OFAC Targets Cybercrime Enablers Supporting Ransomware Attacks Against Americans

Overview

On July 13, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (“OFAC”) announced sanctions targeting two individuals and one entity for allegedly enabling ransomware actors and other cybercriminals responsible for attacks against U.S. persons and critical infrastructure. The action targets First VPN Service (“1VPNS”), a virtual private network (“VPN”) provider, its administrator Dmytro Rashevskyi (“Rashevskyi”), and Belarusian national Yegeniy Vladimirovich Silayev (“Silayev”), an alleged provider of “cryptor” services used to disguise ransomware and other malware.

According to OFAC, ransomware groups utilizing these persons' services have caused billions of dollars in losses to U.S. businesses and critical infrastructure providers. OFAC stated that the action forms part of broader efforts to disrupt the cybercrime ecosystem and protect U.S. financial and digital systems from foreign actors engaged in cybercrime, cyber-enabled fraud, extortion, and other malicious activity.

The designations were issued pursuant to Executive Order (“E.O.”) 13694, as amended. OFAC also noted that the action was coordinated with the United Kingdom's Foreign, Commonwealth & Development Office (“FCDO”), which announced related sanctions targeting other cybercriminals and their enablers.

1VPNS and Ransomware Infrastructure Services

According to OFAC, 1VPNS is a VPN provider whose principal clients include ransomware actors and other cybercriminals. While VPN services can serve legitimate privacy and security purposes, OFAC alleged that numerous ransomware groups purchased infrastructure from 1VPNS and used those services in attacks against U.S. companies and institutions.

OFAC stated that ransomware actors allegedly used 1VPNS infrastructure to conceal the origins of cyberattacks, deploy malware, and manage exfiltrated data. OFAC further noted that victims of ransomware attacks involving 1VPNS infrastructure have included U.S. businesses, financial services companies, hospitals, and municipal governments.

The press release also highlighted a May 2026 law enforcement operation that resulted in the takedown of 1VPNS's website and related infrastructure by European law enforcement authorities, with support from the Federal Bureau of Investigation's (“FBI”) Boston Field Office. See European law enforcement forces pull the plug on this free VPN in massive cybercrime crackdown | Yahoo News. OFAC additionally noted that the FBI released a cybersecurity advisory describing 1VPNS's tactics, techniques, and procedures to assist organizations in identifying and mitigating ransomware threats.

Rashevskyi and Alleged Support for Cybercriminal Activity

Treasury identified Rashevskyi as the administrator of 1VPNS and alleged that he provided technological support to ransomware actors and other illicit users of the service.

According to OFAC, since 2014, 1VPNS has advertised its services on multiple cybercriminal forums and represented that it does not maintain logs of user identities or activities and would not cooperate with law enforcement investigations into illegal activity originating from its servers. Treasury also alleged that Rashevskyi used the false identities “Maksim Sorin” and “Roman Chabanenko” to acquire infrastructure from companies that might otherwise have declined to provide services because of complaints concerning illegal activity associated with 1VPNS servers.

OFAC designated both 1VPNS and Rashevskyi pursuant to E.O. 13694, as amended, for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, certain cyber-enabled activities involving ransomware attacks targeting U.S. persons and entities.

Cryptor Services Supporting Malware Operations

In addition to 1VPNS and Rashevskyi, OFAC designated Silayev, whom Treasury described as a Belarusian national and a cryptor provider who supplied encryption and obfuscation services to ransomware operators targeting U.S. and allied entities.

According to OFAC, cryptors are designed to conceal ransomware and other malicious software by disguising malware as benign files, thereby helping malicious code avoid detection by cybersecurity tools. Treasury distinguished these services from legitimate encryption technologies, stating that cryptors are specifically designed to make malware more difficult to identify and disable.

OFAC designated Silayev pursuant to E.O. 13694, as amended, for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, certain cyber-enabled activities involving ransomware attacks targeting U.S. persons and entities.

Focus on Cybercrime Enablers

The action is notable because it targets not only individuals alleged to be involved directly in ransomware activity, but also infrastructure and service providers that OFAC alleges supported ransomware operators and other cybercriminals. By targeting a VPN provider and a supplier of malware obfuscation services, OFAC's action focuses on elements of the broader cybercrime ecosystem that Treasury alleges facilitate ransomware operations.

The press release further noted that the action was taken in furtherance of President Trump's Executive Order 14390, issued on March 6, 2026, which orders U.S. government agencies to take action to protect Americans from, and harden U.S. financial and digital systems against, the threats posed by foreign actors engaged in cybercrime, cyber-enabled fraud, extortion, and predatory schemes.

OFAC Designation Implications

As with prior OFAC designations, all property and interests in property of the designated individuals and entities that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. Entities owned 50 % or more by one or more blocked persons are also blocked under OFAC’s 50% Rule.

All transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or blocked persons are prohibited unless authorized by a general or specific license issued by OFAC or exempt. These prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.

***

We will continue to monitor developments in this area and encourage you to subscribe to be kept informed of the latest developments. Please contact the authors or your usual Herbert Smith Freehills Kramer contacts for more information.