Cyber-attacks: Council extends sanctions and legal framework

The Council today decided to prolong the restrictive measures (sanctions) against cyber-attacks threatening the EU and its member states for a further year, until 18 May 2026. The legal framework (sanctions regime) for these measures is extended for three years until 18 May 2028.

This framework allows the EU to impose targeted restrictive measures on persons or entities involved in cyber-attacks which cause a significant impact, and constitute an external threat to the EU or its member states. Restrictive measures can also be imposed in response to cyber-attacks against third states or international organisations, where such measures are considered necessary to achieve the objectives of the Common Foreign and Security Policy (CFSP).

With these restrictive measures, the EU seeks to deter malicious cyber activities and uphold the international rules-based order by ensuring that those responsible are held to account.

Restrictive measures currently apply to 17 individuals and four entities, and include an asset freeze and the provision of funds or economic resources, directly or indirectly, to them or for their benefit is prohibited. Additionally, a travel ban to the EU applies to the natural persons listed.

These individual listings will continue to be reviewed every 12 months.

Today's decision confirms the willingness of the EU and its member states to provide a strong and sustained response to persistent malicious cyber activities targeting the EU, its member states and partners.

The EU and its member states will continue to cooperate with our international partners to promote an open, free, stable and secure cyberspace.

Background

In June 2017, the EU established a Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities (the "cyber diplomacy toolbox"). The framework allows the EU and its member states to use all CFSP measures, including restrictive measures if necessary, to prevent, discourage, deter and respond to malicious cyber activities targeting the integrity and security of the EU and its member states. The cyber diplomacy toolbox was revised in 2023 to allow the development of sustained, tailored, coherent and coordinated strategies towards persistent cyber threat actors.

The EU framework for restrictive measures against cyber-attacks threatening the EU and its member states was set up in May 2019.

• Cyber-attacks: three individuals added to EU sanctions list for malicious cyber activities against Estonia (press release, 27 January 2025)
• Council decision concerning restrictive measures against cyber-attacks threatening the Union or its Member States (consolidated text dated 27 January 2025)
• How the EU is strengthening its cybersecurity (background information)