Executive Summary

On March 17, 2026, the Council of the European Union announced new sanctions against three companies and two individuals based in China and Iran for their participation in malicious cyber activities. The restrictive measures, which include asset freezes and travel bans, target entities responsible for cyberattacks on EU critical infrastructure, media organizations, and democratic processes. The sanctioned firms are Iran's Emennet Pasargad and China's Anxun Information Technology (iSoon) and Integrity Technology Group. This action underscores the EU's commitment to using diplomatic and economic tools to deter and respond to malicious behavior in cyberspace.

Regulatory Details

The sanctions were adopted under the EU's cyber sanctions framework, which allows the Union to impose targeted restrictive measures on persons and entities responsible for cyberattacks that threaten the EU or its member states. The measures include:

• An asset freeze on all funds and economic resources belonging to the listed individuals and entities.
• A prohibition on making funds or economic resources available to them.
• A travel ban preventing the listed individuals from entering or transiting through EU territories.

Affected Organizations

Emennet Pasargad (Iran)

This Tehran-based company is identified as a front for Iranian state-sponsored cyber operations. The EU Council linked Emennet to several malicious campaigns:

• Charlie Hebdo Data Leak (2023): A data breach against the French satirical magazine where the subscriber database of over 200,000 individuals was stolen and offered for sale.
• Disinformation Campaigns: Hacking a Swedish SMS service and spreading disinformation during the 2024 Paris Olympic Games.
• U.S. Election Interference (2020): The FBI had previously connected the group to efforts to interfere in the 2020 U.S. presidential election.

Anxun Information Technology / iSoon (China)

Known as iSoon, this company was identified as a hack-for-hire contractor working for the Chinese government and military. Despite claiming to be a cybersecurity training firm, iSoon was sanctioned for developing and providing offensive cyber capabilities used in attacks targeting critical infrastructure within the EU. The two co-founders of iSoon were also sanctioned individually.

Integrity Technology Group (China)

This Chinese firm was sanctioned for supporting cyber operations that compromised over 65,000 devices across six EU member states between 2022 and 2023. The U.S. Treasury had previously sanctioned Integrity Technology in January 2025 for its connections to the Chinese state-backed threat actor Flax Typhoon (also known as Ethereal Panda).

Impact Assessment

The sanctions are designed to have a significant financial and operational impact on the targeted entities by cutting off their access to the EU's financial system and restricting the travel of key personnel. More broadly, the action serves as a strong geopolitical signal to China and Iran, demonstrating the EU's willingness to attribute and impose costs for malicious cyber activities. For businesses within the EU, the sanctions create a compliance obligation, as they are now prohibited from conducting any transactions with the listed entities. This move aims to disrupt the business model of hack-for-hire groups and state-sponsored front companies.

Compliance Guidance

EU citizens and companies must immediately cease all financial dealings with the sanctioned entities and individuals. This includes:

1. Screening: Update and screen all customer, vendor, and partner lists against the new EU sanctions list.
2. Asset Freezing: Any funds or economic resources held on behalf of the sanctioned parties must be frozen, and the relevant national authorities must be notified.
3. Due Diligence: Enhance due diligence processes, particularly for partners operating in or connected to the cybersecurity sectors in China and Iran, to avoid inadvertently engaging with sanctioned entities or their affiliates.
4. Reporting: Report any identified links or transactions to the appropriate national competent authority.