Mr. Sanctions

Category: Cyber

  • December 9, 2025: OFSI Cyber designations

    From the OFSI Notice:

    Based on the OFSI “Notice_Cyber_041225” and the Annex details, here are the re-formatted listings for the additions, followed by supplemental information.

    Individuals

    1. BORIS ALEKSEYEVICH ANTONOV

    • Group ID: 17227
    • Name (non-Latin script): Борис Алексеевич АНТОНОВ
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0104. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Boris ANTONOV has been involved in relevant cyber activity in that he was responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Boris ANTONOV has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Boris Antonov is a Major in the Russian GRU’s Unit 26165 (85th Main Special Service Center). He was indicted by a U.S. federal grand jury in July 2018 (the “Netyksho” indictment) for his role in the conspiracy to interfere with the 2016 U.S. presidential election, specifically involving the hacking of the DNC and DCCC. The FBI lists his Date of Birth as December 19, 1980.

    2. ANATOLIY VLADIMIROVICH ISTOMIN

    • Group ID: 17228
    • Name (non-Latin script): Анатолий Владимирович ИСТОМИН
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0105. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Anatoliy ISTOMIN has been involved in relevant cyber activity in that he was responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Anatoliy Vladimirovich ISTOMIN has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Anatoliy Istomin is identified as an officer in GRU Unit 26165, the unit responsible for military cyber operations including the 2016 U.S. election interference and attacks on the OPCW.

    3. IGOR ANDREYEVICH BOCHKA

    • Group ID: 17229
    • Name (non-Latin script): Игорь Андреевич БОЧКА
    • a.k.a: BOCHKA, Igor, Andreevich
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0106. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that a member of GRU Unit 26165, Igor Andreyevich BOCHKA has also been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Igor Andreyevich BOCHKA has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Igor Bochka is identified as an officer in GRU Unit 26165.

    4. ALEKSEY ANDREYEVICH UMETS

    • Group ID: 17230
    • Name (non-Latin script): Алексей Андреевич УМЕЦ
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0107. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Aleksey Andreyevich UMETS has been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Aleksey Andreyevich UMETS has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Aleksey Umets is identified as an officer in GRU Unit 26165.

    5. PAVEL VYACHESLAVOVICH YERSHOV

    • Group ID: 17231
    • Name (non-Latin script): Павел Вячеславович ЕРШОВ
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0108. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Pavel Vyacheslavovich YERSHOV has been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Pavel Vyacheslavovich YERSHOV has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Pavel Yershov is a Russian military intelligence officer assigned to GRU Unit 26165. He was indicted by the U.S. in July 2018 for his role in the 2016 election interference. The FBI lists his Date of Birth as December 14, 1990.

    6. NIKOLAY YURYEVICH KOZACHEK

    • Group ID: 17232
    • Name (non-Latin script): Николай Юрьевич КОЗАЧЕК
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0109. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Nikolay Yuryevich KOZACHEK has been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Nikolay Yuryevich KOZACHEK has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Nikolay Kozachek is a Lieutenant Captain in the Russian GRU’s Unit 26165. He was indicted by the U.S. in July 2018 for developing and monitoring the “X-Agent” malware used to hack the DNC. The FBI lists his Date of Birth as July 29, 1989.

    7. DENIS IGOREVICH DENISENKO

    • Group ID: 17233
    • Name (non-Latin script): Денис Игоревич ДЕНИСЕНКО
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0110. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect that Russian GRU 29155 Officer Senior Lieutenant Denis Igorevich DENISENKO is or has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Additionally, DENISENKO remains associated with a GRU unit, which is a person who is or has been so involved in such activity.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Denis Denisenko is a Senior Lieutenant in GRU Unit 29155. He was indicted by the U.S. in June 2024 for his involvement in the “WhisperGate” malware attacks against Ukraine and other targets. The FBI lists his Date of Birth as May 14, 1997.

