EU sanctions Integrity Technology, i-Soon and Emennet Pasargad over cyberattacks
On 16 March 2026 the EU sanctioned two Chinese firms, an Iranian firm and two i-Soon co-founders over cyberattacks. What it means for edge-device owners.
On 16 March 2026, the Council of the EU added three companies and two people to its cyber sanctions list: two Chinese firms linked to state-backed hacking and an Iranian company behind influence and intrusion operations in Europe. Sanctions don't patch anything. They do tell you which kinds of attacks European governments consider serious, and one of the cases is about the routers and IP cameras that many engineering teams run and forget about.
What happened
The Council adopted Decision (CFSP) 2026/588 and Implementing Regulation (EU) 2026/589 under its horizontal cyber sanctions framework, which was created in May 2019. The new listings are:
- Integrity Technology Group (China). According to the Council, its products were used to compromise devices in member states and elsewhere, and its technical and material support led to more than 65,000 devices being hacked across six member states in 2022–2023. The US Treasury sanctioned the same company in January 2025 over its links to Flax Typhoon, the group behind the "Raptor Train" botnet of compromised routers, cameras and NAS devices.
- Anxun Information Technology, better known as i-Soon (China), for selling hacking services aimed at critical infrastructure and critical functions in member states and other countries. Two co-founders were sanctioned as individuals. The US sanctioned i-Soon in March 2025, and a 2024 leak exposed its internal tools and client work.
- Emennet Pasargad (Iran), for breaching a French subscriber database and offering its contents for sale, hijacking advertising billboards to spread disinformation during the Paris 2024 Olympics, and compromising a Swedish SMS service that reached many EU citizens.
Listed entities and people face an asset freeze and a ban on anyone in the EU making funds or economic resources available to them. The two individuals are also banned from entering or transiting EU territory. With these additions, the regime covers 19 individuals and 7 entities.
Who is affected
Directly, only the listed parties and any EU company that does business with them. That company would now be breaching sanctions. Indirectly, the cases point at three groups:
- Operators of internet-facing edge devices (SOHO routers, IP cameras, NVRs, NAS), which are the raw material for botnets like Raptor Train.
- Organisations that rely on contractors or outsourced security work, since i-Soon shows that state-linked hacking is often done by private companies working on contract.
- Owners of messaging and SMS platforms and subscriber databases, which Emennet Pasargad used for influence operations, not just for stealing data.
What it means for developers and engineering teams
For most teams the sanctions are background information, but the Integrity Technology case is a practical reminder. Botnets like Raptor Train are built from devices that are reachable from the internet, run outdated firmware, and have admin interfaces exposed. Those devices then serve as proxies for attacks that appear to come from residential or corporate IP addresses. If your office, lab or IoT product line includes such devices, they can end up in someone else's attack infrastructure without any visible effect on you.
The Emennet Pasargad case matters for anyone building notification or messaging systems. Taking over an SMS gateway or billboard controller gives an attacker a trusted channel to large audiences. Credentials for bulk-messaging APIs should get the same protection as production database credentials.
There is also a compliance side. If your company buys security tools, pentesting or data from vendors, sanctioned entities have to be screened out of the supply chain.
What to do now
- Inventory edge devices (routers, cameras, NVRs, NAS). Patch or replace anything that is end-of-life, and take management interfaces off the public internet.
- Change default credentials and turn off UPnP and remote administration on SOHO gear unless you need them.
- Check outbound traffic from IoT network segments, looking for unexpected proxy-like connections or high fan-out. Botnet nodes often show up as steady outbound flows to many destinations.
- Lock down messaging APIs: scope SMS and push-notification credentials to specific templates or senders, rate-limit them, and alert on unusual send volumes.
- Screen vendors against the EU consolidated sanctions list when procurement involves security services, data or hardware.