Wu Shuo learned, according to TRM Labs, that the U.S. Department of the Treasury’s OFAC has sanctioned FirstVPN, its administrator Dmytro Rashevskyi, and the Belarusian “crypto” service provider Yevgeniy Silayev, accusing them of providing anonymous networking and malware obfuscation tools to carry out ransomware attacks targeting U.S. companies, hospitals, and government institutions. This action is not aimed at a specific ransomware group, but directly targets its infrastructure supplier. OFAC also listed 20 related cryptocurrency addresses, involving BTC, ETH, TRX, LTC, DOGE, DASH, ZEC, and SOL. TRM on-chain tracking shows that ransomware groups such as Anubis and Qilin had directly paid FirstVPN for services.