    8. DMITRIY YURYEVICH GOLOSHUBOV

    • Group ID: 17234
    • Name (non-Latin script): Дмитрий Юрьевич ГОЛОШУБОВ
    • Nationality: Russia
    • Address: Russia
    • Other Information: (UK Sanctions List Ref): CYB0111. (UK Statement of Reasons): The activity that GOLOSHUBOV is or has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
    • Gender: Male
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Dmitriy Goloshubov is an officer in GRU Unit 29155. He was indicted by the U.S. in June 2024 for his role in the “WhisperGate” cyber attacks against Ukrainian critical infrastructure. The FBI lists his Date of Birth as October 10, 1998.

    The video below explains how the FBI identified and indicted the GRU officers mentioned in the listing.

    FBI press conference on GRU officers

    This video is relevant as it details the specific indictments and activities of the GRU officers (Unit 26165 and 29155) listed in the sanctions notice.

    Entities

    1. BABBAR AKALI LEHAR

    • Group ID: 17226
    • Good quality a.k.a: BAL
    • Other Information: (UK Sanctions List Ref): CTD0012. (UK Statement of Reasons): “We have reasonable grounds to suspect that Babbar Akali Lehar (“BAL”) is an involved person on the basis that it has been involved in the following terrorist activity: (a) BAL has been and is promoting and encouraging terrorism, through promoting a person involved in terrorism, namely Babbar Khalsa (“BK”) which uses the alias Babbar Khalsa International (“BKI”) (together “BK/BKI”); (b) BAL is associated with a person involved in terrorism namely BK/BKI; and (c) BAL has been and is carrying out recruitment activities for persons involved in terrorism, namely themselves and BK/BKI.” (Website): babbarakali.com
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: Babbar Akali Lehar (BAL) is a pro-Khalistan militant organization. The UK government designated it alongside Gurpreet Singh Rehal, citing its support for the banned terrorist group Babbar Khalsa International (BKI). The group is accused of promoting terrorism and recruiting for BKI activities.

    2. THE MAIN DIRECTORATE OF THE GENERAL STAFF OF THE ARMED FORCES OF THE RUSSIAN FEDERATION

    • Group ID: 17235
    • a.k.a: (1) GRU (2) Main Directorate (3) Main Intelligence Directorate
    • Address: Khoroshevskoye Shosse, 76, Moscow, Russia
    • Other Information: (UK Sanctions List Ref): RUS3149. (UK Statement of Reasons): The Secretary of State considers that there are reasonable grounds to suspect THE MAIN DIRECTORATE OF THE GENERAL STAFF OF THE ARMED FORCES OF THE RUSSIAN FEDERATION (GRU) is an involved person under the Russia (Sanctions) (EU Exit) Regulations 2019 based on the following ground: THE MAIN DIRECTORATE OF THE GENERAL STAFF OF THE ARMED FORCES OF THE RUSSIAN FEDERATION (GRU) is or has been involved in destabilising Ukraine or undermining the territorial security and sovereignty of Ukraine by engaging in, providing support for, or promoting actions which destabilise Ukraine or undermine or threaten the territorial integrity, sovereignty or independence of Ukraine.
    • Financial sanctions imposed in addition to an asset freeze: Trust services
    • Date trust services sanctions imposed: 04/12/2025
    • Listed on: 04/12/2025 UK Sanctions List
    • Date Designated: 04/12/2025
    • Last Updated: 04/12/2025

    Supplemental Information: The GRU (Glavnoye Razvedyvatelnoye Upravleniye) is the foreign military intelligence agency of the General Staff of the Armed Forces of the Russian Federation. It controls the specialized cyber units (Unit 26165 and Unit 29155) whose officers were also designated in the parallel Cyber sanctions notice. The GRU has been implicated in numerous international incidents, including the 2018 Salisbury nerve agent attack and the 2016 U.S. election interference.

    ... Russian military intelligence: The GRU …

    This video provides context on the GRU and its activities, which is relevant to the entity listing for the “Main Directorate of the General Staff” and its associated units.

    —

    ,

  • UK designations for Russia and Cyber programs

    Today, FCDO issued the following notice:

    Policy paper

    New UK action against foreign information warfare

    Published 9 December 2025

    Across Europe, we are witnessing an escalation in hybrid threats – from physical through to cyber and information warfare – designed to destabilise our democracies, weaken our critical national infrastructure, and undermine our interests, all for the advantage of malign foreign states.

