Division B Legal persons, entities and bodiesF1

a.k.a.: Haitai Technology Development Co. Ltd

Location: Tianjin, China

Huaying Haitai provided financial, technical or material support for and facilitated ‘ Operation Cloud Hopper ’ , a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States.

‘ Operation Cloud Hopper ’ has targeted information systems of multinational companies in six continents, including companies located in the Union, and gained unauthorised access to commercially sensitive data, resulting in significant economic loss.

The actor publicly known as ‘ APT10 ’ ( ‘ Advanced Persistent Threat 10 ’ ) (a.k.a. ‘ Red Apollo ’ , ‘ CVNX ’ , ‘ Stone Panda ’ , ‘ MenuPass ’ and ‘ Potassium ’ ) carried out ‘ Operation Cloud Hopper ’ .

Huaying Haitai can be linked to APT10. Moreover, Huaying Haitai employed Gao Qiang and Zhang Shilong, who are both designated in connection with ‘ Operation Cloud Hopper ’ . Huaying Haitai is therefore associated with Gao Qiang and Zhang Shilong.

a.k.a.: Chosen Expo; Korea Export Joint Venture

Location: DPRK

Chosun Expo provided financial, technical or material support for and facilitated a series of cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and of cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘ WannaCry ’ and cyber-attacks against the Polish Financial Supervision Authority and Sony Pictures Entertainment, as well as cyber-theft from the Bangladesh Bank and attempted cyber-theft from the Vietnam Tien Phong Bank.

‘ WannaCry ’ disrupted information systems around the world by targeting information systems with ransomware and blocking access to data. It affected information systems of companies in the Union, including information systems relating to services necessary for the maintenance of essential services and economic activities within Member States.

The actor publicly known as ‘ APT38 ’ ( ‘ Advanced Persistent Threat 38 ’ ) or the ‘ Lazarus Group ’ carried out ‘ WannaCry ’ .

Chosun Expo can be linked to APT38/the Lazarus Group, including through the accounts used for the cyber-attacks.

The Main Centre for Special Technologies (GTsST) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), also known by its field post number 74455, is responsible for cyber-attacks with a significant effect originating from outside the Union and constituting an external threat to the Union or its Member States and for cyber-attacks with a significant effect against third States, including the cyber-attacks publicly known as ‘ NotPetya ’ or ‘ EternalPetya ’ in June 2017 and the cyber-attacks directed at an Ukrainian power grid in the winter of 2015 and 2016.

‘ NotPetya ’ or ‘ EternalPetya ’ rendered data inaccessible in a number of companies in the Union, wider Europe and worldwide, by targeting computers with ransomware and blocking access to data, resulting amongst others in significant economic loss. The cyber-attack on a Ukrainian power grid resulted in parts of it being switched off during winter.

The actor publicly known as ‘ Sandworm ’ (a.k.a. ‘ Sandworm Team ’ , ‘ BlackEnergy Group ’ , ‘ Voodoo Bear ’ , ‘ Quedagh ’ , ‘ Olympic Destroyer ’ and ‘ Telebots ’ ), which is also behind the attack on the Ukrainian power grid, carried out ‘ NotPetya ’ or ‘ EternalPetya ’ .

The Main Centre for Special Technologies of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation has an active role in the cyber-activities undertaken by Sandworm and can be linked to Sandworm.

The 85th Main Centre for Special Services (GTsSS) of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU), also known as ‘ military unit 26165 ’ (industry nicknames: ‘ APT28 ’ , ‘ Fancy Bear ’ , ‘ Sofacy Group ’ , ‘ Pawn Storm ’ and ‘ Strontium ’ ), is responsible for cyber-attacks with a significant effect constituting an external threat to the Union or its Member States.

In particular, military intelligence officers of the GTsSS took part in the cyber-attack against the German federal parliament (Deutscher Bundestag) which took place in April and May 2015 and the attempted cyber-attack aimed at hacking into the Wi-Fi network of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Netherlands in April 2018.

The cyber-attack against the German federal parliament targeted the parliament’s information system and affected its operation for several days. A significant amount of data was stolen and email accounts of several MPs as well as of Chancellor Angela Merkel were affected.