The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) designated First VPN Service (1VPNS) and two individuals in a landmark action targeting infrastructure enablers of ransomware operations. This marks the first time the U.S. government has sanctioned a VPN provider for direct support of ransomware actors.

OFAC identified 1VPNS as providing critical operational cover for ransomware groups and other cybercriminals conducting attacks against American targets. The service enabled threat actors to obscure their infrastructure, mask command-and-control communications, and coordinate extortion campaigns while evading law enforcement detection.

The designation also included sanctions against two individuals linked to the service. One, a 45-year-old Ukrainian national, operated 1VPNS and actively marketed anonymization services to known ransomware operators. The sanctions block access to U.S. financial systems and prohibit American persons and entities from transacting with the provider or its operators.

VPN providers occupy a gray legal zone. Legitimate privacy tools protect journalists, dissidents, and privacy-conscious users. However, ransomware groups routinely abuse commercial VPN services to hide malicious traffic and operational infrastructure. 1VPNS crossed from neutral tool provider into active criminal facilitation by knowingly marketing services to ransomware actors and customizing offerings for their needs.

The action reflects escalating U.S. enforcement against ransomware supply chains. Rather than targeting ransomware operators themselves, increasingly difficult to prosecute internationally, OFAC targets the infrastructure providers who knowingly enable attacks. Previous actions targeted cryptocurrency exchanges, money laundering services, and hosting providers used by ransomware groups.

Organizations relying on VPN services for legitimate purposes should audit their provider's policies, terms of service enforcement, and compliance posture. Entities may face secondary sanctions exposure if they continue patronizing designated services