Treasury sanctions VPN and cryptor operators linked to ransomware, the US Office of Foreign Assets Control announced on 13 July 2026. The action named two individuals and one entity and said services provided by those designated had been connected to ransomware attacks that harmed US targets.
Treasury sanctions VPN: who was designated
The designation on 13 July 2026 identified the entity First VPN Service, also known as 1VPNS, and two people. One was named as Dmytro Rashevskyi, described as the service’s administrator. The other was identified as Belarusian national Yegeniy Vladimirovich Silayev, characterised in the announcement as a seller of cryptors.
The Office of Foreign Assets Control placed the entity and the two individuals on its list as part of a sanctions measure. The announcement described links between the named services and ransomware attacks directed at targets in the United States. For the full text of the action see the official announcement.
Alleged role in attacks and reported losses
The Treasury statement linked the designated services to ransomware attacks against US targets. It said users of the services caused billions of dollars in losses to businesses and critical infrastructure. The language in the announcement framed those impacts as the Office of Foreign Assets Control’s findings.
The designation does not itself determine criminal guilt in a court. It places the named entity and individuals on a sanctions list, which has legal and financial effects under US sanctions authorities.
International coordination and policy context
The action was coordinated with the UK’s Foreign, Commonwealth and Development Office, the Treasury notice said. That coordination reflects a joint approach to disrupting services and individuals that authorities say enable cyber extortion and ransomware activity.
Officials stated that measures of this kind aim to reduce the ability of malicious actors to use virtual private network providers and cryptor sellers to conceal activity or distribute tools used in ransomware incidents. The announcement outlined the specific designations without expanding on law enforcement procedures or future legal steps.
Practical effects of the designation
Sanctions listings typically block access to certain financial channels and can restrict commercial dealings with listed parties. The Treasury announcement described the implications for the named entity and individuals under the relevant US authorities. It also said that the designated services had been used by operators who carried out attacks against US targets.
Companies and institutions that encounter the named entity or individuals in business contexts will need to assess compliance obligations under the sanctions measure. The announcement did not set out prosecutorial actions; it focused on the designation and the reasons given by the Office of Foreign Assets Control.
Industry reaction and next steps
Cybersecurity firms and affected sectors regularly assess the operational impact of sanctions actions, but the announcement itself did not include comment from private companies. The designation noted that users of the services were implicated in operations that caused substantial economic harm to businesses and critical infrastructure.
Further enquiries about the legal status of the designations or follow-up measures were not detailed in the Treasury notice. Stakeholders seeking the official text and lists can consult the announcement for the authoritative details.
Conclusion
The designation on 13 July 2026 names First VPN Service (1VPNS), Dmytro Rashevskyi and Yegeniy Vladimirovich Silayev and links the services to ransomware attacks against US targets. The Treasury said those activities caused billions of dollars in losses and coordinated the action with the UK’s Foreign, Commonwealth and Development Office. The announcement outlines the sanctions consequences and provides the official listing information for entities and individuals named under the action.
Further details are available in the official information.
