EU Sanctions Iranian Cyber Crew Behind US Election Tampering

The European Union has imposed economic sanctions on Emennet Pasargad, an Iranian company operating as a front for state-sponsored cyberattacks, for its role in interfering with US elections and breaching the subscriber database of French satirical magazine Charlie Hebdo.

According to the Council of the European Union, Emennet Pasargad orchestrated a campaign of disinformation during the 2020 US election by operating spoofed media sites that spread anti-American propaganda. The FBI previously linked these efforts to attempts to provoke heated political exchanges among voters and undermine confidence in election security, though the agency did not name the group at the time of its initial investigation.

The sanctions come after years of escalating cyber operations attributed to the group. In early 2023, Microsoft revealed that Emennet Pasargad had compromised and leaked the personal data of over 200,000 Charlie Hebdo subscribers on the dark web. The attack was described as retaliation for the magazine's publication of cartoons depicting the Prophet Muhammad, which have repeatedly drawn threats and violence from extremist groups.

Charlie Hebdo's offices were infamously targeted in a terror attack in 2015 by two Algerian brothers who killed twelve people, including several cartoonists, in response to the magazine's publication of controversial religious imagery. The magazine has continued publishing provocative content despite ongoing security threats.

Beyond election interference and data breaches, the Council identified additional operations by Emennet Pasargad. The group compromised a Swedish company's SMS service after activists burned Qurans during a 2023 protest, sending approximately 15,000 threatening messages warning of retaliation. Sweden's intelligence service later linked these attacks to the Iranian Revolutionary Guard Corps (IRGC) and a cyber group operating under the alias "Anzu Team."

The sanctions also address Emennet Pasargad's involvement in disrupting the 2024 Paris Olympics. The group compromised an advertising board operator to display anti-Israel propaganda during the international sporting event, according to Council documents.

In a broader move against state-sponsored cyber threats, the EU also sanctioned two Chinese organizations and two individuals. Integrity Technology Group was sanctioned for enabling Flax Typhoon, a Chinese state-sponsored cyberespionage group that compromised at least 65,600 IoT devices across six EU member states between 2022 and 2023. Researchers from Microsoft and Eclypsium have documented Flax Typhoon's focus on Taiwan, where it builds botnets by compromising IoT devices to gain covert network access.

The Council also sanctioned Anxun Information Technology, commonly known as i-Soon, following a landmark data leak in 2024 that exposed its role as a hack-for-hire service contracted by Beijing. The leaked files revealed that i-Soon targeted critical infrastructure and state functions in EU member states, accessing and selling classified information. The Council sanctioned CEO Wu Haibo and COO Chen Cheng for their responsibility in directing these operations.

These sanctions represent the EU's latest effort to impose economic penalties on organizations behind cyberattacks that threaten member states and third countries. The Council characterized Emennet Pasargad's activities as constituting "an external threat to member states" and "cyberattacks with a significant effect against a third state."

The coordinated sanctions against Iranian and Chinese entities underscore growing concerns about state-sponsored cyber operations targeting democratic institutions, critical infrastructure, and public events. By naming and sanctioning these organizations, the EU aims to disrupt their operations and signal that such activities carry significant economic consequences.