LegalizeCouncil Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States
| Name | Identifying information | Reasons | Date of listing | |
|---|---|---|---|---|
| 1. | Tianjin Huaying Haitai Science and Technology Development Co. Ltd (Huaying Haitai) | a.k.a.: Haitai Technology Development Co. Ltd Location: Tianjin, China | Huaying Haitai provided financial, technical or material support for and facilitated ‘Operation Cloud Hopper’, a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States. ‘Operation Cloud Hopper’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss. The actor publicly known as ‘APT10’ (‘Advanced Persistent Threat 10’) (a.k.a. ‘Red Apollo’, ‘CVNX’, ‘Stone Panda’, ‘MenuPass’ and ‘Potassium’) carried out ‘Operation Cloud Hopper’. Huaying Haitai can be linked to APT10. Moreover, Huaying Haitai employed Gao Qiang and Zhang Shilong, who are both designated in connection with ‘Operation Cloud Hopper’. Huaying Haitai is therefore also associated with Gao Qiang and Zhang Shilong. | 30.7.2020 |
| 2. | Chosun Expo | a.k.a.: Chosen Expo; Korea Export Joint Venture Location: DPRK | Chosun Expo provided financial, technical or material support for and facilitated a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘WannaCry’ and cyber-attacks against the Polish Financial Supervision Authority and Sony Pictures Entertainment, as well as cyber-theft from the Bangladesh Bank and attempted cyber-theft from the Vietnam Tien Phong Bank. ‘WannaCry’ disrupted information systems around the world by targeting information systems with ransomware and blocking access to data. It affected information systems of companies in the Union, including information systems relating to services necessary for the maintenance of essential services and economic activities within Member States. The actor publicly known as ‘APT38’ (‘Advanced Persistent Threat 38’) or the ‘Lazarus Group’ carried out ‘WannaCry’. Chosun Expo can be linked to APT38/the Lazarus Group, including through the accounts used for the cyber-attacks. | 30.7.2020 |
| 3. | Main Centre for Special Technologies (GTsST) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU) | Address: 22 Kirova Street, Moscow, Russian Federation | The Main Centre for Special Technologies (GTsST) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), also known by its field post number 74455, is involved in cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and in cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘NotPetya’ or ‘EternalPetya’ in June 2017 and the cyber-attacks directed at a Ukrainian power grid in the winter of 2015 and 2016. ‘NotPetya’ or ‘EternalPetya’ rendered data inaccessible in a number of companies in the Union, wider Europe and worldwide, by targeting computers with ransomware and blocking access to data, resulting amongst others in significant economic loss. The cyber-attack on a Ukrainian power grid resulted in parts of it being switched off during winter. The actor publicly known as ‘Sandworm’ (a.k.a. ‘Sandworm Team’, ‘BlackEnergy Group’, ‘Voodoo Bear’, ‘Quedagh’, ‘Olympic Destroyer’ and ‘Telebots’), which is also behind the attack on the Ukrainian power grid, carried out ‘NotPetya’ or ‘EternalPetya’. Sandworm has carried out cyber-attacks against Ukraine, including Ukrainian government agencies and Ukrainian critical infrastructure, following Russia’s war of aggression against Ukraine. Those cyber-attacks include spear-phishing campaigns, malware and ransomware attacks. The Main Centre for Special Technologies of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation has an active role in the cyber-activities undertaken by Sandworm and can be linked to Sandworm. | 30.7.2020 |
| 4. | 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU) | Address: Komsomol’skiy Prospekt, 20, Moscow, 119146, Russian Federation | The 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU) (a.k.a. ‘Military Unit 26165’, ‘APT28’, ‘Fancy Bear’, ‘Sofacy Group’, ‘Pawn Storm’ and ‘Strontium’) is involved in cyber-attacks with a significant effect constituting an external threat to the Union or its Member States and in cyber-attacks with a significant effect against third States. In particular, military intelligence officers of the GTsSS took part in the cyber-attack against the German federal parliament (Deutscher Bundestag) in April and May 2015 and the attempted cyber-attack aimed at hacking into the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands in April 2018. The cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and email accounts of several MPs, as well as of former Chancellor Angela Merkel, were affected. Following Russia’s war of aggression against Ukraine, cyber-attacks by the GTsSS (spear-phishing and malware-based attacks) were carried out against Ukraine. | 22.10.2020 |
