a range of cyber capabilities, which would one day be turned on Western countries.
In Britain, three men were recently found guilty of an arson attack on an east London warehouse involved in shipping humanitarian aid and Elon Musk’s Starlink satellite internet systems to Ukraine.
Prosecutors said the attack could be linked to Russia’s Wagner Group of mercenaries.
British investigators were also probing whether Russian agents had sent an incendiary device through the post after it ignited at a DHL hub in Birmingham last year.
A string of similar incidents has been reported across Europe, including warehouse fires and sabotage of train lines.
GRU Unit 29155 has been enlisted by Russia’s top decision-makers to mount a campaign of attempted assassinations, including that of the Skripals, in recent years.
In the past decade, it has been blamed for explosions at weapons depots, where products destined for Ukraine were stored, in the Czech Republic and Bulgaria.
It was also behind a Russian proxy campaign to hire young Afghans to advise and fund Taliban attacks against US-led coalition forces before the American withdrawal in 2022.
David Lammy, Britain’s Foreign Secretary, said: “GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens.
“The Kremlin should be in no doubt: we see what they are trying to do in the shadows and we won’t tolerate it. That’s why we’re taking decisive action with sanctions against Russian spies. Protecting the UK from harm is fundamental to this Government’s Plan for Change.
“Putin’s hybrid threats and aggression will never break our resolve. The UK and our allies’ support for Ukraine and Europe’s security is ironclad.”
Another group targeted is the “Africa Initiative”, which runs social media troll farms ultimately controlled by Putin’s spies, accused of pushing fake news and trying to scupper life-saving global health initiatives.
The Russian spies on the sanctions list will be hit with travel bans and asset freezes, as well as British-registered businesses being barred from assisting them in any form.
Sir Gavin Williamson, the former Tory defence secretary, said the news shows how Britain needed to ramp up defence spending as soon as possible.
“This is incredibly serious, and it shows the ever-mounting threat that we have to face. It also underlines the fact that it’s right to continue to increase the investment, not just in terms of our Armed Forces, but how essential it is for our security services as well,” Williamson said.
“It shows that the threats abroad are also threats at home. It shows that the urgency for the extra money is absolutely acute, because what you can guarantee is while these [spies] have been revealed, there’ll be many more that continue to operate.
“We need to make sure our security services and our military have those resources to properly tackle them, and that needs to happen today and not tomorrow.”
Williamson added: “It shows how pervasive the tentacles of Russia really are. We saw that very starkly with the Skripal poisonings and the Salisbury attack. This was a foreign nation conducting a kill operation here in the United Kingdom. We shouldn’t forget that, because it demonstrates how far that they will go to deliver on their aims.”