Loading story…
The EU Council imposed sanctions on three entities and two individuals over cyberattacks targeting EU member states and partners. The measures include asset freezes, a ban on EU persons and companies providing funds or economic resources to those listed, and travel bans for the individuals. The action expands the EU cyber sanctions regime to 19 individuals and 7 entities, underscoring a coordinated response to persistent malicious cyber activity affecting Europe.
The sanctioned parties include China-based Integrity Technology Group, which the Council said provided products used to compromise devices in EU member states and worldwide, contributing to the hacking of more than 65,000 devices across six member states between 2022 and 2023. Also listed were Anxun Information Technology and its two co-founders for providing hacking services targeting critical infrastructure and critical functions in member states and third countries. The Iranian company Emennet Pasargad was sanctioned for accessing a French subscriber database and offering it for sale on the dark web, compromising advertising billboards to spread disinformation during the 2024 Paris Olympic Games, and breaching a Swedish SMS service affecting a large number of EU citizens.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-16, the Council of the European Union sanctioned Integrity Technology Group, Anxun Information Technology, Emennet Pasargad, and i-Soon executives Wu Haibo and Chen Cheng for cyberattacks and influence operations targeting EU member states and partners. The measures included asset freezes, bans on EU persons and companies providing funds or economic resources, and travel bans for the listed individuals.
In 2025, the US Department of Justice charged 12 people tied to i-Soon over cyberattacks allegedly conducted on behalf of Chinese security services.
The references state that the EU measures followed earlier US sanctions against Emennet Pasargad for its cyber and influence operations.
Prior to the EU action, the United States sanctioned Integrity Technology Group for its role in enabling Flax Typhoon and the Raptor Train botnet's large-scale IoT compromises.
During the 2024 Paris Olympic Games, Emennet Pasargad was linked to the compromise of advertising displays used to spread anti-Israel propaganda and disinformation.
Leaked materials in 2024 indicated that Anxun Information Technology, also known as i-Soon, took assignments from China's Ministry of Public Security, reinforcing allegations that it operated as a hack-for-hire contractor.
Emennet Pasargad was also tied to the compromise of an SMS service in Sweden that was used in a campaign affecting thousands of citizens under the 'Anzu Team' alias.
Emennet Pasargad was linked to the theft of Charlie Hebdo subscriber data and the attempted sale of that information on the dark web, an incident the EU later referenced in its sanctions decision.
Between 2022 and 2023, tools supplied by China's Integrity Technology Group were used in activity linked to Flax Typhoon that compromised more than 65,000 devices across six EU member states.
The EU later cited Tehran-based Emennet Pasargad for attempted interference in the 2020 US election as part of the activity underlying its 2026 cyber sanctions action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcerisky.biz
Open sourcenews.risky.biz
Open sourcehelpnetsecurity.com
Open sourceeclypsium.com
Open sourcego.theregister.com
Open sourceconsilium.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United Kingdom and European Union imposed their first joint cyber sanctions package against Russian state operators, proxy hackers, and influence actors, formally attributing an attempted attack on Poland’s energy grid to Russia’s FSB **Centre 16**. Officials said the failed operation could have cut electricity to as many as **500,000 people** during winter, and linked the same Russian cyber ecosystem to intrusions targeting water treatment facilities, government networks, defense organizations, and other critical infrastructure across Europe. The EU also publicly identified the FSB’s **16th Centre** as controlling several threat groups, including **Turla**, and cited a failed attack on Poland’s critical infrastructure. The sanctions cover **24 individuals and entities**, including GRU leaders **Vyacheslav Stafeyev**, **Ivan Senin**, and **Ivan Kasyanenko**, as well as **IMPULS**, which Western officials said helped GRU Unit 29155 recruit hackers and cyber specialists. The package also targets operators tied to **Lumma Stealer**, which UK authorities said has been used to harvest stolen credentials for espionage and affected at least **2,100 UK victims** in six months, and **10 people linked to Rybar LLC**, accused of supporting pro-Kremlin disinformation and election interference in Moldova and Armenia. France separately announced additional sanctions, released a technical report on Centre 16 activity, and said it would summon the Russian ambassador over ongoing cyber espionage and sabotage.
Jul 15, 2026
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to **Conti**, **TrickBot**, **Wizard Spider**, **LockBit**, **EvilCorp**, **BlackBasta**, the **Lumma** infostealer, and the pro-Russian **Cyber Army of Russia Reborn**. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of **GRU Unit 29155**. The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to **Unit 29155**, while the EU action also cites links to the **WhisperGate** campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Jul 20, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026