On May 20, 2025, the European Union and the United Kingdom launched a coordinated sanctions campaign targeting Russia’s evolving hybrid warfare infrastructure, coinciding with the EU’s 17th sanctions package. These sweeping measures were introduced in response to both Russia’s continued war of aggression in Ukraine and its increasingly sophisticated destabilization efforts across Europe and beyond.
The sanctions focus heavily on disrupting Russia’s supply chains for drones, weapons, ammunition, and other military hardware, as well as degrading the revenue streams that support the war. In particular, the new measures target Russia’s so-called “shadow fleet”—a network of covert oil tankers and operators used to evade Western energy sanctions. The EU also designated 31 new entities subject to tighter export restrictions on dual-use goods and technologies, citing their material support to Russia’s military and industrial complex.
As part of its package, the UK targeted the Russian cross-border trade platform A7, a joint initiative launched by pro-Russian Moldovan oligarch Ivan Shor and Promsvyazbank. A7 was designed to serve as a sanctions workaround for international trade.
TRM has identified links between A7 and Garantex, a sanctioned Russia-based virtual asset service provider (VASP), through the ruble-backed stablecoin A7A5. On-chain analysis indicates that A7A5 has been used to transfer client funds from Garantex to a new exchange, Grinex, which TRM assesses is likely a reconstituted successor to Garantex. This assessment is based on overlapping infrastructure, user migration patterns, and wallet behaviors consistent with prior Garantex-linked activity.
A7A5 is reportedly backed by ruble reserves held at Promsvyazbank, and has been publicly promoted by a Russian Finance Ministry official. Its emergence appears designed to re-enable liquidity and asset recovery for Garantex clients, offering a blockchain-based method to bypass Western restrictions. This mirrors the broader shift in Russia’s sanctions evasion strategy—using crypto-native tools, offshore entities, and state-aligned platforms to reroute capital flows out of sanctioned channels.
In parallel to the economic measures targeting energy and defense sectors, the EU also sanctioned 21 individuals and 6 entities for their role in Russia’s hybrid threat campaigns against Europe. These designations include actors involved in cybercrime, disinformation, influence operations, and election interference.
Among the entities named was Stark Industries Solutions, a Russian internet hosting provider closely tied to pro-Russian cybercriminal infrastructure. The sanctioned hacker group NoName057(16) has been observed using Stark Industries' services to launch DDoS attacks on Ukraine and other European targets, while the firm’s secretary, Ivan Neculiti, has reportedly facilitated “bulletproof” hosting services on cybercrime forums. Stark Industries has also hosted Recent Reliable News (RRN), a previously sanctioned disinformation site known for laundering Kremlin narratives into Western media ecosystems.
The EU also sanctioned individuals engaged in undermining democratic processes, including German blogger Thomas Röper, who operates a disinformation network under the brand Anti-Spiegel. Röper’s network disseminates false narratives aimed at delegitimizing the Ukrainian government and eroding public support for Ukraine in Germany. TRM Labs has observed cryptocurrency addresses associated with Anti-Spiegel showing exposure to various services, including likely cash-out activity at no-KYC Russian exchanges and the sanctioned Garantex platform, further linking pro-Russian influence operations to illicit digital finance infrastructure.
Within the EU’s hybrid threat framework, the scope of sanctions has also been expanded to cover tangible assets—such as vessels, aircraft, real estate, and communications infrastructure—associated with destabilizing activities. New measures now apply to credit institutions, financial firms, and crypto-asset service providers that directly or indirectly facilitate Russia’s operations, reflecting an effort to close off remaining financial conduits, both traditional and decentralized.
Together, these EU and UK sanctions underscore a growing emphasis on disrupting Russia’s entire sanctions evasion ecosystem—from oil tankers and drone manufacturers to disinformation hubs and crypto-financed trade platforms. At TRM, we continue to observe a move toward holistic sanctions packages that combine traditional trade controls with digital finance-focused enforcement.
As jurisdictions refine their ability to identify and dismantle these evasion typologies—including the use of stablecoins, non-compliant exchanges, and proxy platforms like Grinex and A7—the global response to Russian hybrid threats is becoming more sophisticated, better integrated, and increasingly adaptive.
Access our coverage of TRON, Solana and 23 other blockchains
Fill out the form to speak with our team about investigative professional services.
