US sanctions a VPN, a malware disguiser, and the people behind them for helping ransomware gangs

Key points

• OFAC sanctioned VPN provider 1VPNS, its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev on Monday.
• 1VPNS advertised on criminal forums since 2014 that it kept no logs and would not cooperate with police.
• French and Dutch police, with FBI support, seized 33 servers across 27 countries in May 2026 during Operation Saffron and arrested the administrator.
• Officials estimate ransomware operations using 1VPNS and Silayev's crypters caused billions of dollars in losses to U.S. Businesses and critical infrastructure.
• The action was coordinated with the United Kingdom, on the same day the EU and UK jointly sanctioned Russian hacking networks.

The U.S. Treasury has gone after the plumbing of the ransomware business, not just the gangs themselves.

On Monday, Treasury's Office of Foreign Assets Control (OFAC), which enforces U.S. Financial sanctions, named two people and one company as off-limits for any American to do business with. The targets are quiet suppliers who make ransomware attacks possible.

First on the list is 1VPNS, short for First VPN Service. A VPN, or virtual private network, hides where internet traffic is really coming from. Ordinary people use them for privacy. Criminals use them to cover their tracks. 1VPNS, according to Treasury, was firmly in the second camp.

Since 2014, the service advertised on cybercrime forums with a simple pitch: no logs, no records of who used it, no cooperation with police. That's exactly what a ransomware crew wants when it's breaking into a hospital network.

OFAC also sanctioned the man it says ran the service, Dmytro Rashevskyi, who allegedly used false identities like "Maksim Sorin" and "Roman Chabanenko" to rent servers from hosting companies that would have refused him otherwise.

We covered the May takedown when it happened: Operation Saffron Yanks the Plug on First VPN, the Getaway Car of at Least 25 Ransomware Crews. Led by French and Dutch police with help from the FBI's Boston office, the investigation had been running since December 2021. Officers quietly got inside 1VPNS's own systems, copied its user database, then pulled the plug. Thirty-three servers across 27 countries were seized, the administrator was arrested, and Europol noted that 1VPNS had surfaced in nearly every major cybercrime case it worked on.

Victims included American hospitals, financial services firms and municipal governments. Ransomware is malicious software that encrypts a victim's files and demands payment to restore access.

The second person sanctioned is Yegeniy Vladimirovich Silayev, a Belarusian national who sold crypters, programs that disguise ransomware so antivirus software doesn't flag it as dangerous. Think of it as a costume for malware. Treasury estimates that attacks relying on 1VPNS and Silayev's crypters have cost U.S. Victims billions of dollars.

"These actors supplied ransomware groups with tools to hide their identities, disguise malicious software, and evade detection," State Department spokesperson Thomas Pigott said in the announcement.

The practical effect is blunt. Any property the named people or company hold inside U.S. Jurisdiction is frozen, and Americans are barred from transacting with them. That covers hosting providers, payment processors, cryptocurrency exchanges and any other service that touches the U.S. Financial system.

OFAC coordinated with the United Kingdom's Foreign, Commonwealth and Development Office. Separately, the EU and UK that same day jointly sanctioned dozens of Russian individuals and organisations accused of running hacking campaigns across Europe.

Should you worry?

Probably nothing changes tomorrow for most readers, but the mechanics matter. Sanctions don't arrest anyone new. They cut off money and infrastructure that let ransomware crews operate at scale.

When a hospital can't book appointments or a city can't process payments for a week, a service like 1VPNS was often somewhere in the chain. Squeezing those suppliers is slower than a dramatic arrest, but it raises the cost of doing business for everyone downstream. The gangs haven't gone anywhere. Their most useful vendors just got a lot harder to pay.