    Foreign Information Manipulation and Interference (FIMI) operations are creating fake websites and using social media and bot accounts to undermine democratic elections and spread narratives in support of Russia’s illegal war in Ukraine. Russian organisations responsible for vast malign online networks like Doppelgänger specialise in flooding social media with counterfeit documents and deepfake material in English, German, and French, which advances Russia’s strategic aims.

    We are stepping up cooperation with European partners on hybrid and information threats, including through the UK-EU Security and Defence Partnership, and through deep cooperation between teams in the UK, in France, Germany, Poland and Brussels, to deliver a pan-European response to a pan-European threat.

    Since October 2024, this government has sanctioned 31 organisations and individuals responsible for delivering Russia’s information warfare. Today, the UK has gone further and sanctioned the following entities and individuals for their role in destabilising Ukraine:

    1. RYBAR LLC
    2. Mikhail Sergeevich ZVINCHUK
    3. FOUNDATION FOR THE SUPPORT AND PROTECTION OF THE RIGHTS OF COMPATRIOTS LIVING ABROAD (AKA PRAVFOND)
    4. EUROMORE
    5. GOLOS
    6. THE CENTRE FOR GEOPOLITICAL EXPERTISE
    7. Aleksandr Geljevitj DUGIN

    Rybar LLC & Mikhail Sergeevich Zvinchuk

    The UK has designated RYBAR LLC, a media company partially resourced by the Government of Russia, that hides its connections to the Russian state whilst running a covert FIMI network that promotes international support for the illegal invasion of Ukraine and interferes in global democratic processes, including elections in the EU and Moldova.

    Rybar uses classic Kremlin manipulation tactics, including fake “investigations” and AI driven content to respond rapidly to global events and shape narratives in the Kremlin’s favour.  Rybar is partially coordinated by the Presidential Administration, receives funding from Russian State corporation Rostec and works with members of the Russian Intelligence Services. The UK has also designated Mikhail Sergeevich ZVINCHUK, RYBAR LLC’s co-owner and General Director.

    Foundation for the Support and Protections of the Rights of Compatriots Living Abroad  (AKA PRAVFOND), Euromore and Golos

    The UK has designated Government of Russia-affiliated entities facilitating and delivering Russian propaganda which undermines international support for Ukraine. Leaked reports suggest PRAVFOND, attributed as a front for the GRU by Estonia, has funnelled money into EUROMORE and GOLOS, nominally independent news outlets which hide their connection to the Russian state, to spread Kremlin propaganda targeting Ukraine to European audiences.

    The Centre for Geopolitical Expertise and Aleksandr DUGIN

    The UK has designated the Moscow-based “think tank” Centre for Geopolitical Expertise (CGE) for funding and directing Russian FIMI networks that undermine international support for Ukraine, and its founder Aleksandr Dugin, a prominent supporter of the invasion of Ukraine whose work closely informs Putin’s calculations. The CGE is linked to the Russian Intelligence Services and has coordinated support for the Russian FIMI network known as Storm-1516 to further its aims of undermining Ukraine.

    Storm-1516 is a malign influence network which produces content that seeks to undermine European unity and create support for Russia’s illegal war in Ukraine. It repeatedly targets European political figures and domestic political parties with false and divisive claims, such as allegations of corruption or impropriety. These videos are then spread through social media accounts, news portals and inauthentic websites. Some of these inauthentic sites impersonate legitimate organisations or media outlets.

    Note

    Some of this analysis is drawn from Open Source material. As such, there is a risk that information may exist that contradicts, alters or strengthens the conclusions contained within this document.

    —

    , ,

  • OFSI’s Cyber sanctions additions, refrormatted

    Based on the Office of Financial Sanctions Implementation (OFSI) update for the Cyber sanctions regime dated 04/12/2025, the following additions have been made.

