The US Department of the Treasury's Office of Foreign Assets Control (OFAC) has imposed sanctions on a virtual private network (VPN) provider, its administrator and a Belarusian malware service operator, accusing them of supplying infrastructure and tools that helped ransomware groups carry out attacks against organisations across the United States.
The sanctions target First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev. US officials say the three played key roles in supporting the wider ransomware ecosystem by providing services that allowed threat actors to conceal their identities, evade security tools and sustain cybercriminal operations.
According to the Treasury Department, 1VPNS has been operating since 2014 and openly marketed its services on cybercrime forums frequented by ransomware operators and other malicious actors. The VPN provider reportedly promoted a strict no-logs policy, claiming it did not retain records of users' online activity or identities and would not cooperate with law enforcement requests. Investigators allege these assurances made the service particularly attractive to cybercriminals seeking to obscure their activities.
Authorities also accuse Rashevskyi of using fraudulent identities, including the aliases "Maksim Sorin" and "Roman Chabanenko," to obtain internet infrastructure from service providers that would otherwise have declined to host the operation because of repeated abuse complaints. Officials say the use of false identities enabled the VPN service to continue operating despite growing scrutiny from infrastructure providers.
The sanctions follow a multinational law enforcement operation that dismantled 1VPNS earlier this year. In May, European authorities, working alongside the FBI's Boston Field Office, seized the service's website and infrastructure as part of Operation Saffron, a coordinated investigation led by French and Dutch law enforcement agencies.
The investigation into 1VPNS began in December 2021, when authorities successfully infiltrated the VPN provider's infrastructure. Investigators quietly gathered intelligence, including access to the service's customer database, before ultimately dismantling the operation after several years of surveillance and evidence collection.
During the coordinated enforcement action, authorities seized 33 servers spread across 27 countries, arrested the service's administrator and identified thousands of users allegedly linked to ransomware operations, online fraud and other forms of cybercrime. Europol previously stated that 1VPNS had appeared in nearly every major cybercrime investigation it supported, underscoring the service's alleged role within the broader cybercriminal ecosystem.
US officials said organisations affected by ransomware attacks involving infrastructure provided by 1VPNS included businesses, hospitals, financial institutions and municipal governments. These sectors have increasingly become frequent targets of ransomware campaigns because operational disruption often places significant pressure on victims to pay extortion demands.
In a separate but related action, OFAC also sanctioned Silayev for allegedly developing and selling cryptors, also known as crypters, to cybercriminals. Cryptors are specialised software tools designed to modify malware so that it appears different to security products, making malicious code significantly harder for antivirus software and endpoint detection systems to identify. While cryptors do not carry out attacks themselves, they are widely used to help ransomware and other malware bypass detection during deployment.
The Treasury Department estimates that ransomware operations using services provided by 1VPNS and malware protected by Silayev's cryptors have collectively contributed to billions of dollars in losses suffered by US businesses and operators of critical infrastructure.
In announcing the sanctions, State Department spokesperson Thomas Pigott said the designated individuals supplied ransomware groups with services that concealed their identities, disguised malicious software and helped attackers avoid detection, ultimately enabling campaigns responsible for billions of dollars in damages. Pigott added that the United States and its international partners are increasingly focusing not only on ransomware operators themselves but also on the infrastructure providers and service suppliers that make these attacks possible.
The sanctions were coordinated with the United Kingdom's Foreign, Commonwealth and Development Office as part of a broader international effort to disrupt cybercriminal networks. Under OFAC sanctions, any property or financial interests belonging to the designated individuals or entities that fall under US jurisdiction are blocked. In addition, US individuals and organisations are generally prohibited from engaging in transactions involving the sanctioned parties.
The action forms part of a wider strategy aimed at disrupting the ransomware supply chain by targeting the businesses and technical service providers that support cybercriminal operations. Rather than focusing exclusively on the attackers who deploy ransomware, governments are increasingly using financial sanctions, infrastructure seizures and international law enforcement cooperation to dismantle the broader ecosystem that enables these campaigns.
The sanctions were announced as the European Union and the United Kingdom also introduced coordinated sanctions against dozens of Russian individuals and entities accused of supporting a network of hacking groups responsible for cyberattacks across Europe, reflecting continued international efforts to increase pressure on organisations and individuals believed to facilitate malicious cyber activity.
