Finance & Banking
,
Geo-Specific
,
Industry Specific
Chinese Hacking Firm iSoon and Iran’s Emennet Pasargad Among Targets
The European Union sanctioned three Chinese and Iranian hacking operations that have been under U.S. indictments or sanctions for over a year – or, in one case, since 2019.
See Also: Payment Fraud – Then and Now
The Council of the EU, the institution that represents national governments of the bloc’s member states, levied the sanctions on Monday. The targets include China’s Integrity Technology Group and Anxun Information Technology Co. – also known as iSoon – and Iran’s Emennet Pasargad, which is also known as Anzu Team or Holy Souls. Anxun chief executive officer Wu Haibo and chief operating officer Chen Cheng, both co-founders of that company, were also added to the sanctions list.
“Today’s decision confirms EU’s and its member states’ willingness to provide a strong and sustained response to persistent malicious cyber activities targeting the EU, its member states and partners,” the council said. “The EU and its member states will continue to cooperate with our international partners to promote an open, free, stable and secure cyberspace.”
The new sanctions freeze assets and forbid EU citizens and companies from funding or otherwise doing business with the targets. Wu and Chen are also now banned from entering or transiting through Europe.
“China firmly opposes the EU’s unlawful, unilateral sanctions against Chinese entities and urges the EU to rectify its erroneous practices,” Chinese foreign ministry spokesman Lin Jian reportedly said Tuesday.
Placing sanctions on malicious cyber actors is generally more of a symbolic gesture than a disruptive measure, but in these cases the timeliness of Europe’s response is also questionable.
The most headline-grabbing sanctions here – from a European perspective – are those applied to Emennet Pasargad, a Tehran-registered company that in 2023 stole and advertised the subscriber database for the French satirical magazine Charlie Hebdo, which had previously been the victim of a notorious 2015 Islamist terrorist attack.
At the time, Microsoft said the personal information of over 200,000 subscribers had been compromised. The software giant described the hacking group – which it dubbed Neptunium – as an “Iranian nation-state actor” and said its attack was likely a response to a Charlie Hebdo contest for cartoons ridiculing the now-late Iranian Supreme Leader Ali Khamenei.
According to the council’s sanctions-implementing regulation on Monday, the Iranian company also hijacked advertising billboards at the 2024 Paris Olympic Games to display propaganda and compromised a Swedish SMS service. The last incident is likely a reference to a 2023 incident in which the attackers messaged many Swedes to call for revenge against Koran burners, as the FBI also referred to that incident in a 2024 advisory about Emennet Pasargad.
The council document also notes the company’s attempted interference in the 2020 U.S. elections, when it purloined confidential voter information and used it to send threatening emails to voters, posing as far-right extremists.
The group’s U.S. activity earned indictments there for two of its contracted hackers, Seyyed Mohammad Hosein Musa Kazemi and Sajjad Kashian, in 2021. The U.S. Department of the Treasury had sanctioned the company two years previously. Nonetheless, Emennet Pasargad continues to remain active, being fingered in 2022 for a ransomware campaign that was allegedly backed by Iran’s Islamic Revolutionary Guard Corps (see: Iran Hackers Behind Attempt on US Election Are Still Active).
Beijing-based Integrity Technology Group found itself added to the EU sanctions list for facilitating cyberattacks linked to hacking activity commonly tracked as Flax Typhoon, which intelligence agencies said used leaked code from the notorious Mirai botnet, and had been active since 2021. Per the council, Flax Typhoon used Integrity Tech’s products and technology to compromise and access internet of things devices across Europe.
“Between 2022 and 2023, Flax Typhoon accessed at least 65,600 internet of things devices in six [EU] member states by using Integrity Technology Group’s products,” the Council wrote. But again, the EU’s newly-levied sanctions are somewhat behind the curve, with the U.S. having blacklisted Integrity in January 2025.
As for Anxun/iSoon founders Chen and Wu, the pair were among eight company workers who found themselves on the receiving end of U.S. indictments in early March 2025, following attacks on the New York State Assembly, the Defense Intelligence Agency, the Department of Commerce, two New York-based newspapers, and various other organizations and foreign ministries (see: US Prosecutors Indict iSoon Chinese Hacking Contractors).
iSoon crew had themselves fallen victim to an apparent 2024 leak of spreadsheets and chat logs that showed them taking assignments from China’s Ministry of Public Security in particular.
“No idea why the council decided to sanction iSoon and its two founders two years after the iSoon leak – nor why it took so long,” wrote Stefan Soesanto, the former cyber defense team lead at ETH Zurich’s Center for Security Studies, in a Monday post on X. He went on to say it was “a bit odd” that it had taken Europe so long to sanction Emennet Pasargad, given that it didn’t impose any personal sanctions on individuals working at that company.
At the time of publication, a council spokesperson did not respond to a request for comment on the timing of the new sanctions. In total, the EU has imposed cyber sanctions on 19 individuals and seven entities since creating the framework for the sanctions in 2019.
The United Kingdom, which introduced its own similar framework in 2020, hit Integrity Tech and iSoon with sanctions in December 2025, on the basis of “reckless and indiscriminate cyberattacks.” At the time, the National Cyber Security Center said it was “almost certain” that the companies supported Chinese nation-state operations. The U.K. now has cyber sanctions on 82 individuals and 13 organizations.
British law firm Mishcon de Reya in February said a freedom-of-information request had revealed the existence of five active investigations of potential breaches of the U.K. cyber sanctions regime. It said probes by the Treasury’s Office of Financial Sanctions Implementation were likely the result of “recent upgrades to OFSI’s technological and analytical capabilities.”
“The emergence of these recent cases represents a watershed moment for a sanctions program that, until recently, appeared largely theoretical,” the law firm wrote. “When cyber sanctions were first introduced, policymakers championed them as essential mechanisms for deterring and punishing malicious cyber activity. Yet for several years no breaches were identified, which left open the question of whether the regime was genuinely effective or whether enforcement agencies lacked the tools to identify non-compliance.”