In addition, the OFAC sanctioned Belarusian national Yegeniy Vladimirovich Silayev for allegedly selling cryptors – software used to camouflage ransomware and other malicious computer programs.
According to the Treasury, ransomware groups that use the services of 1VPNS have already generated billions of dollars in losses for businesses and critical infrastructure in the United States. The victims of such attacks include hospitals, local governments, banks, and other organizations.
The Treasury alleges that First VPN Service has been operating since 2014 and has been marketing itself on hacker forums as a privacy-focused provider that does not store any information on its users and does not respond to any legal requests. In addition, investigators allege that Rashevskyi used the nicknames Maksim Sorin and Roman Chabanenko to sign up for hosting services from other companies that had declined to provide services to First VPN Service due to illegal activities.
Furthermore, the Treasury alleges that First VPN Service has been used to mask the Internet Protocol (IP) address of users who utilize the service to conceal their tracks on the web. In addition, the accused used the VPN to hide the origin of ransomware distribution, attack infrastructure, and exfiltrate data during cyber-espionage and ransomware operations.
Silayev, who is not affiliated with First VPN Service, has been accused of selling encryption and obfuscation tools that enable malicious software to elude detection by cybersecurity software, thus increasing the software’s success rate.
The sanctions imposed on the individuals and entities involved prevent them from accessing any property or funds in the United States or controlled by Americans.
In addition, Americans are generally prohibited from dealing with them, and entities owned at least 50% by the sanctioned individuals or entities are also banned. According to the Treasury, the sanctions will disrupt ransomware cybercriminals’ ability to operate and deter organizations from supporting ransomware groups by continuing to offer their services.
The action taken by the OFAC comes after an international law enforcement operation that dismantled First VPN Service in May 2026. During the operation, European authorities and the FBI searched 33 servers, one surface web domain, and one Tor domain, as well as a Ukrainian residence.
In addition, investigators identified individuals who purchased the service from the company.
The recent sanctions imposed by the Treasury on First VPN Service and its administrator follow the Treasury’s sanctions against the infrastructure of the 911 S5 botnet, which disrupted hundreds of thousands of computers using free VPN applications that doubled as anonymous proxy servers for cybercriminals in 2024.
