EU Sanctions Chinese and Iranian Firms for State‑Sponsored Cyberattacks Targeting Critical Infrastructure
What Happened — The European Union Council placed sanctions on three companies—Integrity Technology Group, Anxun Information Technology, and Emennet Pasargad—and two individuals (the co‑founders of Anxun). The entities were accused of providing hacking‑as‑a‑service, operating the “Raptor Train” botnet that compromised more than 65 000 devices across six EU member states, and running influence‑campaign operations that hijacked advertising billboards and sold personal data of 230 000 French magazine subscribers.
Why It Matters for TPRM
- State‑backed threat actors are now explicitly listed as sanctioned parties, creating legal and reputational risk for any third‑party that engages them.
- The attacks demonstrate a supply‑chain threat model: compromised devices can be embedded in critical‑infrastructure environments of vendors and their customers.
- Sanctions trigger asset‑freeze and travel‑ban obligations that may affect contracts, payments, and cross‑border collaborations.
Who Is Affected — Critical‑infrastructure operators, telecom providers, advertising/marketing firms, media publishers, cloud‑service providers, and any organization that sources hardware or software from the sanctioned entities or their affiliates.
Recommended Actions
- Conduct an immediate review of all contracts and payments to any vendors with ties to China or Iran, especially those providing networking hardware, IoT devices, or managed services.
- Verify that no assets, funds, or services are being transferred to the listed entities or individuals; update sanctions screening lists accordingly.
- Enhance monitoring for botnet‑related traffic (e.g., Raptor Train signatures) and for credential‑theft indicators tied to the “Holy Souls” forum.
- Incorporate the sanction details into your threat‑intel feeds and incident‑response playbooks for supply‑chain compromise.
Technical Notes — The Raptor Train botnet leveraged malware implants to create a 260 000‑device network; Anxun advertised hacker‑for‑hire services via underground forums; Emennet Pasargad conducted influence campaigns through compromised SMS services and billboard hijacking. No specific CVEs were disclosed. Source: BleepingComputer