Treasury sanctions 1VPNS, two cyber enablers tied to ransomware attacks on Americans

WASHINGTON, July 13, 2026 — The US Treasury’s Office of Foreign Assets Control on Monday imposed sanctions on First VPN Service, or 1VPNS, its alleged administrator Dmytro Rashevskyi of Ukraine, and Belarusian national Yegeniy Vladimirovich Silayev, in a move aimed at disrupting the infrastructure behind ransomware attacks on Americans. Treasury said 1VPNS sold virtual private network services to ransomware groups, while Silayev sold “cryptors,” tools designed to disguise malware and help it evade security systems.

Treasury said ransomware groups using the sanctioned parties’ services caused billions of dollars in losses to US businesses and critical infrastructure providers. Victims tied to 1VPNS infrastructure included businesses, financial services firms, hospitals and municipal governments, according to the Treasury statement.

The action was coordinated with the United Kingdom’s Foreign, Commonwealth and Development Office, which Treasury said was also sanctioning cybercriminals and their enablers on Monday. The US action followed a May 2026 takedown of 1VPNS websites and other infrastructure by European law enforcement, backed by the FBI’s Boston Field Office. The FBI also issued a cybersecurity advisory on 1VPNS tactics to help companies detect and prevent attacks.

Treasury said the designations advance President Donald Trump’s March 6, 2026 executive order directing agencies to combat cybercrime, cyber-enabled fraud, extortion and related schemes targeting Americans. Under OFAC rules, any property or interests in property of the designated parties in the United States, or under US control, must be blocked, and US persons are generally barred from dealing with them.

Separately, OFAC’s July 13 recent-actions page also listed new Cuba-related designations and a new FAQ giving non-U.S. persons until Aug. 12, 2026 to wind down transactions involving newly designated Cuban entities GECOMEX and GEMAR, while warning that US persons remain prohibited from such dealings absent authorization.