Targeting and Compromise of French Entities Using the Turla Intrusion Set

**Executive summary:** The French inter‑ministerial Cyber Crisis Coordination Center (C4) attributes persistent, high‑sophistication espionage activity against French and European targets to the FSB 16th Center using the Turla intrusion set (active since at least 2004), detailing use of custom malware families (e.g., Uroburos, Kazuar, ComRAT), open‑source tools, exploitation (including zero‑days), complex C2 (satellite, P2P, compromised relays), and confirmed compromises of ministerial email accounts, the French Embassy in Moscow, and other defense, justice, and technology sector victims through 2026.