Finland Accuses Russia of Cyberespionage

The Finnish Security and Intelligence Service (SUPO) has issued a warning about a cyberattack linked to the FSB’s 16th Center.

This was reported by the Finnish broadcaster Yle.

According to SUPO, Russia is seeking to obtain information about the security measures and structures of Finnish systems through poorly secured corporate routers and other vulnerable network equipment.

Russian cyberespionage is aimed at influencing decisions regarding foreign and security policy, as well as targeting companies operating in critical infrastructure, the defense industry, or those supporting Ukraine.

EU hyväksyi kyberpakotepaketin ja paljasti Venäjään, mukaan lukien FSB:hen, liittyviä rikollisia kybertoimijoita.

Suomi tuomitsee Venäjän haitallisen kybertoiminnan sekä kybertoimintaympäristön väärinkäytön. Olen tänään kutsunut Venäjän federaation suurlähettilään puhutteluun.

— Elina Valtonen (@elinavaltonen) July 13, 2026

Following the incident on July 13, Finnish Foreign Minister Elina Valtonen summoned the Russian ambassador.

On the same day, EU High Representative for Foreign Affairs Kaja Kallas issued a statement condemning Russia’s cyberattacks and announcing sanctions against nine individuals and four organizations.

“Cybercriminals, self-proclaimed hacktivists and private companies linked to Russia, including actors operating under its instructions, direction or control, have also carried out, enabled and facilitated a wide range of malicious activities. We strongly condemn Russia’s behaviour and misuse of this cyber ecosystem, targeting public services and critical infrastructure, causing disruptions and financial losses,” said Kaja Kallas.

CheckFirst, a Finnish company dedicated to combating disinformation, conducted an investigation in which it determined that most of the 16th Center’s units or listening stations are located in regions near the border with Finland: Kaliningrad, St. Petersburg, and the Moscow and Saratov regions.

FSB’s 16th Center for Radio-Electronic Intelligence on Communications

The FSB’s 16th Center for Radio-Electronic Intelligence on Communications (TsRRSS) is the main unit responsible for intercepting, decrypting, and processing electronic communications. It also includes the Central Radio Node (military unit 51952), which intercepts wireless and wired communications and monitors internet traffic in the Moscow Oblast.

It has been documented that the 16th Center has been conducting cyber operations since at least 2010. In 2014, it carried out large-scale campaigns against the energy sector, and in 2020, against the aviation sector.

The unit is also responsible for the Turla malware (known as SNAKE) and its variants, which have been a key component of the FSB’s espionage operations for nearly two decades. This espionage module has been used to collect confidential information from specific targets, such as government networks, research institutions, and journalists.