US Sanctions Entities Supporting Ransomware Operations

Why it matters locally: The U.S. sanctions against entities supporting ransomware operations could help mitigate the risk of cyberattacks on Oregon's critical infrastructure, including hospitals, schools, and local government systems, which have seen an increase in such threats nationally.

WASHINGTON – The United States on July 13, 2026, sanctioned one entity and two individuals for allegedly providing support to ransomware groups. These groups have reportedly targeted American critical infrastructure providers, including hospitals, schools, businesses, and local governments. The sanctioned entity is First VPN Service (1VPNS). The individuals named in the sanctions are Dmytro Rashevskyi, identified as 1VPNS's administrator, and Yegeniy Vladimirovich Silayev. According to authorities, these individuals and the service supplied ransomware groups with tools to conceal their identities, disguise malicious software, and evade detection. Officials assert that these actions enabled attacks that resulted in billions of dollars in losses to U.S. critical infrastructure. This action coincides with coordinated efforts with the United Kingdom's Foreign, Commonwealth & Development Office. It also follows a European law enforcement operation in May 2026, which the Federal Bureau of Investigation (FBI) supported, that disrupted 1VPNS’s infrastructure. Authorities stated that these measures aim to dismantle broader networks supporting cybercriminal activity worldwide by targeting service and tool providers in addition to ransomware operators. The United States plans to continue utilizing diplomatic and economic measures to disrupt foreign cybercriminals and those who enable them. Officials have characterized ransomware as a foreign policy threat affecting the security and economic stability of the United States and its allies. The sanctions were enacted under the authority of Executive Order (E.O.) 13694, as amended by E.O. 13757, E.O. 14144, and E.O. 14306.