The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned two individuals and one company for helping ransomware groups carry out cyberattacks against US organizations.
The sanctions target First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev. According to officials, 1VPNS provided VPN services that were used by ransomware groups and other cybercriminals to hide their online activity. The company advertised that it kept no logs of users and would not cooperate with law enforcement.
Officials said Rashevskyi used fake identities to buy servers and internet infrastructure from companies that would likely have refused service because of abuse complaints. The Treasury Department said this allowed 1VPNS to continue supporting cybercriminal operations.
The sanctions come following Operation Saffron, an international law enforcement operation led by French and Dutch authorities with support from the FBI. During the investigation, which began in late 2021, officers gained access to 1VPNS's systems and collected its user database before the service was shut down in May. Authorities seized 33 servers across 27 countries, arrested Rashevskyi, and identified thousands of users linked to ransomware, fraud, and other cybercrime.
Europol said the VPN service appeared in many major cybercrime investigations and was connected to attacks targeting US businesses, hospitals, financial institutions, and local governments.
The Treasury Department also sanctioned Silayev for selling cryptors (crypters), tools that help ransomware and other malware avoid detection by antivirus and security software.
US officials estimate that ransomware groups using 1VPNS and Silayev's tools caused billions of dollars in losses to businesses and critical infrastructure across the United States. The sanctions were coordinated with the United Kingdom. Under the measures, any assets belonging to those designated that fall under US jurisdiction are frozen, and US individuals and companies are prohibited from doing business with them.
Earlier this week, the European Union and the United Kingdom announced new joint sanctions against Russia, accusing Moscow’s intelligence services of carrying out cyberattacks and attempts to disrupt countries across Europe.