Joint operation dismantles First VPN Service (1VPNS)
Law Enforcement
Summary
Hide ▲
Show ▼
European and North American authorities dismantled First VPN Service (1VPNS) in a ransomware-linked takedown, removing infrastructure used to hide attack origins and other cybercrime activity. The service had supported the concealment of data theft, scanning, and denial-of-service attacks. The action disrupted a long-running proxy service that criminal actors used to enable offensive operations.
Related Happenings
OFAC sanctions First VPN Service and two individuals
Regulatory/Legal Action
H score27
First: 14.07.2026 11:02
Last: 14.07.2026 11:02
Sources 1
How related:
The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling ransomware actors' and other cybercriminals' malicious activities, including ransomware attacks against Americans.
About this happening:
OFAC sanctioned First VPN Service (1VPNS), Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling ransomware attacks and helping malicious software...
OFAC sanctions First VPN Service and two individuals
Regulatory/Legal ActionHow related: The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) has designated two individuals and a VPN service provider for enabling ransomware actors' and other cybercriminals' malicious activities, including ransomware attacks against Americans.
About this happening: OFAC sanctioned First VPN Service (1VPNS), Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling ransomware attacks and helping malicious software...
FBI seizes NetNut and Popa botnet domains
Law Enforcement
H score34
First: 02.07.2026 22:27
Last: 02.07.2026 22:27
Sources 1
About this happening:
The FBI seized hundreds of domains tied to NetNut and the Popa botnet, disrupting infrastructure used for abusive traffic and account-takeover activity. Th...
FBI seizes NetNut and Popa botnet domains
Law EnforcementAbout this happening: The FBI seized hundreds of domains tied to NetNut and the Popa botnet, disrupting infrastructure used for abusive traffic and account-takeover activity. Th...
First VPN Service as criminal VPN infrastructure for ransomware and fraud operators
Threat Actor Meta
H score18
First: 22.05.2026 20:35
Last: 22.05.2026 20:35
Sources 1
How related:
The VPN, named First VPN Service (1VPNS), has been accused of offering its tools to ransomware groups, along with its 45-year-old Ukrainian administrator, Dmytro Rashevskyi.
About this happening:
First VPN Service functioned as a criminal VPN layer that let ransomware, fraud, and data theft operators hide their identities, expanding the reach and resilience of undergro...
First VPN Service as criminal VPN infrastructure for ransomware and fraud operators
Threat Actor MetaHow related: The VPN, named First VPN Service (1VPNS), has been accused of offering its tools to ransomware groups, along with its 45-year-old Ukrainian administrator, Dmytro Rashevskyi.
About this happening: First VPN Service functioned as a criminal VPN layer that let ransomware, fraud, and data theft operators hide their identities, expanding the reach and resilience of undergro...
Latest development: 14.07.2026 11:02
The U.S. Treasury Department’s OFAC sanctioned First VPN Service (1VPNS), Ukrainian administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for supporting ransomware actors; Treasury said First VPN Service was used to hide attack origins, deploy malware, and manage exfiltrated data, and that victims included U.S. businesses, financial services companies, hospitals, and municipal governments.
First VPN had assets seized in First VPN takedown
Law Enforcement
H score17
First: 21.05.2026 18:30
Last: 21.05.2026 18:30
Sources 1
About this happening:
Authorities took down First VPN, a ransomware-linked service used to hide cybercrime activity, in a coordinated action led by France and the Netherlands. The operation...
First VPN had assets seized in First VPN takedown
Law EnforcementAbout this happening: Authorities took down First VPN, a ransomware-linked service used to hide cybercrime activity, in a coordinated action led by France and the Netherlands. The operation...
First VPN takedown by Europol and French-Dutch authorities
Law Enforcement
H score17
First: 21.05.2026 16:09
Last: 21.05.2026 16:09
Sources 1
About this happening:
Europol and French and Dutch authorities took First VPN offline in a cross-border operation that also seized servers and arrested the administrator. The case m...
First VPN takedown by Europol and French-Dutch authorities
Law EnforcementAbout this happening: Europol and French and Dutch authorities took First VPN offline in a cross-border operation that also seized servers and arrested the administrator. The case m...
Timeline
-
14.07.2026 11:02 2 articles · 14d ago
Joint operation dismantles First VPN Service (1VPNS)
Initial DisclosureBy May 2026, authorities had dismantled First VPN Service (1VPNS) in a cross-border operation spanning Europe and North America. The action cut off infrastructure used to hide the origins of ransomware, data theft, scanning, and denial-of-service attacks.
Show sources
- U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support — thehackernews.com — 14.07.2026 11:02
- U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support — thehackernews.com — 14.07.2026 11:02