First VPN Service Review: Sanctions, Infrastructure, and User Risks

First VPN Service operated as a VPN provider from 2014 until its infrastructure was dismantled in May 2026. U.S. Treasury sanctions in July 2026 designated the service for supporting ransomware groups, blocking U.S. persons from any dealings with the entity.

First VPN Service Overview and Sanctions Background

First VPN Service launched in October 2014 in Dnipro, Ukraine. It marketed itself on cybercrime forums as a no-logs provider that would not cooperate with law enforcement. The service supported OpenVPN, WireGuard, Outline, Shadowsocks, V2Ray, and VLESS/Reality protocols across roughly 33 servers in 27 countries, including three in the United States. Payments were accepted in cryptocurrency only.

On July 13, 2026, the Office of Foreign Assets Control added First VPN Service, its administrator Dmytro Rashevskyi, and associate Yegeniy Vladimirovich Silayev to the Specially Designated Nationals list under Executive Order 13694. The designation marked the first time OFAC sanctioned a VPN provider specifically for ransomware facilitation. All U.S.-jurisdiction property of the designated parties became blocked, and U.S. persons are prohibited from transactions with them without a license.

Operation Saffron, an international law-enforcement effort led by France and the Netherlands with support from Europol, Eurojust, and the FBI, had already seized the service’s domains and servers in May 2026. Investigators had accessed the infrastructure since December 2021 and obtained user databases and traffic logs that identified more than 500 individuals.

Infrastructure, Operations, and Compliance Impact

The service ran 32–33 exit nodes and advertised anonymity features that appealed to malicious actors. Twenty-five ransomware groups, including Anubis, Qilin, Sinobi, and Avaddon, used the VPN for command-and-control traffic, data exfiltration, and origin concealment. Victims included U.S. hospitals, financial firms, and municipal governments.

OFAC sanctions impose strict liability. U.S. companies must screen counterparties against the SDN list and block listed cryptocurrency addresses. Penalties for violations can exceed one million dollars per instance. The 50-percent ownership rule extends restrictions to any entity owned 50 percent or more by designated parties. Historical transaction reviews and ongoing monitoring of crypto flows are now required for any organization that previously accepted payments from First VPN Service users.

Users received notification that their activity logs were seized. Service domains and onion sites remain offline. No delisting announcements have been issued as of October 31, 2026. Legitimate VPN use continues through unrelated providers that maintain transparent logging policies and cooperate with lawful requests.

• Blocked U.S. transactions without OFAC license
• Requirement to screen all crypto addresses against listed identifiers
• Potential civil penalties above $1 million for violations
• International coordination with UK sanctions and FBI indicators of compromise