EU Sanctions Chinese and Iranian Firms and Two Individuals Over Cyberattacks
Summary
The EU sanctioned three Chinese and Iranian companies and two individuals over cyber operations, citing support for the Raptor Train botnet, i-Soon hacking-for-hire activity, and Emennet Pasargad influence campaigns. Measures include asset freezes and travel bans.
Key points
- The EU sanctioned Integrity Technology Group, Anxun Information Technology (i-Soon), Emennet Pasargad, and Anxun’s two co-founders.
- The EU cited Integrity Technology Group’s support for Raptor Train in 2022–2023, which it says led to more than 65,000 devices being compromised across six EU states.
- Anxun provided hacker-for-hire services targeting critical infrastructure, according to the article; a 2024 data leak exposed the company’s internal operations and offensive toolkit.
- Emennet Pasargad has been linked to influence campaigns and the hijacking of advertising billboards during the 2024 Paris Olympics.
- Microsoft reported that an actor using the name Holy Souls offered information on 230,000 Charlie Hebdo subscribers for sale and published a sample.
- The EU measures impose asset freezes and restrict access to funds; the listed individuals also face travel bans.
Article Details
- Event Type
- EU cyber sanctions against three companies and two individuals for cyberattacks and related malicious activity.
- Impact
- The sanctioned entities face asset freezes and restrictions on receiving funds or economic resources from EU citizens and companies; named individuals also face travel bans. The reported activity includes a botnet compromising more than 65,000 devices across six EU states, attacks targeting critical infrastructure, an SMS-service compromise in Sweden, and the offering for sale of personal data belonging to 230,000 Charlie Hebdo subscribers.
Threat Actors
Flax TyphoonThe article describes Flax Typhoon as a Chinese state-sponsored threat actor believed to have operated the Raptor Train botnet; the attribution is presented as a belief, not a confirmed fact.Holy SoulsAccording to Microsoft, an actor using the moniker Holy Souls offered to sell personal information belonging to 230,000 Charlie Hebdo subscribers and published a sample of the stolen details.
Vendors
Anxun Information Technologysupport that enabled the Raptor Train botnet to compromise tens of thousands of devices, Anxun Information Technology and its coâfounders for hackerâforâhire operations against critical functions, andEmennet PasargadTechnology and its coâfounders for hackerâforâhire operations against critical functions, and Emennet Pasargad for influence campaigns and the compromise and sale of Charlie Hebdo subscriber data; listedIntegrity Technology GroupSanctions target Integrity Technology Group for providing technical support that enabled the Raptor Train botnet to compromise tens of thousands of devices, Anxun Information Technology and its coâfounders for
Countries
ChinaThe Council of the European Union has sanctioned three companies from China and Iran and two individuals for cyberattacks that targeted devices and critical infrastructure across EU member states.IranThe Council of the European Union has sanctioned three companies from China and Iran and two individuals for cyberattacks that targeted devices and critical infrastructure across EU member states.SwedenThe sanctioned Iranian company is Emennet Pasargad, which has been attributed multiple influence campaigns and the compromise of an SMS service in Sweden.