OFAC sanctions VPN provider FirstVPN and two operators tied to top ransomware gangs hiding attacks using malware-disguising tools.
The US Treasury’s Office of Foreign Assets Control sanctioned a VPN provider and two individuals on July 13, 2026.
The action names FirstVPN Service, also called 1VPNS, along with administrator Dmytro Rashevskyi and Belarusian national Yevgeniy Vladimirovich Silayev. FirstVPN sold anonymizing infrastructure to cybercriminals since 2014. It promised no activity logs and no cooperation with law enforcement.
Ransomware groups including Anubis, Qilin, and Sinobi used the service to hide the source of their attacks.
OFAC Targets Ransomware Infrastructure, Not Just Attackers
According to a report by TRM Labs, this designation goes after the tools ransomware groups buy rather than a ransomware group itself. FirstVPN provided the anonymizing layer.
Silayev supplied something different: a cryptor built to disguise malware as a harmless file. That disguise lets malicious code slip past security systems undetected.
Together, the two designations cover both halves of the attack chain, network anonymity and endpoint evasion.
OFAC issued the action under Executive Order 14390, the March 2026 order directing US agencies to harden systems against foreign cybercrime. It also relied on E.O. 13694, the standing cyber-sanctions authority.
The United Kingdom’s Foreign, Commonwealth & Development Office coordinated a matching set of sanctions the same day against other cybercriminals and their enablers.
The action follows earlier law enforcement pressure on FirstVPN.
European authorities took down the service’s website and infrastructure in May 2026. The FBI’s Boston Field Office supported that takedown and later published an advisory describing FirstVPN’s tactics for businesses to watch for.
🚨 Today, @USTreasury's OFAC sanctioned FirstVPN Service (1VPNS), admin Dmytro Rashevskyi, and Yevgeniy Silayev — who sold "cryptors" disguising malware as safe files.
Since 2014, FirstVPN promised cybercriminals no logs, no cooperation with law enforcement. Ransomware groups… pic.twitter.com/ZtFhMgWHiR
— TRM Labs (@trmlabs) July 13, 2026
FirstVPN’s Crypto Addresses Span Multiple Blockchains
OFAC listed five cryptocurrency addresses tied to FirstVPN itself, spanning Bitcoin, Ethereum, Litecoin, and Tron.
All five trace back to Cryptomus, an exchange OFAC flagged as high risk. Rashevskyi’s individual listing carries far more addresses: fifteen in total, spread across Bitcoin, Ethereum, Tron, Litecoin, Dogecoin, Dash, Zcash, and Solana.
That spread across eight chains shows how far FirstVPN’s operator diversified his holdings. Silayev’s listing, by contrast, came with no addresses attached.
Paired with the VPN and cryptor designations, it still marks him as sanctionable for supplying obfuscation tools to ransomware operators targeting US and allied entities.
Rashevskyi also used false identities, listed by OFAC as “Maksim Sorin” and “Roman Chabanenko,” to buy server infrastructure. Providers had flagged FirstVPN for abuse complaints before, so the fake names kept the service running.
Read also:
On-Chain Data Shows Ransomware Groups Paying FirstVPN Directly
Blockchain analytics firm TRM Labs traced payments from ransomware groups straight to FirstVPN before the sanctions landed.
The Anubis ransomware group sent a total of $715 to the service, split between December 13, 2025, and March 15 to 16, 2026. Qilin Ransomware sent $120 on January 11, 2026. Sinobi Group sent $58 on February 8, 2026.
Those dollar figures look small next to typical ransomware extortion payments. Infrastructure subscriptions tend to run cheap compared to the payouts they help extract.
Still, the payments confirm that named ransomware groups relied on FirstVPN for operational infrastructure, and that reliance shows up on-chain.
TRM Labs noted that enabling services get paid through the same rails their customers use to extort victims. Those payments remain traceable once investigators know where to look.
Compliance teams have been advised to screen the newly listed addresses against their own transaction histories going forward.
Leave a Reply
You must be logged in to post a comment.