The US government has gone after the plumbing rather than the plumbers, and the target this time is a VPN. Treasury’s Office of Foreign Assets Control sanctioned First VPN Service and its Ukrainian administrator, Dmytro Rashevskyi, for helping cybercriminals. The service ran since 2014 and became a favourite among ransomware gangs hitting American hospitals, municipalities, and businesses.
The service sold exactly what criminals wanted. Treasury said it let attackers “hide the origins of their attacks, deploy malware, and manage exfiltrated data.” Rashevskyi marketed it aggressively on dark web forums, promising total anonymity and boasting that the network kept no logs of users’ identities or activities. He also advertised that it refused to cooperate with law enforcement.
That pitch deserves a pause, since it sounds identical to what legitimate privacy VPNs advertise. The difference sits in intent and audience, because Rashevskyi sold to ransomware crews rather than journalists or ordinary users. Yet the overlap explains why VPNs keep drawing regulatory fire worldwide, often with little distinction between the two.
Interesting, Pakistan is one of the key examples that show how that logic travels. The PTA moved from an open internet to a whitelist system, requiring VPN registration and blocking unregistered services. Officials called unregistered VPNs a security risk enabling access to sensitive data. Meanwhile the Council of Islamic Ideology went further and declared VPN use to reach blocked content un-Islamic. Over 20,000 VPNs have since registered, though the framework requires providers to share user data on request, which directly contradicts the no-logs policies most reputable services run on.
Russia’s Roskomnadzor wants to block 92% of VPN apps by 2030. They plan to invest 20 billion rubles yearly to build permanent censorship infrastructure. The EU has signalled VPNs are its next target after launching age verification, while Utah passed VPN restrictions and Malaysia is cracking down on misuse.
This latest wave of sanctions was coordinated alongside the United Kingdom’s Foreign, Commonwealth & Development Office (FCDO) and carries severe consequences for the designated individuals.