| 5. | Integrity Technology Group | 永信至诚科技集团股份有限公司 (Chinese spelling) Alias: Beijing Integrity Technology Company Limited, Yongxin Zhicheng Technology Group Company Limited Address: Fenghao East Road, Room 103, Building6, No. 9, Beijing Haidian District, China Place of registration: Beijing, China Date of registration: 2.9.2010 Unified Social Credit Code: 91110108562135265P | Integrity Technology Group is a cybersecurity enterprise, based in the People’s Republic of China (PRC), that facilitated cyber-attacks linked to Advanced Persistent Threat (APT) Flax Typhoon. That APT used Integrity Technology Group’s products and technology to deploy its computer network exploitation activities. Integrity Technology Group’s products have been used since then to compromise and access Internet of Things devices in Member States, as well as in countries across Europe and globally. Between 2022 and 2023, Flax Typhoon accessed at least 65 600 Internet of Things devices in six Member States by using Integrity Technology Group’s products. Therefore, Integrity Technology Group’s commercial products and infrastructure were routinely used in cyber-attacks against Member States as well as third States. Consequently, by affecting information systems relating to digital infrastructure, Integrity Technology Group is providing technical and material support for cyber-attacks with a significant effect which constitute an external threat to Member States and third States. | 16.3.2026 |
| 6. | Emennet Pasargad | Alias: Anzu Team, Holy Souls, Aria Sepehr Ayandehsazan, Haywire Kitten Place of registration: Tehran, Iran Registration number: 554267 Principal place of business: Tehran, Iran | Emennet Pasargad is an Iranian cyber actor (company) that has targeted numerous entities, in particular, in Member States as well as in the United States (US). Emennet Pasargad, operating under the alias ‘Anzu Team’, targeted digital infrastructure in Sweden and compromised a Swedish SMS service, affecting a large number of people. Furthermore, by acting under the alias ‘Holy Souls’, the entity compromised the subscriber database of the French satirical magazine, Charlie Hebdo, and advertised it for sale on the dark web. Emennet Pasargad compromised advertising billboards during the Paris Olympic Games and displayed disinformation campaigns. Emennet Pasargad also attempted to interfere with the US presidential elections of 2020, threatening democracy and the rule of law, by obtaining confidential US voter information and gaining unauthorised access to a US media company’s computer network. Emennet Pasargad is therefore responsible for cyber-attacks with a significant effect which constitute an external threat to Member States and for cyber-attacks with a significant effect against a third State. | 16.3.2026 |
| 7. | Anxun Information Technology Co. Ltd. | 安洵信息技术有限公司 (Chinese spelling) Alias: i-Soon Address: Room 1002, Qiangqiang Building, No. 1318 Qixin Road, Minhang District, Shanghai Unified Social Credit Code: 91510105332025597A (Sichuan branch) Unified Social Credit Code: 91310116561906136G (Shanghai branch) Website: i-soon.net, isoon.net, i-soon.com.cn, isoonren.com, isoon.win Phone numbers: +862161119992, +8605645893417, +8613761671735, +864000665915 Email: shutdown@163.com, isoon2015@126.com, tao_tingting@i-soon.net, li_ping@i-soon.net | Anxun Information Technology Co. Ltd. is a company based in the People’s Republic of China that offers ‘hacking-for-hire’ services. It has targeted critical infrastructure and critical State functions of Member States and accessed and sold classified information. Furthermore, Anxun Information Technology Co. Ltd. has attacked governments of various third States, thereby posing a threat to the common foreign and security policy (CFSP) objectives of the Union, as set out in Article 21(2), points (a) to (c), of the Treaty on European Union. Anxun Information Technology Co. Ltd. gains an important economic benefit from the services provided. Anxun Information Technology Co. Ltd. is therefore responsible for cyber-attacks with a significant effect which constitute an external threat to Member States as well as for cyber-attacks with a significant effect against third States. | 16.3.2026 |
