Korea Export Joint Venture

Democratic People's Republic of Korea

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2020.246.01.0004.01.ENG&toc=OJ:L:2020:246:TOC

Chosun Expo provided financial, technical or material support for and facilitated a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘WannaCry’ and cyber-attacks against the Polish Financial Supervision Authority and Sony Pictures Entertainment, as well as cyber-theft from the Bangladesh Bank and attempted cyber-theft from the Vietnam Tien Phong Bank. ‘WannaCry’ disrupted information systems around the world by targeting information systems with ransomware and blocking access to data. It affected information systems of companies in the Union, including information systems relating to services necessary for the maintenance of essential services and economic activities within Member States. The actor publicly known as ‘APT38’ (‘Advanced Persistent Threat 38’) or the ‘Lazarus Group’ carried out ‘WannaCry’. Chosun Expo can be linked to APT38/the Lazarus Group, including through the accounts used for the cyber-attacks.

EU

2020/1125 (OJ L246)

(Designation details: 30.7.2020)

2020-07-30

EU

Restrictive measures against cyber-attacks threatening the Union or its Member States

EU-horizontal

Cyber-attacks

Asset freeze and prohibition to make funds available, Restrictions on admission

- All assets of the listed persons and entities should be frozen. It is also prohibited to make any funds or assets directly or indirectly available to them. - Member States shall enforce travel restrictions on persons listed in the Annex of Council Decision(CFSP) 2019/797.

Through the adoption of the “Cyber Diplomacy Toolbox” on 19 June 2017, the Council stressed the growing need to protect the integrity and security of the EU, its Member States and their citizens against cyber threats and malicious cyber activities. At the European Council on 18 October 2018, Member States called for the introduction of a new EU sanctions regime to build up the EU and its Member States’ capacity to respond to and to deter cyber-attacks. The Council established the new sanctions regime on 17 May 2019, introducing targeted restrictive measures against cyber-attacks threatening the Union or its Member States. The measures consist of asset freeze and travel ban of persons and/or entities responsible for cyber-attacks or attempted cyber-attacks, as well as those involved in or offering financial, technical or material support for these attacks and those who assist, encourage, facilitate or are associated with them.