As part of the sustained, tailored and coordinated Union action against persistent cyber threat actors, three natural persons were included in the list of natural and legal persons, entities and bodies subject to restrictive measures set out in Annex I to Regulation (EU) 2019/796. Those persons are responsible for, or involved in, cyber-attacks with a significant effect which constitute an external threat to the Union or its Member States.