The UK sanctioned 18 officers and three units from Russia's military intelligence agency (GRU) on Friday over their role in a 2022 air strike on a theatre in Ukraine that killed hundreds of civilians.
The Foreign, Commonwealth and Development Office (FCDO) said the targeted GRU personnel were responsible for preparations leading to the bombing of the Mariupol Drama Theatre, where civilians had taken refuge and painted the word "children" outside in large letters hoping to deter attacks.
The strike on 16 March 2022 is believed to have killed around 600 people, including many children, according to an investigation by the Associated Press.
Western officials have blamed Russia for over 70 attacks since 2022, aimed at destabilising Europe and weakening support for Ukraine.
"GRU spies are running a campaign to destabilise Europe, undermine Ukraine’s sovereignty and threaten the safety of British citizens," said Foreign Secretary David Lammy.
The UK alleges that GRU Unit 26165 conducted online reconnaissance of civilian bomb shelters in Mariupol and Kharkiv in the days leading up to the attack.
In addition to their role in Ukraine, the officers are accused of past operations including targeting the family of former Russian spy Sergei Skripal, who was poisoned alongside his daughter with the nerve agent Novichok in Salisbury in 2018.
The same GRU unit is believed to have used malware in 2013 to spy on the email account of Skripal's daughter, Yulia.
The FCDO described Unit 26165 as a "highly sophisticated, well-established cyber actor" involved in intelligence gathering and hack and leak operations against Ukraine, NATO and European countries.
It also linked the unit to cyberattacks on the US Democratic Party in 2016, French President Emmanuel Macron's 2017 campaign and attempted interference in the 2024 Paris Olympics.
Another GRU division, Unit 74455, was said to have launched cyberattacks against the UK Foreign Office and the Defence Science and Technology Laboratory during the Skripal investigation.
The UK's National Cyber Security Centre added that Russian hackers had developed malware designed to gain unauthorised access to Microsoft cloud accounts.
Friday's sanctions also targeted the African Initiative, an outlet allegedly used by Russian intelligence operatives to conduct disinformation campaigns in Africa, including efforts to weaken public health programmes and destabilise local governments.
While the immediate impact of the sanctions — typically asset freezes and travel bans — may be limited, British officials said they aim to raise the cost of involvement in hostile acts and restrict international travel.
