EU cyber sanctions regime extended to 18 May 2027 — annual Council renewal 11 May 2026

policy · policy:eu-cyber-sanctions-2027-renewal

Coverage timeline

first 2026-05-18 → last 2026-05-18

Briefs

1 distinct

Sources cited

13 hosts

Sections touched

weekly_summary

Co-occurring entities

see Related entities below

Story timeline

2026-05-18CTI Weekly Summary — 2026-W21 (Mon 18 – Sun 24, 2026)
weekly_summaryConsolidated in weekly summary for week 2026-W21

Where this entity is cited

weekly_summary1

Source distribution

helpnetsecurity.com4 (24%)
thehackernews.com2 (12%)
dig.watch1 (6%)
bleepingcomputer.com1 (6%)
cert.ssi.gouv.fr1 (6%)
computerweekly.com1 (6%)
correctiv.org1 (6%)
interpol.int1 (6%)
other5 (29%)

Related entities

Google Threat Intelligence Group AI Threat Tracker (May 2026) — first AI-generated zero-day exploit ITW; AI-augmented malware (CANFAIL, LONGSTREAM, PROMPTFLUX, HONESTCUE); state-actor Gemini abuse (UNC2814, APT45, APT27, UNC5673)
annual-reportannual-report:gtig-ai-threat-tracker-may-2026×1
UPDATE: Chaotic Eclipse Windows zero-days — MiniPlasma is third PoC (cldflt.sys CfAbortHydration, claimed CVE-2020-17103 regression on fully patched Win11)
campaignitem:windows-zero-day-proliferation-yellowkey-greenplasma-minipla×1
UPDATE: Grafana Labs CoinbaseCartel — victim confirms source-code-only theft via Pwn-Request, no customer data, ransom rejected on FBI guidance
incidentitem:grafana-labs-coinbasecartel-pwn-request-github-actions-breac×1
UPDATE: TeamPCP / Shai-Hulud — first copycat wave (OX Security npm packages w/ Phantom Bot + SSH/cloud stealers); Checkmarx Jenkins plugin trojanised (third in three months); SentinelLabs PCPJack rival worm
campaignitem:teampcp-shai-hulud-copycat-wave-ox-security-checkmarx-pcpja×1

All cited sources (17)

Items in briefs about EU cyber sanctions regime extended to 18 May 2027 — annual Council renewal 11 May 2026 (1)

EU cyber sanctions regime extended to 18 May 2027 — 19 individuals and 7 entities remain listed; Swiss SECO ordinance update expected [SINGLE-SOURCE: Digital Watch Observatory]

From CTI Weekly Summary — 2026-W21 (Mon 18 – Sun 24, 2026) · published 2026-05-18 · view item permalink →

The Council of the EU adopted on 11 May 2026 the annual renewal of individual and entity listings under the cyber sanctions regime (Decision 2019/797 / Regulation 2019/796) for one year, until 18 May 2027. The renewal preserves the current composition without new additions: 19 individuals and 7 entities subject to asset freezes, travel bans, and fund-transfer prohibitions. Switzerland aligns with EU cyber sanctions via SECO ordinances (SR 946.231.176.72); a corresponding SECO ordinance update is expected within days of the Council decision. Swiss financial institutions and operators conducting counterparty screening should monitor SECO for the updated ordinance.