U.S. Sanctions First VPN Service and Malware Cryptor Seller Over Ransomware Support 美国制裁首个VPN服务和恶意软件加密器卖家，因其支持勒索软件

TL;DR

• The U.S. Treasury designated First VPN Service and two individuals for facilitating ransomware attacks, marking the first time a VPN provider has been sanctioned for enabling cybercriminals.
• The UK and EU imposed sanctions on Russian intelligence-linked entities and cybercriminals, highlighting the convergence of state-sponsored espionage and commercial cybercrime ecosystems.
• The FBI issued an advisory regarding FSB Center 16 exploiting vulnerable routers via SNMP and known CVEs to access critical infrastructure networks globally.

Why It Matters

This development signals a significant escalation in regulatory enforcement against the cybercrime supply chain, specifically targeting infrastructure providers like VPNs and malware cryptors that enable malicious activities. For security professionals, it underscores the urgent need to secure network perimeters and patch legacy vulnerabilities, as state-sponsored actors continue to exploit poorly configured devices to compromise critical infrastructure.

Technical Details

• Sanctioned Infrastructure: First VPN Service (1VPNS) was dismantled in May 2026 after providing anonymity tools to ransomware groups to hide attack origins and manage exfiltrated data.
• Malware Obfuscation: Yegeniy Silayev was sanctioned for selling cryptors designed to disguise ransomware and malware as legitimate software to evade detection by security tools.
• Exploitation Techniques: FSB Center 16 actors utilize SNMP Set-Requests with spoofed IPs to extract configurations from poorly secured routers, leveraging default community strings and specific OIDs.
• Vulnerability Abuse: Active exploitation of Cisco vulnerabilities, specifically CVE-2018-0171 and CVE-2008-4128, is being used to discover and compromise networking appliances.
• Attribution: Threat actors are tracked under aliases such as Berserk Bear, Crouching Yeti, and Dragonfly, linking them to Russian intelligence services like GRU and FSB.

Industry Insight

Organizations must prioritize the immediate remediation of known exploited vulnerabilities (KEVs) and enforce strict network segmentation to prevent lateral movement from compromised edge devices. Additionally, cybersecurity strategies should include monitoring for abuse of common protocols like SNMP and ensuring that all remote access infrastructure is vetted against emerging regulatory designations to mitigate complicity risks.

TL;DR

• 美国财政部OFAC制裁乌克兰籍VPN服务商“First VPN”及其管理员，因其协助勒索软件团伙隐藏攻击源头并造成数十亿美元损失。
• 英国与欧盟联合制裁24名俄罗斯个人及实体，包括GRU高级官员及Lumma Stealer开发者，指控其利用网络犯罪生态系统进行破坏性网络行动及间谍活动。
• FBI发布警告指出俄罗斯FSB Center 16黑客组织正通过SNMP协议漏洞和Cisco设备已知漏洞（如CVE-2008-4128）大规模扫描并入侵配置不当的路由器。
• 此次制裁与执法行动反映了国家行为体与网络犯罪团伙之间界限模糊的趋势，以及针对关键基础设施的网络攻击日益加剧。

为什么值得看

本文揭示了地缘政治冲突背景下，国家级黑客组织与商业网络犯罪生态系统的深度交织，为理解现代混合战争形态提供了关键案例。对于安全从业者而言，文中提到的具体攻击手法（如SNMP滥用）和受制裁实体名单是更新威胁情报库和防御策略的重要参考。

技术解析

• 勒索软件基础设施支持：First VPN被指控自2014年起运营，通过不记录日志和不配合执法的方式，为勒索软件团伙提供匿名化服务，用于部署恶意软件和管理窃取的数据。
• 国家级网络侦察技术：FSB Center 16利用代理服务器发送伪造IP的SNMP Set-Requests，利用默认社区字符串认证，诱导配置不当的路由器将配置文件传输至攻击者控制的VPS或FTP服务器。
• 已知漏洞利用：攻击者积极利用Cisco设备的CVE-2018-0171和CVE-2008-4128等漏洞进行初始访问，其中CVE-2008-4128已被CISA列入已知被利用漏洞目录，要求联邦机构在2026年7月16日前修复。
• 恶意软件即服务（MaaS）：Lumma Stealer被用于大规模收集敏感信息，俄罗斯情报机构被指利用该工具窃取凭证以支持全球范围内的网络间谍活动。

行业启示

• 强化网络设备基线安全：鉴于SNMP和路由器配置错误成为国家级APT组织的常见入口，企业应立即审计全网网络设备，禁用默认凭证，关闭不必要的SNMP服务或限制访问源。
• 关注供应链与第三方风险：制裁涉及的基础设施提供商（如VPN、恶意软件开发者）表明，网络犯罪生态系统的合规性审查至关重要，需警惕间接支持恶意活动的第三方服务。
• 加速漏洞修补流程：CISA对已知漏洞的强制修复期限提醒组织，必须建立针对高危已知漏洞的快速响应机制，特别是针对长期存在但常被忽视的老版本设备漏洞。