    Individuals

    • Boris Alekseyevich ANTONOV
      • Group ID: 17227
      • Name (non-Latin script): Борис Алексеевич АНТОНОВ
      • Nationality: Russia
      • Address: Russia
      • Other Information: (UK Sanctions List Ref): CYB0104.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Boris ANTONOV has been involved in relevant cyber activity in that he was responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Boris ANTONOV has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Anatoliy Vladimirovich ISTOMIN
      • Group ID: 17228
      • Name (non-Latin script): Анатолий Владимирович ИСТОМИН
      • Nationality: Russia
      • Address: Russia
      • Other Information: (UK Sanctions List Ref): CYB0105.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Anatoliy Vladimirovich ISTOMIN has been involved in relevant cyber activity in that he was responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Anatoliy Vladimirovich ISTOMIN has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Igor Andreyevich BOCHKA
      • Group ID: 17229
      • Name (non-Latin script): Игорь Андреевич БОЧКА
      • a.k.a: BOCHKA, Igor, Andreevich
      • Nationality: Russia
      • Address: Russia
      • Other Information: (UK Sanctions List Ref): CYB0106.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that a member of GRU Unit 26165, Igor Andreyevich BOCHKA has also been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Igor Andreyevich BOCHKA has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Aleksey Andreyevich UMETS
      • Group ID: 17230
      • Name (non-Latin script): Алексей Андреевич УМЕЦ
      • Nationality: Russia
      • Address: Russia
      • Other Information: (UK Sanctions List Ref): CYB0107.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Aleksey Andreyevich UMETS has been involved in relevant cyber activity in that he was responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Aleksey Andreyevich UMETS has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Pavel Vyacheslavovich YERSHOV
      • Group ID: 17231
      • Name (non-Latin script): Павел Вячеславович ЕРШОВ
      • Nationality: Russia
      • Other Information: (UK Sanctions List Ref): CYB0108.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Pavel Vyacheslavovich YERSHOV has been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Pavel Vyacheslavovich YERSHOV has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Nikolay Yuryevich KOZACHEK
      • Group ID: 17232
      • Name (non-Latin script): Николай Юрьевич КОЗАЧЕК
      • Nationality: Russia
      • Other Information: (UK Sanctions List Ref): CYB0109.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that as part of Unit 26165, Nikolay Yuryevich KOZACHEK has been involved in relevant cyber activity in that he has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Such activity that Nikolay Yuryevich KOZACHEK has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025
    • Denis Igorevich DENISENKO
      • Group ID: 17233
      • Name (non-Latin script): Денис Игоревич ДЕНИСЕНКО
      • Nationality: Russia
      • Other Information: (UK Sanctions List Ref): CYB0110.
      • UK Statement of Reasons: The Secretary of State considers that there are reasonable grounds to suspect that Russian GRU 29155 Officer Senior Lieutenant Denis Igorevich DENISENKO is or has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Additionally, DENISENKO remains associated with a GRU unit, which is a person who is or has been so involved in such activity. The activity that DENISENKO is or has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.1
      • Gender: Male2
      • Listed on: 04/12/2025345
      • Last Updated: 04/12/2025678
    • Dmitriy Yuryevich GOLOSHUBOV91011
      • Group ID: 17234121314
      • Nam15e (non-Latin script): Дмитрий Юрьевич ГОЛОШУБОВ1617
      • Nationality: Russia1819
      • Other Information: (UK Sanctions List Ref): CYB0111.2021
      • UK Statement of Reasons:22 The Secretary of State 23considers that there are reasonable grounds to suspect that Russian GRU 29155 Officer Dmitriy Yuryevich GOLOSHUBOV is or has been responsible for, engaging in, providing support for, or promoting the commission, planning or preparation of relevant cyber activity. Additionally, GOLOSHUBOV remains associated with a GRU unit, which is a person who is or has been so involved in such activity. The activity that GOLOSHUBOV is or has been involved in undermines, or is intended to undermine, the integrity, prosperity or security of the United Kingdom or a country other than the United Kingdom.
      • Gender: Male
      • Listed on: 04/12/2025
      • Last Updated: 04/12/2025

    —

    ,

  • Daily Digest for Thursday, December 4, 2025

    Daily Digests are simple lists of hyperlinks to new content released by sanctions and export control regulators. When appropriate, additional posts of analysis and commentary, as well as summarizations and rephrasing of the contents will be posted separately.

    Mr. Sanctions does not attempt to comprehensively cover the worlds of sanctions and export control. Opinions expressed here are my own and do not represent that of my past current or future employers.

    —

    , , , , , , , , ,