US Sanctions First VPN in Crackdown on Ransomware Criminals

The US Department of the Treasury this week sanctioned First VPN Service, saying it enabled cybercriminals to launch ransomware attacks against American companies and institutions.

The Office of Foreign Assets Control, an intelligence and enforcement agency within the Department of the Treasury, also levied sanctions on First VPN administrator Dmytro Rashevskyi and Yegeniy Vladimirovich Silayev for selling tools used to disguise ransomware and other malware. These tools — known as “cryptors” — prevent security systems from detecting or deactivating them.

In May, European authorities dismantled First VPN, also known as 1VPNS, and arrested Rashevskyi, who is based in Dnipro, Ukraine, to culminate an investigation that began in 2021. 

Europol, the EU’s law enforcement agency, said that First VPN was well publicized on Russian-language cybercrime forums as a service offering anonymous payments, hidden infrastructure and services “designed specifically for criminal use.”

The agency also said the VPN service helped cybercriminals hide their identities while carrying out ransomware attacks and data theft, and that it appeared “in almost every major cybercrime investigation supported by Europol in recent years.”

Representatives for the Department of the Treasury did not immediately respond to a request for comment.

What is ransomware?

Ransomware is malicious software that gets into a computer system and prevents an individual or company from accessing files, systems or networks. The perpetrator will typically demand a ransom to regain access. It’s a massive problem: One estimate puts the cost at $74 billion globally this year. 

The FBI advises that people keep their operating systems and software programs updated, use anti-malware and antivirus programs and regularly back up data, among other tips. The FBI also does not recommend paying ransomware instigators.

Read more: Best VPNs for 2026

Under the sanctions enacted this week, the Department of the Treasury will prohibit all transactions by people in the US involving property owned by Rashevskyi or Silayev. The department also said any of their property that is in the country or in possession of anyone in the country must be reported to the department. Financial institutions and others are prohibited from “engaging in certain transactions or activities” involving Rashevskyi or Silayev.

“The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior,” the department said in the statement.

When used legally and ethically, a VPN is an invaluable tool for consumers seeking online privacy. The safest and most effective VPNs — CNET advises against using free ones — will not log or record your data, meaning that no one can see your internet activity. VPNs also mask your physical location by using a unique IP address, making it look as though you’re in a different country than the one you’re in. Many people use VPNs to watch online content that is geo-restricted from their actual country of residence.

But, as CNET’s Attila Tomaschek writes, “total anonymity” is impossible, even with the best VPNs. They can help achieve some privacy, but so much of our data is accessible that a VPN can never give you “an all-encompassing invisibility cloak on the internet,” he says.

Cybercrime forums and fake identities

In the news statement, the Department of the Treasury said Rashevskyi and First VPN began advertising their services in 2014 on various online cybercrime forums. First VPN said it did not log user identities or activities and would refuse to cooperate with law enforcement investigations into any possible illegal activity originating from servers it rents to customers.

The agency also said that Rashevskyi used fake identities to get companies to sell him infrastructure they would not have sold him if they had known his real identity. Internet service providers had complained about illegal activity emanating from First VPN servers, the statement said.

Ransomware criminals have used infrastructure obtained from First VPN to attack US businesses, financial services companies, hospitals and municipal governments, according to the Department of the Treasury.

Silayev, a Belarusian national, supplied encryption and obfuscation services to ransomware operators targeting US and allied entities, the Department of the Treasury said. These cryptors make malware look like harmless files, fooling the computer systems of companies and other institutions.