The European Union has imposed targeted sanctions on three state-affiliated cyber contractors, China’s Integrity Technology Group (Flax Typhoon) and i-Soon, and Iran’s Emennet Pasargad, for operations that compromised approximately 65,000 SOHO and edge devices across six EU member states, disrupted Swedish SMS infrastructure, and exposed Charlie Hebdo subscriber data. These sanctions mirror 2025 U.S. Treasury OFAC designations against the same Chinese entities, signaling coordinated Western cost-imposition. Organizations operating critical infrastructure in the EU, particularly those with SOHO router exposure or public-facing systems, face elevated risk from contractor-model threat actors who sell persistent access to state customers.