The U.S. Department of the Treasury has sanctioned the First VPN service and two administrators for providing infrastructure and obfuscation tools that facilitated global ransomware attacks against American institutions.

Key Points

• The Treasury sanctioned First VPN, administrator Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling cybercriminal activity.
• First VPN, also known as 1VPNS, provided anonymous infrastructure and "cryptor" tools designed to bypass security systems and hide malware.
• European authorities dismantled the service and arrested Rashevskyi in May following a multi-year investigation that began in 2021.
• The service was widely advertised on Russian-language cybercrime forums since 2014, promising no data logging and refusal to cooperate with law enforcement.
• Sanctions prohibit U.S. persons and financial institutions from engaging in transactions involving the property or interests of the designated individuals.

Why it Matters

These sanctions represent a significant effort to disrupt the infrastructure that supports the global ransomware economy, which is estimated to cost $74 billion annually. By targeting the specific tools used to mask malicious activity, the Treasury aims to increase the operational costs and risks for cybercriminals targeting critical U.S. infrastructure.