US Treasury Sanctions VPN Provider Accused of Selling Cover to Ransomware Gangs

Key points

• The U.S. Treasury's Office of Foreign Assets Control announced sanctions against a VPN service called First VPN Service, or 1VPNS, on the grounds it provided infrastructure used in ransomware attacks on Americans.
• Two individuals were named alongside the service, including a 45-year-old Ukrainian national accused of running the VPN operation.
• A separate seller of malware "cryptor" software, tools that help criminal code slip past antivirus scanners, was also designated.
• The action freezes any U.S.-held assets of those named and bars Americans from doing business with them.
• The sanctions were first reported by The Hacker News.

The U.S. Treasury has put a virtual private network provider on its sanctions list, saying the service was a paid utility for ransomware crews.

The Office of Foreign Assets Control, the Treasury arm that enforces U.S. sanctions, announced the designation this week. It named the service First VPN Service, known as 1VPNS. It also named two individuals, including a 45-year-old Ukrainian man accused of operating the VPN.

A third designation targets a seller of malware "cryptor" tools. A cryptor is software that wraps malicious code in layers of obfuscation so antivirus products struggle to recognise it. Think of it as a disguise kit for malware.

What did the sanctioned VPN actually do?

According to OFAC, 1VPNS was not a general-purpose privacy tool with some bad customers. Treasury describes it as a service marketed to and used by ransomware operators and other cybercriminals to hide the origin of their attacks on U.S. targets.

A VPN, or virtual private network, routes internet traffic through a middleman server so the user's real location is masked. Legitimate people use VPNs every day. Criminals use them to make it harder for investigators to trace attacks back to a person or a country.

Treasury's position is that 1VPNS knew who its customers were and what they were doing.

Ransomware, for readers new to the term, is malicious software that scrambles a victim's files and demands payment for the key. It has hit U.S. hospitals, schools, pipelines and small businesses over the last five years, sometimes shutting them down for weeks.

Why sanctions and not arrests?

Sanctions are a financial weapon. Once OFAC designates a person or a company, any assets they hold in the United States are frozen. Americans, including U.S. banks, payment processors and cloud providers, are barred from doing business with them. Foreign firms that keep dealing with a sanctioned party risk being cut off from the U.S. financial system themselves.

That matters here because ransomware crews rely on a supply chain: hosting, VPN cover, cryptor services, cryptocurrency exchanges. Sanctions try to make each link expensive to use.

The Ukrainian operator named in the filing has not, based on the OFAC notice, been arrested. Sanctions can run in parallel with a criminal case or stand on their own.

What does this mean for ordinary VPN users?

Nothing changes for people using mainstream, above-board VPN products from well-known providers. 1VPNS is not one of them. It was, per Treasury, a niche service sold into criminal channels.

Businesses should still take note. If your procurement or marketing team ever paid a small, obscure VPN vendor, check the OFAC Specially Designated Nationals list. Paying a sanctioned entity, even unknowingly, can trigger civil penalties.

What affected organisations should do

Check whether any vendor invoices, cryptocurrency payments or infrastructure contracts touch the newly designated names. Report matches to OFAC and freeze the relationship. If your incident response logs from past ransomware events show connections to 1VPNS infrastructure, preserve them: law enforcement will want them.

And if your business has never mapped which of its suppliers sit in the sanctions blast radius, this is a good week to start.