U.S. Sanctions First VPN Services and Two Alleged Ransomware Enablers
Summary
The U.S. Treasury sanctioned First VPN Services (1VPNS), its alleged administrator Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev over alleged support for ransomware operations, including infrastructure and malware-disguising tools.
Key points
- OFAC sanctioned 1VPNS and its alleged administrator Dmytro Rashevskyi in coordination with the United Kingdom.
- Treasury said ransomware groups used 1VPNS infrastructure to conceal attack origins, deploy malware, and manage exfiltrated data.
- Treasury said victims of attacks involving 1VPNS infrastructure included U.S. businesses, financial services firms, hospitals, and municipal governments.
- Belarusian national Yegeniy Vladimirovich Silayev was sanctioned for allegedly selling cryptors to ransomware operators.
- The article says 1VPNS advertised its services on cybercrime forums and promoted its refusal to cooperate with law enforcement.
- Europol said it arrested 1VPNS's administrator in a May operation but did not identify the person; Treasury did not confirm whether that person was Rashevskyi.
Article Details
- Event Type
- U.S. Treasury sanctions designations against First VPN Services and two individuals for alleged support of ransomware operations.
- Impact
- OFAC said ransomware groups used 1VPNS infrastructure to conceal attack origins, deploy malware, and manage exfiltrated data. Reported victims included U.S. businesses, financial services companies, hospitals, and municipal governments; the article gives no victim count.
People
Threat Actors
AnubisNamed in TRM Labs' report of 1VPNS service prices offered to ransomware operators; the article does not provide further details about its activity.Dmytro RashevskyiOFAC sanctioned him as the alleged administrator of 1VPNS for allegedly supporting ransomware operations; Europol said it arrested the service's administrator, but did not identify that person, and the article says it is unclear whether this was Rashevskyi.sinobiNamed in TRM Labs' report of 1VPNS service prices offered to ransomware operators; the article does not provide further details about its activity.Yegeniy Vladimirovich SilayevTreasury sanctioned him for allegedly selling cryptors to ransomware operators.
Countries
BelarusTreasury also sanctioned Belarus national Yegeniy Vladimirovich Silayev for allegedly selling “cryptors,” tools used to disguise ransomware and other malware, to ransomware operators.United StatesThe U.S. Treasury Department sanctioned First VPN Services (1VPNS), its alleged administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for allegedly supporting ransomware operations.