Name

Identifying information

Reasons

Date of listing

‘9.

Ruslan Aleksandrovich PERETYATKO

Руслан Александрович ПЕРЕТЯТЬКО

Date of birth: 3.8.1985

Nationality: Russian

Gender: Male

Ruslan Peretyatko took part in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

Ruslan Peretyatko is part of the “Callisto group” of Russian military intelligence officers conducting cyber operations against EU Member States and third states.

Callisto Group (a.k.a. “Seaborgium”, “Star Blizzard”, “ColdRiver”, “TA446”) has launched multi-year phishing campaigns used to steal account credentials and data. Furthermore, the Callisto group is responsible for campaigns targeting individuals and critical state functions, including in the areas of defence and external relations.

Therefore, Ruslan Peretyatko is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

10.

Andrey Stanislavovich KORINETS

Андрей Станиславович КОРИНЕЦ

Date of birth: 18.5.1987

Place of birth: City of Syktyvkar, Russia

Nationality: Russian

Gender: Male

Andrey Stanislavovich Korinets took part in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

Andrey Stanislavovich Korinets is an officer of “Center 18” of the Federal Security Service (FSB) of the Russian Federation. Andrey Stanislavovich Korinets is part of the “Callisto group” of Russian military intelligence officers conducting cyber operations against EU Member States and third states.

Callisto Group (a.k.a. “Seaborgium”, “Star Blizzard”, “ColdRiver”, “TA446”) has launched multi-year phishing campaigns used to steal account credentials and data. Furthermore, the Callisto group is responsible for campaigns targeting individuals and critical state functions, including in the areas of defence and external relations.

Therefore, Andrey Stanislavovich Korinets is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

11.

Oleksandr SKLIANKO

Александр СКЛЯНКО (Russian spelling)

Олександр СКЛЯНКО (Ukrainian spelling)

Date of birth: 5.8.1973

Passport: EC 867868, issued on 27.11.1998 (Ukraine)

Gender: male

Oleksandr Sklianko took part in cyberattacks with a significant effect against EU Member States, as well as cyberattacks with a significant effect against third states.

Oleksandr Sklianko is part of the “Armageddon” hacker group supported by the Federal Security Service (FSB) of the Russian Federation that carried out various cyberattacks with a significant effect on the government of Ukraine and on EU Member States and their government officials, including by using phishing emails and malware campaigns.

Therefore, Oleksandr Sklianko is involved in cyberattacks with a significant effect against third states, as well as in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

12.

Mykola CHERNYKH

Николай ЧЕРНЫХ (Russian spelling)

Микола ЧЕРНИХ (Ukrainian spelling)

Date of birth: 12.10.1978

Passport: EC 922162, issued on 20.01.1999 (Ukraine)

Gender: male

Mykola Chernykh took part in cyberattacks with a significant effect against EU Member States, as well as cyberattacks with a significant effect against third states.

Mykola Chernykh is part of the “Armageddon” hacker group supported by the Federal Security Service (FSB) of the Russian Federation that carried out various cyberattacks with a significant effect on the government of Ukraine and on EU Member States and their government officials, including by using phishing emails and malware campaigns.

As a former employee of the Security Service of Ukraine, he is charged in Ukraine with treason and unauthorised interference in the operation of electronic computing machines and automated systems.

Therefore, Mykola Chernykh is involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

13.

Mikhail Mikhailovich TSAREV

Михаил Михайлович ЦАРЕВ

Date of birth: 20.4.1989

Place of birth: Serpukhov, Russian Federation

Nationality: Russian

Address: Serpukhov

Gender: male

Mikhail Mikhailovich Tsarev took part in cyberattacks with a significant effect, which constitute an external threat to EU Member States.

Mikhail Mikhailovich Tsarev, also known by the online monikers “Mango”, “Alexander Grachev”, “Super Misha”, “Ivanov Mixail”, “Misha Krutysha”, and “Nikita Andreevich Tsarev” is a key-player in the deployment of the “Conti” and “Trickbot” malware programs, and is involved in the Russia-based threat group “Wizard Spider”.

The Conti and Trickbot malware programs were created and developed by Wizard Spider. Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking. The group has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, “Ryuk” and TrickBot, are responsible for substantial economic damage in the European Union.

Mikhail Mikhailovich Tsarev is therefore involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024

14.

Maksim Sergeevich GALOCHKIN

Максим Сергеевич ГАЛОЧКИН

Date of birth: 19.5.1982

Place of birth: Abakan, Russian Federation

Nationality: Russian

Gender: male

Maksim Galochkin took part in cyberattacks with a significant effect, which constitute an external threat to EU Member States.

Maksim Galochkin is also known by the online monikers “Benalen”, “Bentley”, “Volhvb”, “volhvb”, “manuel”, “Max17” and “Crypt”. Galochkin is a key player in the deployment of the “Conti” and “Trickbot” malware programs and is involved in the Russia-based threat group “Wizard Spider”. He has led a group of testers, with responsibilities for the development, supervision, and implementation of tests for the TrickBot malware program, created and deployed by Wizard Spider.

Wizard Spider has conducted ransomware campaigns in a variety of sectors, including essential services such as health and banking. The group has infected computers worldwide and their malware has been developed into a highly modular malware suite. Campaigns by Wizard Spider, using malware such as Conti, “Ryuk” and TrickBot, are responsible for substantial economic damage in the European Union.

Maksim Galochkin is therefore involved in cyberattacks with a significant effect, which constitute an external threat to the Union or its Member States.

24.6.2024’