U.S. Sanctions 1VPNS VPN Service and Cryptor Seller Over Ransomware Support
Summary
The U.S. sanctioned 1VPNS, its administrator Dmytro Rashevskyi, and cryptor seller Yegeniy Silayev for supporting ransomware attacks. A multinational operation dismantled 1VPNS and seized 33 servers across 27 countries.
Key points
- OFAC sanctioned 1VPNS and its administrator, Dmytro Rashevskyi, for supporting ransomware attacks against U.S. organizations.
- Authorities dismantled 1VPNS infrastructure in May during Operation Saffron, led by French and Dutch authorities with FBI support.
- The operation seized 33 servers in 27 countries and collected 1VPNS's user database before the service was dismantled.
- Authorities arrested Rashevskyi and exposed thousands of users associated with ransomware, fraud, and other malicious activity, according to the article.
- The U.S. also sanctioned Belarusian cryptor seller Yegeniy Silayev; officials said his tools helped malware evade security detection.
- Officials estimate operations using 1VPNS and Silayev's cryptors caused billions of dollars in losses; the estimate is attributed to officials.
Article Details
- Event Type
- U.S. Treasury sanctions against a VPN provider and a cryptor seller accused of enabling ransomware activity, following a multinational law-enforcement operation against the VPN service.
- Impact
- Authorities dismantled 1VPNS infrastructure and seized 33 servers across 27 countries; the investigation collected its user database and exposed thousands of users associated with ransomware, fraud, and other malicious activity. Ransomware attacks involving 1VPNS infrastructure affected U.S. businesses, hospitals, financial services firms, and municipal governments. Officials estimate the operations caused billions of dollars in losses.
People
Threat Actors
Dmytro RashevskyiThe sanctioned administrator of 1VPNS, which provided VPN services to ransomware groups. Authorities say he allegedly used false identities to obtain infrastructure and evade abuse complaints.Yegeniy Vladimirovich SilayevThe sanctioned Belarusian cryptor seller. The article says his cryptors helped ransomware and other malware evade security detection.
Vendors
Countries
United KingdomOFAC said the action was coordinated with the United Kingdom’s Foreign, Commonwealth & Development Office.United StatesThe U.S. Treasury sanctioned First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yegeniy Vladimirovich Silayev for supporting ransomware attacks against U.S.
Industries
Critical infrastructureOfficials estimate that ransomware operations using 1VPNS and Silayev cryptors have caused billions of dollars in losses to businesses and critical infrastructure providers across the United States.Financial Servicesbusinesses, hospitals, financial services firms, and municipal governments.