{
  "url": "https://openlegislation.uk/eu-decision-2019-797/annex/division-A",
  "json_url": "https://openlegislation.uk/eu-decision-2019-797/annex/division-A.json",
  "legislation": "eudn/2019/797",
  "legislation_title": "Council Decision (CFSP) 2019/797 of 17 May 2019 concerning restrictive measures against cyber-attacks threatening the Union or its Member States",
  "legislation_url": "https://openlegislation.uk/eu-decision-2019-797",
  "path": "annex/division/A",
  "kind": "division",
  "number": "A",
  "heading": "Natural persons",
  "text": "Name\nIdentifying information\nReasons\nDate of listing\n1.\nGAO Qiang\nDate of birth: 4 October 1983\nPlace of birth: Shandong Province, China\nAddress: Room 1102, Guanfu Mansion, 46 Xinkai Road, Hedong District, Tianjin, China\nNationality: Chinese\nGender: male\nGao Qiang is involved in ‘ Operation Cloud Hopper ’ , a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.\n‘ Operation Cloud Hopper ’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.\nThe actor publicly known as ‘ APT10 ’ ( ‘ Advanced Persistent Threat 10 ’ ) (a.k.a. ‘ Red Apollo ’ , ‘ CVNX ’ , ‘ Stone Panda ’ , ‘ MenuPass ’ and ‘ Potassium ’ ) carried out ‘ Operation Cloud Hopper ’ .\nGao Qiang can be linked to APT10, including through his association with APT10 command and control infrastructure. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating ‘ Operation Cloud Hopper ’ , employed Gao Qiang. He has links with Zhang Shilong, who is also designated in connection with ‘ Operation Cloud Hopper ’ . Gao Qiang is therefore associated with both Huaying Haitai and Zhang Shilong.\n30.7.2020\n2.\nZHANG Shilong\nDate of birth: 10 September 1981\nPlace of birth: China\nAddress: Hedong, Yuyang Road No 121, Tianjin, China\nNationality: Chinese\nGender: male\nZhang Shilong is involved in ‘ Operation Cloud Hopper ’ , a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.\n‘ Operation Cloud Hopper ’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.\nThe actor publicly known as ‘ APT10 ’ ( ‘ Advanced Persistent Threat 10 ’ ) (a.k.a. ‘ Red Apollo ’ , ‘ CVNX ’ , ‘ Stone Panda ’ , ‘ MenuPass ’ and ‘ Potassium ’ ) carried out ‘ Operation Cloud Hopper ’ .\nZhang Shilong can be linked to APT10, including through the malware he developed and tested in connection with the cyber-attacks carried out by APT10. Moreover, Huaying Haitai, an entity designated for providing support to and facilitating ‘ Operation Cloud Hopper ’ , employed Zhang Shilong. He has links with Gao Qiang, who is also designated in connection with ‘ Operation Cloud Hopper ’ . Zhang Shilong is therefore associated with both Huaying Haitai and Gao Qiang.\n30.7.2020\n3.\nAlexey Valeryevich MININ\nАлексей Валерьевич МИНИН\nDate of birth: 27 May 1972\nPlace of birth: Perm Oblast, Russian SFSR (now Russian Federation)\nPassport number: 120017582\nIssued by: Ministry of Foreign Affairs of the Russian Federation\nValidity: from 17 April 2017 until 17 April 2022\nLocation: Moscow, Russian Federation\nNationality: Russian\nGender: male\nAlexey Minin took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands.\nAs a human intelligence support officer of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Alexey Minin was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (DISS) (Militaire Inlichtingen- en Veiligheidsdienst – MIVD) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.\n30.7.2020\n4.\nAleksei Sergeyvich MORENETS\nАлексей Сергеевич МОРЕНЕЦ\nDate of birth: 31 July 1977\nPlace of birth: Murmanskaya Oblast, Russian SFSR (now Russian Federation)\nPassport number: 100135556\nIssued by: Ministry of Foreign Affairs of the Russian Federation\nValidity: from 17 April 2017 until 17 April 2022\nLocation: Moscow, Russian Federation\nNationality: Russian\nGender: male\nAleksei Morenets took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands.\nAs a cyber-operator for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Aleksei Morenets was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (DISS) (Militaire Inlichtingen- en Veiligheidsdienst – MIVD) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.\n30.7.2020\n5.\nEvgenii Mikhaylovich SEREBRIAKOV\nЕвгений Михайлович СЕРЕБРЯКОВ\nDate of birth: 26 July 1981\nPlace of birth: Kursk, Russian SFSR (now Russian Federation)\nPassport number: 100135555\nIssued by: Ministry of Foreign Affairs of the Russian Federation\nValidity: from 17 April 2017 until 17 April 2022\nLocation: Moscow, Russian Federation\nNationality: Russian\nGender: male\nEvgenii Serebriakov took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands.