Loading story…
The U.S. Treasury sanctioned First VPN Service (1VPNS), its alleged Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly supporting ransomware and other cybercriminal activity. Officials said 1VPNS provided anonymizing infrastructure that helped threat actors hide their identities, disguise malware, and evade detection during attacks on U.S. municipalities, hospitals, schools, businesses, and critical infrastructure providers. Treasury alleged Rashevskyi used false identities to obtain infrastructure for the service, while Silayev sold malware-obfuscation tools that made malicious code harder for defenders to detect.
The sanctions, issued under Executive Order 14390 and E.O. 13694 as amended, block U.S. persons from transacting with the designated parties and mark a broader move against ransomware enablers rather than only the gangs themselves. The action was coordinated with the United Kingdom and followed a May law enforcement takedown of 1VPNS infrastructure by European agencies with FBI support. Separate reporting said blockchain tracing tied payments from ransomware groups including Anubis, Qilin, and Sinobi Group to FirstVPN, adding financial evidence that the service was used as operational infrastructure by ransomware actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Following an FBI advisory describing FSB Center 16 exploitation of vulnerable and misconfigured networking devices, CISA added Cisco flaw CVE-2008-4128 to its Known Exploited Vulnerabilities catalog. The reference says U.S. federal agencies were ordered to remediate the flaw by July 16, 2026.
On 2026-07-13, the U.S. Treasury's Office of Foreign Assets Control sanctioned First VPN Service, its Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for allegedly enabling ransomware and other cybercriminal activity. The action, coordinated with the United Kingdom's FCDO, barred U.S. persons from transacting with the designated parties.
In May 2026, European law enforcement agencies, supported by the FBI Boston Field Office, took down infrastructure associated with First VPN Service (1VPNS). Later reporting described the sanctions as following this law enforcement action.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcemalware.news
Open sourcetrmlabs.com
Open sourcehome.treasury.gov
Open sourcedarkwebinformer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European law enforcement agencies dismantled the privacy-focused service **First VPN**, which investigators say was widely used to conceal ransomware attacks, data theft, fraud, and other cybercrime. The operation was led by French and Dutch authorities with Europol support and coordinated action on May 19–20, resulting in the seizure of **33 servers across 27 countries**, the takeover of multiple First VPN domains and related onion services, and enforcement activity in Ukraine, where authorities questioned a suspected administrator and searched a residence. Officials said the service was openly advertised on Russian-speaking cybercrime forums and marketed features such as anonymity, hidden infrastructure, anonymous payments, and refusal to cooperate with law enforcement. Investigators said they had infiltrated First VPN’s infrastructure before the takedown, obtained the service’s user database, and collected traffic data that exposed thousands of users allegedly tied to cybercrime. Europol said the platform had surfaced in nearly every major cybercrime investigation it supported in recent years, and authorities have already shared information on **506 users** and **83 intelligence packages** to aid ongoing cases worldwide. Officials described the seizure as the removal of a key layer criminals relied on to hide identities, communications, and backend systems, while warning that follow-on investigations into ransomware, fraud, and related offenses are continuing.
Jun 29, 2026
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026
U.S. authorities charged alleged **Sodinokibi/REvil** operators Yaroslav Vasinskyi of Ukraine and Yevgeniy Polyanin of Russia over ransomware attacks that included the compromise of Kaseya's remote management software, an intrusion that cascaded to managed service providers and their customers worldwide. The Kaseya incident was reported to have affected as many as **1,500 organizations**, with attackers allegedly encrypting systems, leaving ransom notes, and directing victims to Tor-based or public payment sites to obtain decryption keys; victims that did not pay were allegedly threatened with the publication or sale of stolen data. The Justice Department said Vasinskyi was arrested in Poland, later extradited to the United States, and arraigned in Texas on charges including conspiracy to commit computer fraud, damage to protected computers, and money laundering conspiracy. In parallel, U.S. authorities seized **$6.1 million** in alleged ransom proceeds tied to Polyanin, part of a broader multinational enforcement effort involving the FBI, Europol, Eurojust, and law enforcement partners across Europe and other allied countries to disrupt the REvil ransomware operation linked to the Kaseya attack.
Jun 29, 2026