New Zealand sanctions Russian military hackers over cyberattacks on Ukraine

New Zealand has imposed sanctions on Russian military intelligence hackers accused of cyberattacks on Ukraine, including members of a notorious hacking unit previously tied to destructive malware campaigns.

The sanctions announced Friday target Unit 29155 of Russia’s GRU intelligence agency. Western security agencies say the unit — also tracked by researchers as Cadet Blizzard and Ember Bear — has been involved in espionage, sabotage, and assassination plots across Europe. It was behind the 2022 WhisperGate malware attack on Ukrainian government networks ahead of Moscow’s full-scale invasion.

“Russian state actors have been illegally using malware against Ukrainian government networks,” New Zealand Foreign Minister Winston Peters said in a statement on Friday, without giving further details.

Ukrainian President Volodymyr Zelensky welcomed the move, describing New Zealand’s latest sanctions on Russia as “a strong signal of support for Ukraine.”

The sanctions impose an asset freeze, a travel ban and prohibit New Zealand citizens and companies from making funds available to the designated entities.

According to a joint advisory by several U.S. federal agencies, Unit 29155 has since 2022 focused on disrupting aid to Ukraine through destructive cyber campaigns, data theft and reconnaissance operations in Europe, North America, Latin America and Central Asia. In 2024, the U.S. Justice Department indicted members of the unit and offered rewards of up to $10 million for information leading to their prosecution.

The hackers have also been targeted by sanctions elsewhere. In January, the European Union sanctioned three alleged members of Unit 29155 over cyberattacks on Estonian ministries in 2020 that stole thousands of confidential government and business documents. In July, Britain sanctioned three GRU units, including Unit 29155, accusing them of reconnaissance operations that facilitated strikes leading to civilian deaths in Ukraine.