OFAC recently designated the VPN provider 1VPNS and a cryptor supplier tied to ransomware infrastructure, signaling a tactical shift: U.S. enforcement is moving from chasing individual attackers to targeting the services that let them operate anonymously and evade detection.

The specific designations and the legal reach

OFAC named 1VPNS (marketed since 2014 on cybercriminal forums with “no logs” and anti-law‑enforcement claims), Dmytro Rashevskyi (who used multiple aliases and false identities to acquire hosting from providers wary of abuse), and Yevgeniy Vladimirovich Silayev (a supplier of cryptors that obfuscate malware code). The listings are tied to Executive Orders 13694 and 14390 and block property and transactions in U.S. jurisdiction.

The sanctions automatically cover entities owned 50% or more by these designated parties and prohibit U.S. persons from dealing with them unless OFAC issues a license; that extension makes ownership and corporate structure a compliance focal point rather than a peripheral detail.

How VPNs and cryptors change attribution and detection

Recommended Reading

FBI probes coordinated malware in Steam games — if it ties one actor, Valve will be under pressure to change vetting

The FBI’s Seattle Division has opened a public investigation into multiple Steam games that embedded malware to steal cryptocurrency and hijack accounts between May 2024 and January 2026. The agency is asking anyone who installed the affected titles to submit incident details and victim information while it investigates a likely coordinated campaign exploiting Steam’s release […]

FBI probes coordinated malware in Steam games — if it ties one actor, Valve will be under pressure to change vetting

VPN providers can erase or mask attacker footprints and, in the case described by OFAC, operators like Rashevskyi used false identities to buy infrastructure that would otherwise have been rejected for abuse—an operational step that complicates takedowns and law‑enforcement response.

Cryptors, such as those supplied by Silayev, are not data‑encryption tools for legitimate protection: they actively obfuscate malware binaries so security products fail to flag malicious payloads. That technical distinction—obfuscation versus legitimate encryption—explains why OFAC treated the supplier as an enabler rather than a neutral vendor.

Practical checkpoints for banks, VASPs, and payment platforms

Financial institutions and virtual asset service providers now face two parallel pressures: (1) traditional sanctions screening based on names and ownership chains under the EOs, and (2) behavioral detection for services (VPN rentals, cryptor-related revenues, suspicious wallet flows) that indicate possible ransomware enablement.

Decision lens: when to proceed, adjust, or stop transactions

If there is a clear OFAC designation or a deemed 50% ownership link, stop transactions and seek an OFAC license before continuing; that is a legal threshold, not a risk appetite choice. Where there is no designation but strong behavioral indicators—advertising on cybercriminal forums, “no logs” promises, use of false identities—treat relationships as high‑risk and apply enhanced due diligence, transaction limits, and human review.

Escalate to law enforcement or compliance if you see recurring payment patterns to the same infrastructure providers or to wallets linked by blockchain analytics to known cryptor suppliers. Note that the UK’s Foreign, Commonwealth & Development Office issued parallel measures, so multi‑jurisdictional coordination is now a practical requirement for cross‑border institutions.

Short Q&A

Will using a VPN trigger sanctions? No—ordinary VPN use by individuals or businesses is not targeted. The sanctions focus on providers whose business practices and customer base clearly enable ransomware operations, per OFAC’s findings.

Do these measures criminalize software obfuscation? OFAC’s action targets suppliers of cryptors when the product is knowingly used to enable malicious campaigns; legitimate code‑protection vendors that can demonstrate lawful use and customer controls are in a different compliance posture.

What should compliance teams watch next? The immediate checkpoint is whether OFAC lists additional VPNs or cryptor services and how banks and VASPs update screening to catch layered corporate structures and cryptocurrency flows tied to those vendors.