The Council prolonged the EU restrictive measures (sanctions) against cyber-attacks threatening the EU and its member states until 18 May 2026. The legal framework is extended until 18 May 2028.