| 8. | Media Land LLC | Address: Tsvetnochnaya st., 16 Litera P, Room 27, Moskovskaya Zastava Municipal District St Petersburg, 196006, Russian Federation Type of entity: Limited Liability Company Place of registration: St Petersburg Date of registration: 19.10.2015 Registration number: 1152536009900 Principal place of business: St Petersburg, Russian Federation Associated entity: ML.Cloud | Since 2016, Bullet Proof Hosting service Media Land LLC has been facilitating a wide array of malware attacks against the Member States and globally, by offering hosting services that hide user identities and resist takedowns by law enforcement, leading to significant financial losses. Media Land LLC enabled large-scale ransomware operations, command-and-control services, and phishing operations that target critical infrastructure and essential services among the Member States. Operations facilitated by Media Land LLC include, inter alia, LockBit, EvilCorp and BlackBasta. Therefore, Media Land LLC is involved in cyber-attacks with a significant effect, which constitute an external threat to the Member States. | 13.7.2026 |
| 9. | ML.Cloud | Address: Brivibas iela 52, Riga, LV-1011, Latvija; Russian Federation, Kazan, Peterburgskaya st. 52 Place of registration: Riga Associated individual: Alexander Volosovik Other associated entities: Media Land LLC | ML.Cloud is the sister company of Media Land LLC, and provides the technical infrastructure for Media Land LLC. Since 2016, Bullet Proof Hosting service Media Land LLC has been facilitating a wide array of malware attacks against the Member States and globally, by offering hosting services that hide user identities and resist takedowns by law enforcement, leading to significant financial losses. Media Land LLC enabled large-scale ransomware operations, command-and-control services, and phishing operations that target critical infrastructure and essential services among the Member States. Operations facilitated by Media Land LLC include, inter alia, LockBit, EvilCorp and BlackBasta. Therefore, Media Land LLC is involved in cyber- attacks that constitute an external threat with significant effect to EU Member States. Therefore, ML. Cloud provides technical support for cyber-attacks with a significant effect, which constitute an external threat to the Member States. | 13.7.2026 |
| 10. | ‘Impuls’ LLC | Общество с ограниченной ответственностью ‘Импульс’ Address: 344015, Russian Federation, Rostov Region, Rostov-on-Don, ul. Eremenko, d. 56, k. 6, apt. 88 Type of entity: Limited Liability Company Place of registration: Interdistrict Inspectorate of the Federal Tax Service No. 26 for the Rostov Region, 344019, Rostov-on-Don, ul. Myasnikova, d. 52/32, Russian Federation Date of registration: 27.9.2010 Registration number: INN (ИНН): 6168033776; OGRN (ОГРН): 1106194004850 Principal place of business: Russian Federation Associated individuals: Evgeniy Bashev Associated entities: GRU Unit 29155 | ‘Impuls’ LLC is a Russian company owned by Evgeniy Viktorovich Bashev, a member of Russian Military Intelligence Agency GRU, Unit 29155. The company provides technical and material support to cyber-attacks and attempted cyber-attacks conducted by GRU Unit 29155. In particular, ‘Impuls’ LLC serves as an operational intermediary enabling hacking-related activities to be carried out through a company formally unconnected to the Russian State. It facilitated operational cover, infrastructure and payments for cyber-attacks, and was connected to technical assets, including servers used in support of hacking activities. In particular, ‘Impuls’ LLC enabled cooperation between GRU structures and external hacker networks. The cyber operations facilitated by ‘Impuls’ LLC target critical state functions and services necessary for the maintenance of essential social and economic activities in the Member States, notably in the transport sector. Via the WhisperGate campaign, GRU Unit 29155 also targeted critical infrastructure of Ukraine. Therefore, ‘Impuls’ LLC provides technical and material support for, or is otherwise involved in, cyber-attacks with a significant effect, which constitute an external threat to the Member States, as well as cyber-attacks with a significant effect against a third country. | 13.7.2026 |
| 11. | Z-Pentest | Aliases: ‘Z-Pentest Alliance’, ‘Z-Alliance’ Principal place of business: Russian Federation Associated individuals: Yuliya Pankratova Associated entities: Cyber Army of Russia/CARR X.com account: ZPentest (Account suspended) Telegram account: Zpentestalliance | Z-Pentest is a pro-Russia hacktivist group, composed of members from CARR (Cyber Army of Russia Reborn) and NoName057, globally targeting critical infrastructure, especially the energy and water sector. Notably, the group attacked a Danish water utility in December 2024. Therefore, Z-Pentest is responsible for cyber-attacks with a significant effect, which constitute an external threat to the Member States. | 13.7.2026 |
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.