U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses
VPN provider 1VPNS and cryptor seller sanctioned for facilitating attacks on critical infrastructure.
1Scope of Sanctions
The U.S. Treasury sanctioned VPN provider 1VPNS and cryptor seller Yegeniy Silayev for supplying tools to ransomware groups. These groups have caused billions in damages to U.S. businesses and critical infrastructure.
21VPNS's Role
1VPNS helped ransomware groups encrypt internet traffic and hide their identities. The VPN provider openly advertised on cybercrime forums that it kept no logs and wouldn't cooperate with law enforcement.
3Cryptor Seller Silayev
Yegeniy Silayev sold 'cryptors' that disguised ransomware as harmless files. These tools made malware more effective by evading security systems.
4International Coordination
The U.S. action was coordinated with the UK and European authorities. In May 2026, European law enforcement, with FBI support, seized 1VPNS's servers.
5Impact of Sanctions
The sanctions freeze U.S.-based assets of the designated individuals and entities, banning Americans from transactions with them. This move targets the ransomware supply chain.
6New Era in Cybersecurity
This action shows the U.S. is targeting the entire ransomware supply chain. Not just operators, but their enablers now face sanctions, marking a shift in cybercrime deterrence.