Loading story…
Western governments have increasingly used economic sanctions as a tool to disrupt state-sponsored cyber threat actors, targeting not only the hackers themselves but also the infrastructure and enablers that support their operations. Reports from the Royal United Services Institute (RUSI) highlight that sanctions are most effective when they focus on entities such as cryptocurrency mixers, hosting providers, technology suppliers, and private-sector contractors, as these groups are more vulnerable due to their reliance on the legitimate global economy. The United States has demonstrated the greatest impact with its long-standing framework, often combining sanctions with criminal indictments, diplomatic pressure, and intelligence sharing to amplify operational and reputational pressure on adversaries.
While the European Union and the United Kingdom have established newer sanction regimes, their impact has been more limited, with relatively few individuals and entities sanctioned to date. Experts emphasize that sanctions alone are insufficient to stop cyberattacks but can make operations slower, riskier, and more expensive for threat actors when integrated into broader cross-domain strategies. Recommendations for improving the effectiveness of cyber sanctions include clearer strategic intent, greater transparency, and a continued focus on disrupting the support networks that enable state-backed cyber operations.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple nation-state actors, including China, Russia, Iran, and North Korea, are intensifying cyber operations targeting critical infrastructure, government entities, and private sector organizations worldwide. China-linked groups such as Ink Dragon have expanded espionage campaigns against European governments, while Russia-linked actors like Callisto have targeted NGOs and are implicated in disruptive attacks in Europe. Iran's MuddyWater has focused on critical infrastructure in Israel and Egypt, and North Korea is increasing disruptive attacks on various sectors. These activities are accompanied by sophisticated cybercrime campaigns, exploitation of zero-day vulnerabilities, and significant data breaches affecting sectors such as health, telecommunications, and justice. In response, Western governments and institutions are taking legal and policy actions, including EU sanctions and fines, UK and Polish legal proceedings against Russian actors, and increased attribution of attacks to state-sponsored groups. However, there is growing concern that U.S. cyber defenses are lagging behind adversaries, with strained mission capacity, weakened public-private collaboration, and unstable federal leadership. Experts call for renewed strategic focus, improved coordination with allies, and robust policy reforms to counter the persistent and evolving threat landscape posed by hostile nation-states.
Jun 29, 2026
A new bill has been introduced in the U.S. House of Representatives that seeks to establish government-wide processes for attributing and sanctioning foreign hackers responsible for major cyberattacks against the United States. The proposed legislation, known as the Cyber Deterrence and Response Act, would empower the executive branch to formally designate certain foreign entities as 'critical cyber threat actors' and impose a range of sanctions, including asset blocking, financial restrictions, export controls, procurement prohibitions, visa bans, and suspension of assistance. The bill also outlines a framework for attribution, leveraging input from federal cyber agencies and private threat intelligence firms, and is intended to strengthen the government's ability to hold malicious actors accountable and protect critical infrastructure. The legislative push comes amid growing concern in Congress over the increasing sophistication and frequency of cyberattacks targeting U.S. interests, as well as perceived gaps in the nation's ability to deter such threats. The move follows high-profile incidents such as the Salt Typhoon cyberespionage campaign and reflects a broader effort to enhance national cyber defense and response capabilities. Congressional leaders and the Trump administration have emphasized the need for real-time detection and deterrence, with the new bill positioned as a key component of the administration's evolving cyber strategy.
Jun 29, 2026
Australia, in coordination with the United States, has imposed sanctions on North Korean cybercriminals and entities accused of generating illicit revenue to support Pyongyang's weapons of mass destruction (WMD) programs. The sanctions target one individual and four entities linked to activities such as espionage, cryptocurrency theft, and fraudulent IT worker schemes, with the aim of disrupting North Korea's ability to fund its weapons development. The measures include financial restrictions and travel bans, and are part of a broader international effort to counter North Korea's destabilizing cyber operations. Australian officials highlighted that North Korean hacking groups have stolen over $2 billion in digital assets in the first three quarters of 2025, with proceeds laundered through networks in Russia, China, and other countries. The joint action underscores ongoing collaboration between Australia, the US, and other partners to push back against hostile cyber campaigns and promote responsible conduct in cyberspace. The sanctions follow similar US actions against North Korean nationals and institutions involved in laundering cybercrime proceeds.
Jul 12, 2026