EU sanctions three members of Russia’s GRU who committed cyberattacks against Estonia

EU sanctions three members of Russia’s GRU who committed cyberattacks against Estonia. Photo: Sander Ilvest

The European Union on Monday imposed sanctions on three staffers of Russia's military intelligence agency GRU, who conducted a cyberattack against Estonia in May 2020.

Last autumn, after a national investigation, Estonia made the first ever attribution of cyberattacks against the state to the perpetrators, that is, GRU operatives Yuri Denisov, Nikolay Korchagin and Vitali Shevchenko, and declared them international fugitives.

Together with allies and partners, including the United States, Ukraine, Germany, Latvia, the Netherlands and the Czech Republic, a technical advisory was published to warn against the malicious cyber operations of this group.

GRU Unit 29155 targets government entities as well as critical infrastructure of the EU, NATO and other nations with an aim to disrupt support to Ukraine.

Now, EU-wide restrictive measures were imposed on the same GRU members under the cyber sanctions regime. Supporting the decision at the Foreign Affairs Council in Brussels, Estonian Foreign Minister Margus Tsahkna said that Russia is trying to undermine Western unity with hybrid actions, and sow fear and chaos in society.

«One of the tools of the aggressor is cyberattacks against contemporary countries -- including Estonia -- where a large part of services are digital,» Tsahkna said. «We are not blind and we can see through this pattern.»

Tsahkna added that in cooperation with international partners, Estonia will continue working to uphold safety, security, and values. Estonia also stands for all countries respecting international law in cyberspace.

In May 2019, the EU established a sanctions framework or so-called cyber sanctions regime that allows the EU to impose targeted restrictive measures to prevent and respond to cyberattacks if they pose an external threat to the EU or its member states.

The sanctions regime covers cyberattacks that have a significant impact and come from outside the EU; use infrastructure located outside the EU; are committed by individuals or entities operating outside the EU; or are conducted with support from individuals or entities operating outside the EU. Restrictive measures include a ban on traveling to the EU, and an asset freeze for individuals or entities.