U.S. Sanctions First VPN Service and Cryptor Seller for Ransomware Support

The U.S. Treasury Department’s OFAC has sanctioned First VPN Service (1VPNS), its Ukrainian administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for enabling ransomware attacks against American entities. First VPN, operational since 2014, was dismantled in May 2026 by a joint law enforcement operation for obscuring ransomware origins, data theft, and DDoS attacks. Silayev sold cryptors to conceal malware from security tools. Ransomware groups using these services caused billions in losses to U.S. businesses, financial services, hospitals, and municipal governments.

Concurrently, the U.K. and E.U. sanctioned 24 Russian individuals and entities for cyber and hybrid operations, including GRU senior leaders Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko, and FSB Center 16 for sabotage against Poland’s energy grid. Sanctions also targeted Lumma Stealer operators, used by Russia for cyber espionage.

The FBI issued an advisory on FSB Center 16 exploiting poorly configured networking devices via SNMP, abusing CVEs CVE-2018-0171 and CVE-2008-4128 in Cisco devices. CISA added CVE-2008-4128 to its KEV catalog, requiring fixes by July 16, 2026.