The US Treasury has sanctioned a VPN service and its administrator for actively supporting ransomware operations against American businesses and institutions. This is the first time Washington has targeted VPN operators specifically for enabling cybercrime, and it signals a major shift in how authorities intend to police digital infrastructure.
According to multiple reports, the Office of Foreign Assets Control designated First VPN Service (also known as 1VPNS) and its Ukrainian administrator Dmytro Rashevskyi. A Belarusian national, Yegeniy Vladimirovich Silayev, was also sanctioned for selling cryptors—tools that disguise ransomware from security software.
What the Sanctions Cover
- First VPN Service was operated by Dmytro Rashevskyi, based in Dnipro, Ukraine
- The service ran since 2014 and was heavily marketed on dark web forums
- Rashevskyi allegedly used false identities to rent server infrastructure
- European authorities seized 33 servers across 27 countries in May 2026
- Silayev's cryptors were sold separately to ransomware operators
The Treasury move comes months after a coordinated takedown in May. European law enforcement, working with the FBI's Boston Field Office, dismantled the service as part of "Operation Saffron." Investigators had infiltrated the network since December 2021, collecting user data before the infrastructure was seized.
Authorities say First VPN's name surfaced in nearly every major cybercrime investigation supported by Europol in recent years. Victims included US hospitals, municipal governments, and financial services firms.
Our Analysis
This matters for a straightforward reason: hosting and VPN providers occupy similar legal territory when it comes to customer activity. The Treasury's rationale—that the service knowingly facilitated harm by promising anonymity and refusing to cooperate with law enforcement—applies equally to bulletproof hosting providers that resellers sometimes rely on for questionable clients.
The sanctions also target the supply chain. Silayev wasn't affiliated with First VPN but got swept up anyway. That broader approach suggests regulators are willing to pursue anyone providing tools for cybercrime, not just the operators themselves.
What changes now? US persons and financial institutions are prohibited from transacting with the designated individuals. More broadly, any provider that can't demonstrate basic abuse handling or cooperation with legal process faces higher regulatory risk.
Practical Takeaways
Say you're a reseller evaluating a new upstream provider or considering offering VPN services as a value-add. This is your reminder to ask hard questions: Does the provider have a published abuse policy? Do they respond to legal process? Have they been named in any cybercrime investigations?
Providers that market themselves on total anonymity and refusing law enforcement cooperation are now explicitly in the crosshairs. That's not a selling point—it's a liability.
What to Watch Next
Look for follow-on actions against other VPN and hosting providers that serve similar profiles. The Treasury action wasn't isolated; it's part of a coordinated crackdown. If you host any infrastructure in jurisdictions with weak law enforcement cooperation, expect more scrutiny ahead.
Frequently asked questions
What did the US Treasury sanction First VPN for?
The service and its administrator were sanctioned for enabling ransomware attacks against US organizations by providing anonymous infrastructure and refusing to cooperate with law enforcement.
How long had First VPN been operating?
The service launched in 2014 and operated for 12 years before being dismantled in May 2026.
Were any individuals arrested?
Yes, administrator Dmytro Rashevskyi was arrested during the May 2026 takedown coordinated by European law enforcement and the FBI.
What are cryptors?
Cryptors are tools that disguise ransomware and other malware so security software cannot detect them. Selling these tools was also sanctioned.
How does this affect legitimate VPN providers?
It raises the bar for compliance and abuse handling. Providers that actively facilitate or ignore cybercrime face significant legal and financial consequences.