This time, OFAC isn’t chasing wallets—it’s going after VPNs. At last, infrastructure providers have been brought to the table to “eat” the sanctions, and on-chain forensics is getting more and more meticulous.

According to TRM Labs, OFAC sanctioned FirstVPN, administrator Dmytro Rashevskyi, and Belarusian crypto obfuscation service provider Yevgeniy Silayev, accusing them of providing anonymous networks and obfuscation tools for ransomware attacks targeting U.S. businesses, hospitals, and government agencies, and published 20 related crypto addresses. On-chain tracking shows that groups such as Anubis and Qilin had previously paid FirstVPN, indicating the focus is on infrastructure providers rather than a single ransomware gang.