{"id":999,"date":"2026-07-13T20:02:28","date_gmt":"2026-07-14T01:02:28","guid":{"rendered":"https:\/\/decipher.sc\/?p=999"},"modified":"2026-07-13T20:02:29","modified_gmt":"2026-07-14T01:02:29","slug":"us-sanctions-first-vpn-cybercriminal-service","status":"publish","type":"post","link":"https:\/\/decipher.sc\/2026\/07\/13\/us-sanctions-first-vpn-cybercriminal-service\/","title":{"rendered":"US Sanctions First VPN Cybercriminal Service\u00a0\u00a0"},"content":{"rendered":"\n

2026 hasn\u2019t been a good year for First VPN, a VPN service<\/a> that\u2019s been used widely by ransomware actors and other cybercriminals for more than a decade.<\/p>\n\n\n\n

On Monday, the Treasury Department announced sanctions on the VPN provider, as well as its administrator (Dmytro Rashevskyi).  The sanctions come after Europol in May announced an international operation led by France and the Netherlands, which targeted First VPN\u2019s infrastructure and dismantled 33 servers linked to the criminal service. That month, the FBI also publicly outlined TTPs<\/a> linked to threat actors using the service in an effort to help organizations detect ransomware attacks. <\/p>\n\n\n\n

First VPN has been active for more than a decade and is specifically designed for ransomware operators, fraud groups, and other cybercriminals trying to hide malicious activity from law enforcement. It was used in attacks linked back to at least 25 types of ransomware, such as the Avaddon ransomware. Victims of these ransomware groups have included U.S. businesses, financial services companies, hospitals, and municipal governments.<\/p>\n\n\n\n

\u201cFirstVPN has advertised on cybercriminal forums like Exploit and XSS since 2014, promising no logs and no cooperation with law enforcement,\u201d according to Ari Redbord<\/a>, global head of policy and government affairs at TRM Labs, in a recent LinkedIn post<\/a>. \u201cRansomware groups paid for that promise and used it to hide the origin of attacks, deploy malware, and manage stolen data.\u201d<\/p>\n\n\n\n

The Treasury Department\u2019s announcement<\/a> shed some light on the activities of First VPN administrator Rashevskyi, who it said used false identities (like \u201cMaksim Sorin\u201d and \u201cRoman Chabanenko\u201d) to acquire infrastructure from companies.  Rashevskyi used these fake aliases because he left behind a trail of abuse complaints from internet service providers about illegal activity on First VPN\u2019s servers.<\/p>\n\n\n\n

The U.S. also sanctioned Vladimirovich Silayev, a Belarusian national who government officials said sells \u201ccryptors.\u201d These are tools used to disguise ransomware so they can pass as safe programs, preventing security systems from sniffing them out.<\/p>\n\n\n\n

\u201cUnlike legitimate encryption tools, which are designed to protect data and the privacy of the people that own it, cryptors are built specifically to make malware stealthier and more effective by disguising it as harmless files,\u201d according to the Treasury Department. <\/p>\n\n\n\n

The sanctions block all U.S. assets belonging to First VPN, Rashevskyi, and Silayev, and prohibits Americans from doing business with them. It becomes extremely difficult for sanctioned entities to participate in the legitimate global financial system, even if they’re located outside the U.S. While this doesn\u2019t mean the end for First VPN, the sanctions coupled with the disruption efforts earlier this year makes it much harder for the service to operate – particularly because in May, authorities also arrested an unnamed administrator linked to the service. <\/p>\n\n\n\n

Beyond First VPN, several other sanctions were announced this week by other countries. The UK on Monday<\/a> announced sanctions against 24 individuals and entities involved in cybercriminal proxy networks linked to the Russian Intelligence Services (RIS).<\/p>\n\n\n\n

\u201cThese sanctions\u202fstrike at the core of the cybercriminal networks propping up the\u202fRussian state\u2019s\u202faggression, and the UK and EU are sending a clear message that Russia cannot hide\u202fbehind its use of these\u202fproxy groups,\u201d according to UK Foreign Secretary Yvette Cooper.<\/p>\n","protected":false},"excerpt":{"rendered":"

First VPN has been active for more than a decade and is specifically designed for ransomware operators, fraud groups, and other cybercriminals trying to hide malicious activity from law enforcement.<\/p>\n","protected":false},"author":3,"featured_media":397,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"pagelayer_contact_templates":[],"_pagelayer_content":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[40,22],"tags":[94],"class_list":["post-999","post","type-post","status-publish","format-standard","has-post-thumbnail","category-government","category-law-enforcement","tag-first-vpn","entry"],"acf":[],"featured_image_src":"https:\/\/decipher.sc\/wp-content\/uploads\/2025\/10\/mitchell-luo-4vBN9dMCip0-unsplash-600x400.jpg","featured_image_src_square":"https:\/\/decipher.sc\/wp-content\/uploads\/2025\/10\/mitchell-luo-4vBN9dMCip0-unsplash-600x600.jpg","author_info":{"display_name":"Lindsey O'Donnell-Welch","author_link":"https:\/\/decipher.sc\/author\/lindsey\/"},"_links":{"self":[{"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/posts\/999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/comments?post=999"}],"version-history":[{"count":1,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/posts\/999\/revisions"}],"predecessor-version":[{"id":1000,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/posts\/999\/revisions\/1000"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/media\/397"}],"wp:attachment":[{"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/media?parent=999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/categories?post=999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/decipher.sc\/wp-json\/wp\/v2\/tags?post=999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}