US Treasury Sanctions VPN Provider Accused of Selling Cover to Ransomware Gangs

Key points

• The U.S. Treasury's Office of Foreign Assets Control sanctioned a VPN service called First VPN Service (1VPNS), saying it provided infrastructure used in ransomware attacks on Americans.
• A 45-year-old Ukrainian national was named as the operator of 1VPNS.
• A separate seller of malware "cryptor" software, tools that disguise malicious code from antivirus scanners, was also designated.
• The action freezes any U.S.-held assets of those named and bars Americans from doing business with them.

The U.S. Treasury has put a virtual private network provider on its sanctions list, saying the service was a paid utility for ransomware crews. The Office of Foreign Assets Control (OFAC) named the service First VPN Service, known as 1VPNS, alongside a 45-year-old Ukrainian man accused of operating it.

A third designation targets a seller of malware "cryptor" tools. A cryptor wraps malicious code in obfuscation so antivirus products can't recognise it. We covered the cryptor threat category for the first time on 14 July 2026, when Brussels and London sanctioned GRU and FSB officers behind years of European cyberattacks.

What did the sanctioned VPN actually do?

Treasury's position isn't that 1VPNS was a general-purpose tool with some bad customers. OFAC describes it as a service marketed to and used by ransomware operators to hide the origin of their attacks on U.S. Targets.

A VPN routes internet traffic through a middleman server so the user's real location is masked. Criminals use them to make it harder for investigators to trace attacks back to a person or country. Treasury's position is that 1VPNS knew who its customers were and what they were doing.

Ransomware is malicious software that scrambles a victim's files and demands payment for the key. It's hit U.S. Hospitals, schools and pipelines over the last five years, sometimes shutting them down for weeks.

Why sanctions and not arrests?

Sanctions are a financial weapon. Once OFAC designates a person or company, any U.S.-held assets are frozen. Americans, including banks and payment processors, are barred from doing business with them. Foreign firms that keep dealing with a sanctioned party risk being cut off from the U.S. Financial system.

That matters here because ransomware crews rely on a supply chain: hosting, VPN cover, cryptor services, cryptocurrency exchanges. Sanctions try to make each link expensive to use. The Ukrainian operator named in the filing hasn't, based on the OFAC notice, been arrested. Sanctions can run in parallel with a criminal case or stand alone.

Should you worry about your VPN provider?

Nothing changes for people using mainstream, above-board VPN products. 1VPNS is not one of them. It was, per Treasury, a niche service sold into criminal channels.

Businesses should take note, though. If your procurement team ever paid a small, obscure VPN vendor, check the OFAC Specially Designated Nationals list. Paying a sanctioned entity, even unknowingly, can trigger civil penalties.

What affected organisations should do

Check whether any vendor invoices or infrastructure contracts touch the newly designated names. Report matches to OFAC and freeze the relationship. If your incident response logs show connections to 1VPNS infrastructure, preserve them: law enforcement will want them.

If your business has never mapped which suppliers sit in the sanctions blast radius, this is a good week to start. The pattern here, targeting criminal infrastructure suppliers rather than attackers directly, is one OFAC has been running hard this year, and it won't stop at VPNs.