Ransomware attacks are no longer driven only by hackers writing malicious code and breaking into networks. Behind many major campaigns is an ecosystem of service providers that supply the infrastructure, anonymity and tools needed to carry out attacks — and the U.S. government is now targeting those players directly.
The U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against two individuals and one entity accused of enabling ransomware operations targeting American businesses and critical infrastructure.
Among those sanctioned is First VPN Service (1VPNS), a VPN provider that authorities say became a preferred infrastructure supplier for ransomware groups and other cybercriminals. Its administrator, Dmytro Rashevskyi, was also sanctioned. According to the Treasury, ransomware operators used 1VPNS infrastructure to hide the origins of attacks, deploy malware and manage stolen data.
OFAC also sanctioned Yegeniy Vladimirovich Silayev, a Belarusian national accused of providing “cryptors”, tools that allow malware operators to disguise malicious files as legitimate programs and bypass security defenses.
The sanctions follow a broader international effort against ransomware infrastructure. In May 2026, European law enforcement agencies, with support from the FBI, dismantled 1VPNS-related infrastructure and seized its website. The UK also announced coordinated sanctions against cybercriminals and their enablers.
The move reflects a shift in the fight against ransomware: authorities are increasingly targeting not only the attackers themselves, but also the underground businesses that provide them with the tools and services needed to operate.
By blocking assets and restricting transactions with sanctioned entities, Washington aims to increase the cost of participating in the ransomware economy and disrupt the infrastructure that allows cyber extortion campaigns to scale.
Click Here For The Original Source.
