Cyber & Technology — 2026-07-14

Treasury Sanctions First VPN Service and Malware Cryptor Seller for Enabling Ransomware Attacks on US Hospitals and Businesses

BLUFSanctioning shared criminal infrastructure rather than individual ransomware crews tests whether asset freezes can durably raise costs across an ecosystem built for rapid vendor substitution.

The Treasury Department's Office of Foreign Assets Control on Monday sanctioned VPN provider First VPN Service (1VPNS), its administrator Ukrainian national Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev, who sold malware-disguising "cryptor" tools to ransomware operators 1. OFAC said ransomware groups used 1VPNS's services to hide attack origins, deploy malware, and manage stolen data, with victims including US businesses, financial services firms, hospitals, and municipal governments 123. Treasury said the resulting ransomware attacks caused billions of dollars in losses to US businesses and critical infrastructure providers 134. The action, coordinated with the UK's Foreign, Commonwealth & Development Office, follows a May takedown of 1VPNS's infrastructure by European law enforcement with FBI Boston Field Office support 14. Europol said it arrested the service's administrator during that takedown, though Treasury did not confirm whether that individual is Rashevskyi 2.

Analysis
Treasury's designation targets the anonymization and cryptor infrastructure shared across ransomware groups rather than the operators themselves, converting May's law-enforcement seizure of 1VPNS's servers into an asset freeze against those who ran and supplied it. Disruption of ongoing campaigns hinges on how quickly replacement VPN and cryptor vendors absorb the displaced customer base, a substitution risk sanctions alone cannot foreclose. Treasury's refusal to confirm whether Rashevskyi is the administrator Europol already arrested leaves unresolved whether the designation freezes an operator still at large or one already in custody, and reporting converges so tightly on the Treasury press release, with other outlets restating rather than independently sourcing its findings, that the coverage amounts to a single evidentiary base. The action may function largely as a symbolic capstone to an infrastructure takedown already completed months earlier rather than a fresh operational blow.

4 sources

Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans - U.S. Department of the Treasury
Treasury sanctions First VPN Service, others for abetting ransomware gangs - CyberScoop
VPN service favored by ransomware groups is sanctioned by US - The Record from Recorded Future News
US sanctions VPN, malware providers for enabling ransomware attacks - BleepingComputer