UK adds 14 to cyber sanctions list, targeting alleged GRU and Lumma Stealer links

UNITED KINGDOM, July 13, 2026 — The United Kingdom added 14 entries to its Cyber Sanctions regime on Monday, designating 13 individuals and one entity in a fresh move aimed largely at people and structures linked to Russia’s GRU military intelligence service and the cybercrime ecosystem around Lumma Stealer. The new measures were published in an official Foreign, Commonwealth and Development Office sanctions notice updating the UK Sanctions List.

All 14 additions were made under the Cyber (Sanctions) (EU Exit) Regulations 2020. Most of the individuals were hit with asset freezes, travel bans and director disqualification sanctions, while the entity, OOO Impuls, was subjected to an asset freeze and director disqualification sanction.

The notice names Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko as being involved in relevant cyber activity that the UK said undermined, or was intended to undermine, the security or prosperity of Britain or another country and caused, or was intended to cause, economic loss or commercial harm.

It also identifies Maksim Evgenievich Voronin, Maksim Aleksandrovich Gordienko and Marat Shaigovich Zhurkin as Lumma Stealer operators. The UK said each had been involved in relevant cyber activity through association with the malware operation and had provided technical assistance contributing to that activity.

A larger cluster of the designations targets alleged GRU personnel or associates of GRU Unit 29155, including Roman Aleksandrovich Puntus, Vyacheslav Stanislavovich Stafeyev, Evgeniy Viktorovich Bashev, Ivan Sergeyevich Kasyanenko, Aleksandr Vladimirovich Shepelev, Dmitriy Aleksandrovich Voronov, Sultan Omarovich Omarov and Ivan Alekseyevich Senin, as well as OOO Impuls. The UK said several remain associated with Unit 29155, which it had already sanctioned in 2025.

The latest action builds on Britain’s broader effort to expose and sanction Russian cyber and hybrid threat activity. The UK previously linked GRU Unit 29155 to cyber-attacks and digital sabotage, including activity affecting Ukraine and other countries, and sanctioned the unit in July 2025.