\nAs a cyber-operator for the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Evgenii Serebriakov was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (DISS) (Militaire Inlichtingen- en Veiligheidsdienst – MIVD) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.\n30.7.2020\n6.\nOleg Mikhaylovich SOTNIKOV\nОлег Михайлович СОТНИКОВ\nDate of birth: 24 August 1972\nPlace of birth: Ulyanovsk, Russian SFSR (now Russian Federation)\nPassport number: 120018866\nIssued by: Ministry of Foreign Affairs of the Russian Federation\nValidity: from 17 April 2017 until 17 April 2022\nLocation: Moscow, Russian Federation\nNationality: Russian\nGender: male\nOleg Sotnikov took part in an attempted cyber-attack with a potentially significant effect against the Organisation for the Prohibition of Chemical Weapons (OPCW), in the Netherlands.\nAs a human intelligence support officer of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Oleg Sotnikov was part of a team of four Russian military intelligence officers who attempted to gain unauthorised access to the Wi-Fi network of the OPCW in The Hague, the Netherlands, in April 2018. The attempted cyber-attack was aimed at hacking into the Wi-Fi network of the OPCW, which, if successful, would have compromised the security of the network and the OPCW’s ongoing investigatory work. The Netherlands Defence Intelligence and Security Service (DISS) (Militaire Inlichtingen- en Veiligheidsdienst – MIVD) disrupted the attempted cyber-attack, thereby preventing serious damage to the OPCW.\n30.7.2020\n7.\nDmitry Sergeyevich BADIN\nДмитрий Сергеевич БАДИН\nDate of birth: 15 November 1990\nPlace of birth: Kursk, Russian SFSR (now Russian Federation)\nNationality: Russian\nGender: male\nDmitry Badin took part in a cyber-attack with a significant effect against the German federal parliament (Deutscher Bundestag).\nAs a military intelligence officer of the 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), Dmitry Badin was part of a team of Russian military intelligence officers which conducted a cyber-attack against the German federal parliament (Deutscher Bundestag) in April and May 2015. This cyber-attack targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and the email accounts of several MPs as well as of Chancellor Angela Merkel were affected.\n22.10.2020\n8.\nIgor Olegovich KOSTYUKOV\nИгорь Олегович КОСТЮКОВ\nDate of birth: 21 February 1961\nNationality: Russian\nGender: male\nIgor Kostyukov is the current Head of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), where he previously served as First Deputy Head. One of the units under his command is the 85th Main Centre for Special Services (GTsSS), also known as ‘ military unit 26165 ’ (industry nicknames: ‘ APT28 ’ , ‘ Fancy Bear ’ , ‘ Sofacy Group ’ , ‘ Pawn Storm ’ and ‘ Strontium ’ ).\nIn this capacity, Igor Kostyukov is responsible for cyber-attacks carried out by the GTsSS, including those with a significant effect constituting an external threat to the Union or its Member States.\nIn particular, military intelligence officers of the GTsSS took part in the cyber-attack against the German federal parliament (Deutscher Bundestag) which took place in April and May 2015 and the attempted cyber-attack aimed at hacking into the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands in April 2018.\nThe cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and email accounts of several MPs as well as of Chancellor Angela Merkel were affected.\n22.10.2020",
  "extent": "E+W+S+N.I.",
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Inserted by Council Decision (CFSP) 2020/1127 of 30 July 2020 amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States."
    },
    {
      "type": "F",
      "label": "F2",
      "text": "Substituted by Council Decision (CFSP) 2020/1748 of 20 November 2020 amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States."
    },
    {
      "type": "F",
      "label": "F3",
      "text": "Inserted by Council Decision (CFSP) 2020/1537 of 22 October 2020 amending Decision (CFSP) 2019/797 concerning restrictive measures against cyber-attacks threatening the Union or its Member States."
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/eudn/2019/797/annex/division/A",
    "retrieved_at": "2026-11-01T15:12:42.435427+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}