EU imposes cyber sanctions on entities linked to China and Iran

Three entities and two individuals involved in cyber attacks targeting member states

Pro

Image: Shutterstock via Dennis

The European Union has taken decisive action against cyber threats by imposing sanctions on three entities and two individuals linked to malicious cyber activities targeting member states and EU partners, according to EU Global. This marks a significant step forward in the Union’s use of the cyber-sanctions regime, intervening directly against actors linked to China and Iran.

Concretely, the sanctions have been imposed on Integrity Technology Group and Anxun Information Technology, both Chinese companies, as well as Iranian company Emennet Pasargad. Two Chinese nationals linked to Anxun have also been placed on the sanctions list. These individuals and entities are now subject to an asset freeze and a travel ban within the EU.

The EU detailed the specific cyber crimes committed by each entity. Integrity Technology Group was found to have supplied products used to compromise and access devices in member states and beyond, resulting in more than 65,000 device hacks in six member states between 2022 and 2023. Anxun Information Technology provided hacking services targeting critical infrastructure and functions in member states and third countries.

Emennet Pasargad was involved in unlawful access to a French subscriber database, which was then offered for sale on the dark web. It also ran disinformation campaigns by compromising billboards during the 2024 Paris Olympics and targeted a Swedish text messaging service, affecting numerous EU citizens.

These sanctions illustrate the EU’s commitment to deter and respond to serious malicious cyber activities. The EU cyber diplomacy toolbox established in 2017, with the specific sanctions framework introduced in 2019, provides a legal basis for asset freezes and related restrictions against actors engaged in cyber attacks that pose an external threat to the Union or its member states.

The latest additions to the sanctions list bring the total number of individuals and entities sanctioned under the EU’s horizontal cyber sanctions regime to 19 and seven respectively. The Council noted that these entries represent a “strong and sustained response” to persistent malicious cyber activities targeting the EU and its partners.

The EU is demonstrating a shift in its approach to cyber security by imposing sanctions. It is no longer exclusively a technical or law enforcement issue, but is recognised as a tool for external coercion and hybrid pressure. This is in line with the EU’s broader strategy to link cyber resilience, foreign policy and critical infrastructure protection.

The effectiveness of this new position will depend on the EU’s willingness to consistently impose sanctions on politically sensitive actors. Monday’s decision shows that, at least in certain cases, the EU is willing to take such measures.

Business AM

Read More: China cyber security EU European Union Iran security