# US Treasury (OFAC) and UK Sanction First VPN Service (1VPNS), Administrator Dmytro Rashevskyi, and Cryptor Seller Yevgeniy Silayev for Enabling Anubis and Sinobi Ransomware Operations

> OFAC, jointly with the UK's FCDO, designated First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev under E.O. 13694 (as amended by E.O. 14390) for materially supporting Anubis, Sinobi, and Qilin ransomware operations against US businesses, hospitals, financial-services firms, and municipal governments. The designation follows a May 2026 Europol-led takedown of 1VPNS infrastructure, supported by the FBI's Boston Field Office.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1316
- **ID:** TL-2026-1316
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Anubis Ransomware
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-53704

## Description

On July 13, 2026, the US Department of the Treasury's Office of Foreign Assets Control (OFAC), acting jointly with the United Kingdom's Foreign, Commonwealth & Development Office (FCDO), announced sanctions against three parties that provided material technical and financial support to ransomware operators attacking American organizations: First VPN Service (1VPNS), a bulletproof-style VPN provider; its alleged administrator, Ukrainian national Dmytro Rashevskyi; and Yevgeniy Vladimirovich Silayev, a Belarusian national who sold "cryptor" (malware-obfuscation) services to ransomware affiliates.

1VPNS has operated since 2014, advertising on cybercriminal forums (including Exploit and XSS) that it retains no logs of subscriber identity or activity and will not cooperate with law-enforcement requests. It also ran a peer-to-peer Jabber messaging service used by criminal customers. Ransomware operators used 1VPNS infrastructure to anonymize command-and-control traffic, conceal the origin of intrusions, stage and deploy ransomware payloads, and manage exfiltrated victim data during double-extortion negotiations. Rashevskyi is alleged to have used false identities -- "Maksim Sorin" and "Roman Chabanenko" -- to procure server and hosting infrastructure from providers that would otherwise have refused service due to prior abuse complaints.

Blockchain analysis (cited by OFAC and TRM Labs) ties at least three ransomware operations to direct payments to 1VPNS: the Anubis ransomware group sent a total of $715 in two tranches (December 13, 2025 and March 15-16, 2026); Qilin ransomware sent $120 on January 11, 2026; and Sinobi Group sent $58 on February 8, 2026. OFAC designated five cryptocurrency addresses (spanning Bitcoin, Ethereum, Litecoin, and Tron) tied to 1VPNS, all traced to the high-risk exchange Cryptomus, plus fifteen additional addresses (Bitcoin, Ethereum, Tron, Litecoin, Dogecoin, Dash, Zcash, Solana) tied personally to Rashevskyi.

Silayev's cryptor service is used by ransomware affiliates to repackage malware binaries so that they evade signature- and heuristic-based antivirus/EDR detection prior to deployment -- a widely used commodity service in the ransomware-as-a-service (RaaS) supply chain that materially lowers the technical barrier for affiliates to execute successful intrusions.

The sanctions action follows a May 2026 international law-enforcement operation, led by European authorities with support from the FBI's Boston Field Office, that took down the 1VPNS website and seized associated servers and domains, and arrested the alleged administrator. The July 2026 OFAC/UK designation freezes any US-touching assets of the designated parties, prohibits US persons from transacting with them, and is intended to disrupt the anonymization and obfuscation supply chain that underpins ransomware operations including Anubis and Sinobi -- both of which have caused significant losses to US critical infrastructure, healthcare, and municipal-government victims.

Anubis (active since ~November 2024, RaaS subscription priced around $723) is a Go-based ransomware notable for an integrated wiper mode (`/WIPEMODE`) that irreversibly zeroes out file contents after encryption, defeating recovery even if a ransom is paid; it encrypts using the Elliptic Curve Integrated Encryption Scheme (ECIES) and has targeted healthcare, construction, professional-services, and government victims via spear-phishing.

Sinobi (emerged mid-2025, RaaS subscription priced around $58) is assessed as a probable rebrand of the Lynx/INC ransomware lineage (63.2% function similarity to Lynx, 55.9% to INC Ransom) and has claimed 274+ victims across 27 countries as of July 2026, concentrated in US mid-market manufacturing, construction, and healthcare organizations. Sinobi affiliates have gained initial access via exploitation of CVE-2024-53704 (SonicWall SSLVPN improper authentication / session-cookie handling bypass), followed by AnyDesk deployment, Active Directory and credential-store enumeration, RClone-based cloud exfiltration, and Curve-25519/AES-128-CTR file encryption appending the `.SINOBI` extension.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1219 Remote Access Tools
- T1134 Access Token Manipulation
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1482 Domain Trust Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1090 Proxy
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities

## Sources

- [US sanctions first VPN service tied to ransomware operations](https://cyberscoop.com/us-sanctions-first-vpn-ransomware/)
- [Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans](https://home.treasury.gov/news/press-releases/sb0559)
- [OFAC Sanctions FirstVPN and Ransomware Enablers Behind Attacks on Americans](https://www.trmlabs.com/resources/blog/ofac-sanctions-firstvpn-and-ransomware-enablers-behind-attacks-on-americans)
- [U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support](https://thehackernews.com/2026/07/us-sanctions-first-vpn-service-and.html)
- [US sanctions VPN, malware providers for enabling ransomware attacks](https://www.bleepingcomputer.com/news/security/us-sanctions-vpn-malware-providers-linked-to-ransomware-gangs/)
- [VPN service favored by ransomware groups is sanctioned by US](https://therecord.media/first-vpn-administrator-us-sanctions-ransomware-groups)
- [Sanctioning Ransomware Enablers in Coordinated International Action](https://www.state.gov/releases/office-of-the-spokesperson/2026/07/sanctioning-ransomware-enablers-in-coordinated-international-action)
- [Anubis: A Closer Look at an Emerging Ransomware with Built-in Wiper](https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html)
- [Anubis: A Deep Dive into the Emerging Ransomware](https://www.bitsight.com/blog/anubis-ransomware-group-overview-and-evolution)
- [Anubis Ransomware Adds Destructive Wiper Capability](https://areteir.com/resources/anubis-ransomware-group-global-threat)
- [Dark Web Profile: Anubis Ransomware](https://socradar.io/blog/dark-web-profile-anubis-ransomware/)
- [Sinobi Ransomware Explained: Intrusion Methods, Encryption, and Incident Response](https://www.provendata.com/blog/sinobi-ransomware)
- [Dark Web Profile: Sinobi Ransomware](https://socradar.io/blog/dark-web-profile-sinobi-ransomware/)
- [Threat Actor Profile Sinobi](https://www.surefirecyber.com/threat-actor-profile-sinobi/)
- [sinobi-ransomware-cyber-threat-profile (TTPs, IoCs, IoAs)](https://github.com/molchanka/sinobi-ransomware-cyber-threat-profile)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1316