EU slaps sanctions on GRU leader, Fancy Bear, FBI

It's just the second time the EU has used its cyber sanctions powers.

The European Union on Thursday sanctioned the head of a Russian military intelligence unit, an alleged hacker wanted by the FBI and a Russian government-linked hacking group over a 2015 cyberattack against Germany’s parliament.

It’s only the second time the EU has issued cyber-related sanctions, following July sanctions against Russia, China and North Korea in connection with a string of unrelated cyberattacks. Now, as then, the General Staff Main Intelligence Directorate, commonly known as the GRU, is among the targets of the EU’s ire.

Igor Kostyukov, head of the GRU, was hit with sanctions in Thursday’s action over the Bundestag hack. So, too, was alleged intelligence officer Dmitry Badin, previously indicted in the U.S. for his role in 2016 election interference. The EU also sanctioned the GRU-connected hacking group known as Fancy Bear, among other names, which the U.S. has likewise connected to 2016 election meddling.

“The cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days,” the sanctions listing reads. “A significant amount of data was stolen and email accounts of several MPs as well as of Chancellor Angela Merkel were affected.”

The sanctions include travel bans and asset freezes. Russia has contended that Germany has presented no evidence of its involvement.

While the sanctions apply across the pond, they stand to bolster the U.S. position, too. Germany charged Badin in the Bundestag hack, something a top Justice Department official praised in an interview Wednesday for CyberTalks, the annual summit produced by CyberScoop.

It’s part of a broader trend toward international allies’ attribution of attacks that is “very helpful” and something the U.S. has made an important objective, said John Demers, the assistant attorney general for national security.

“One of the big things we’re trying to do with our charges and our calling it out is establish norms of acceptable behavior by countries in cyberspace,” Demers said. “If it’s just us, it’s easy for the Chinese government or the Russian government or the Iranians to just say, ’Oh, no, this is just the U.S. being mad at us over whatever other issue, and they’re just using this as a political tool.’”

Sean Lyngaas contributed reporting.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure