Sanctioning Ransomware Enablers in Coordinated International Action

Today, the United States sanctioned one entity and two individuals — First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev — for providing critical support to ransomware groups that have targeted American hospitals, schools, businesses, and local governments.

These actors supplied ransomware groups with tools to hide their identities, disguise malicious software, and evade detection — enabling attacks that have caused billions of dollars in losses to U.S. critical infrastructure providers.

This action reflects the United States’ commitment to working with allies and partners to disrupt the global cybercrime ecosystem. Today’s designations are coordinated with the United Kingdom’s Foreign, Commonwealth & Development Office, and follow a May 2026 European law enforcement takedown of 1VPNS’s infrastructure, supported by the FBI.

By targeting not just ransomware operators but the service providers and tool suppliers who make their attacks possible, the United States and its partners are dismantling the broader networks that sustain cybercriminal activity worldwide.

The United States will continue to use every diplomatic and economic tool available to disrupt foreign cybercriminals and their enablers and hold them accountable. Ransomware is not only a law enforcement challenge — it is a foreign policy threat that undermines the security and economic stability of the United States and its allies.

Today’s action is being taken pursuant to the authorities under Executive Order (E.O.) 13694, as further amended by E.O. 13694, as amended by E.O. 13757, E.O. 14144, and E.O. 14306 (E.O. 13694, as amended). For more information on today’s action, please see the Department of the Treasury’s Press Release.