France on Tuesday explicitly accused a Russian military intelligence agency of mounting cyber attacks on a dozen entities over the last decade, including against an organization involved in the 2024 Paris Olympics and Emmanuel Macron's first presidential campaign in 2017.
Since 2021, a branch of Russian military intelligence (GRU) dedicated to such attacks has also targeted a dozen French entities including "defense, financial and economic sectors", the foreign ministry said.
"France condemns in the strongest terms the use by Russia's military intelligence service (GRU) of the APT28 attack group, at the origin of several cyberattacks on French interests," the foreign ministry said in a statement.
The GRU "has been carrying out cyberattacks against France for several years using a method known as APT28", Foreign Minister Jean-Noel Barrot said in a message on X, officially attributing these cyberattacks to the GRU for the first time.
APT28, also known as Fancy Bear, has been linked to dozens of global cyberattacks including the 2016 U.S. election, where it was accused of aiding Donald Trump by leaking Democratic Party emails and those of the campaign of Hillary Clinton.
The group targets personal email accounts to retrieve data and messages, or gain access to other machines on a system.
In 2017, hackers hit Macron's first presidential run, leaking thousands of documents barely 24 hours before the vote.
"In the midst of the presidential election, APT28 participated in a massive hacking operation" aiming "to sow doubt and influence public opinion", France's foreign ministry said in a video shared by Barrot on X.
"Thousands of documents were stolen and disseminated, hoping to manipulate voters, but the manoeuvre failed to really impact the electoral process," the video continues, referring to the 2017 leak.
Macron easily won the election in a second-round runoff against far-right veteran Marine Le Pen. French officials have also warned in the past over the risk of interference in elections set for 2027, when Macron cannot stand again because of term limits, and the far right is expected to be a major contender.
The video added that entities in France attacked since 2021 include those "working in the daily lives of French people and include public services, private enterprises as well as a sport organization involved in the 2024 Olympic and Paralympic Games".
Media is one of the hackers' preferred targets, the foreign ministry added.
In 2015, ATP28, posing as Daesh terrorists, hacked the French-language channel TV5 Monde "to manipulate public opinion" and "create a panic in France", it said.
France has been a frequent target of Islamist attacks over the last decade, notably in 2015 when the Bataclan concert hall and the national stadium were attacked.
France is not APT28's only target, with several international intelligence services, including German authorities, warning in September 2024 of Fancy Bear cyberattacks against NATO countries.
The group is "targeting our partners," the foreign ministry video said, adding that Ukraine has been one of the group's "priorities" since Russia launched its invasion of the country in February 2022.
"APT28 is also being used to exert constant pressure on Ukrainian infrastructure in the context of Russia's war of aggression against Ukraine," the foreign ministry said.
And Poland, a staunch ally of Kyiv, warned in recent months that Moscow might seek to interfere with a presidential vote set for May 18 through cyberattacks and disinformation.
France and Poland will sign a "friendship treaty" on May 9, coinciding with Russian President Vladimir Putin presiding over a huge parade in Moscow on the same day as Russia marks victory in World War II.
"Alongside its partners, France is determined to use all the means at its disposal to anticipate Russia's malicious behavior in cyberspace, discourage it and respond to it where necessary," the foreign ministry said.
