Cyber-related Designations; Cuba Designations; Issuance of Cuba-related Frequently Asked Question

Additions:

Treasury Press Release: Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans

State Press Release: Sanctioning Ransomware Enablers in Coordinated International Action

The following individuals have been added to OFAC’s SDN List:

OFAC Program: CYBER4  Executive Order 13694; Executive Order 13757; Executive Order 14144; Executive Order 14306

RASHEVSKYI, Dmytro

• AKA:
  • CHABANENKO, Roman
  • RASHEVSKY, Dmitry
  • SORIN, Maksim
  • “JOBBERJOBBER777”
  • “JOHNYW255”
  • “RASHDV7”
  • WALKER, Johny
• Address: Dnipro, Ukraine
• DOB: 05 Jan 1981
• Nationality: Ukraine
• Gender: Male
• Digital Currency Address – XBT: 1MTndG4K51RRMvkzyvguaHnQpiMLnxFGzM
• Alt. Digital Currency Address – XBT: 1DfyWkiXVVqWfcSduj23qTDis9kb2qvRDa
• Digital Currency Address – ETH: 0x1d19b52b54e7ef5ea1a4b40b616165e798eac9f8
• Alt. Digital Currency Address – ETH: 0x2C7DcD774b33e10367F7d6385479e04F97d179dc
• Digital Currency Address – LTC: LcP1DumXkNJbBtSYD3XxAfsJ2nZR5hLdpM
• Alt. Digital Currency Address – LTC: LbPAqHvemZBv3pvAqiAtDnZ3U1t6EziaL1
• Digital Currency Address – ZEC: t1LHesgnkapziGQCJtrfZWYXhyjfTVo1dvh
• Digital Currency Address – DASH: XcuGqRfrR85zyDrzVr1gSL5RNjwwpbu2KS
• Alt. Digital Currency Address – DASH: XowUeMFa1FkEUnAHL78E5oqpezMfSB6xP1
• Digital Currency Address – TRX: TTLRNgLpz5H5tLPuNU4FViUs7zmmAtyvzW
• Alt. Digital Currency Address – TRX: TBFW9gF4oDX5cG44gS7AoxQeujScmm3z6h
• Digital Currency Address – DOGE: DHzAVdEoL3PjGeLWNdEJwwMA1CeQ9J9Cpo
• Alt. Digital Currency Address – DOGE: DTqpKQ96rqkTvHcohQQd9BksmgRjasHgGo
• Digital Currency Address – SOL: Fc1EwQUZyTEagaDvA1utHXCcZNyG1x2PLt2DfNu1cJdH
• Alt. Digital Currency Address – SOL: FuCC7GoYwt5TsNTjWL23Xx9UKCvC18chjMEFPL3vJDCC
• Passport: FG819665 (Ukraine)
• Party Type: Individual

Supplemental Information: Rashevskyi is the administrator of First VPN Service (1VPNS). Treasury states he used the false identities above (“Maksim Sorin,” “Roman Chabanenko”) specifically to acquire infrastructure from providers who might otherwise have declined to do business with him, given abuse complaints already on file about illegal activity traced to 1VPNS servers.

SILAYEV, Yevgeniy Vladimirovich

• AKA: SILAYEU, Yauheni
• Address: Pestraa iela 8-7, Grodno, Belarus
• DOB: 09 Nov 2000
• Nationality: Belarus
• Gender: Male
• Passport: KH3188588 (Belarus) expires 04 May 2033
• Party Type: Individual

Supplemental Information: Silayev, a Belarusian national, supplied “cryptor” encryption and obfuscation services to ransomware operators targeting the U.S. and its allies. Treasury distinguishes cryptors from legitimate encryption tools: rather than protecting user data, they’re built specifically to disguise malware as harmless files so security software fails to flag it. Reporting from The Record indicates Silayev has no affiliation with First VPN Service; his designation reflects a separate contribution to the same ransomware-enabling ecosystem.

The following entities have been added to OFAC’s SDN List:

OFAC Program: CYBER4  Executive Order 13694; Executive Order 13757; Executive Order 14144; Executive Order 14306

FIRST VPN SERVICE

• AKA:
  • 1VPNS
  • FIRSTVPN
  • “FVPNS”
• Address: Dnipro, Ukraine
• Website: 1vpns.com
• Alt. Website: 1vpns.net
• Alt. Website: 1vpns.org
• Alt. Website: 1jabber.com
• Alt. Website: t.me/FirstVPNService
• Email Address: support@1vpns.com
• Digital Currency Address – XBT: bc1qdnr88f4d2yqunnc4mjsguezm6g3mlwe44z5dw8
• Alt. Digital Currency Address – XBT: bc1qr4ankqmvmrhce3ydvzse86dfx5s3zhehfr9tg9
• Digital Currency Address – ETH: 0x2711d73d559f62f4f855ee21f38378f528e07985
• Digital Currency Address – LTC: ltc1qr8ntsedq8tv0svmxqhzvdcdl5k7kntdmnhwep7
• Organization Established Date: Oct 2014
• Organization Type: Computer programming activities
• Digital Currency Address – TRX: TUuaxBAWfA5nmsqNfycxYrzEvz4a5GJMGY

Supplemental Information: 1VPNS is a VPN provider whose principal clients include ransomware groups and other cybercriminals; per Treasury, its infrastructure was used to hide attack origins, deploy malware, and manage exfiltrated data, with victims including U.S. businesses, financial services firms, hospitals, and municipal governments. It advertised on cybercriminal forums (identified by the FBI as Exploit and XSS) since 2014, marketing itself on a no-logs policy and refusal to cooperate with law enforcement. An FBI Flash advisory issued May 21, 2026 puts the service at roughly 32 exit-node servers across 27 countries, used by at least 25 ransomware groups (including Avaddon Ransomware) for reconnaissance, scanning, botnet activity, and denial-of-service operations. European law enforcement dismantled 1VPNS’s website and infrastructure in May 2026 with support from the FBI’s Boston Field Office; this action was coordinated with the UK’s Foreign, Commonwealth & Development Office, which sanctioned other cyber actors the same day.

State Fact Sheet: Further Sanctions on the Cuban Regime’s Sources of Funding and Tools of Oppression

OFAC Program: CUBA-EO14404  Executive Order 14404

ASSOCIATION OF COMBATANTS OF THE CUBAN REVOLUTION

• AKA:
  • ASOCIACION DE COMBATIENTES DE LA REVOLUCION CUBANA
  • “ACRC”
• Address: Havana, Cuba
• Organization Established Date: 07 Dec 1993
• Party Type: Civil Society Organization

Supplemental Information: Designated under Sec. 2(a)(i)(B) of E.O. 14404 for being owned or controlled by, or acting on behalf of, the Cuban government. State describes ACRC as a social and paramilitary organization overseen by Cuba’s Ministry of the Revolutionary Armed Forces (MINFAR, already designated) that conducts surveillance of dissidents at the direction of Cuba’s Ministry of the Interior.

COREYDAN S.A.

• Address: Havana, Cuba
• Organization Established Date: 19 Feb 2020
• Organization Type: Wholesale of solid, liquid and gaseous fuels and related products
• Entity Code: 60637 (Cuba)

Supplemental Information: Designated under Sec. 2(a)(i)(A) for operating in the energy sector of the Cuban economy. State identifies it as a Cuban state-owned entity engaged in importing solid, liquid, and gaseous fuels and related products.

CORPORACION ANTILLANA EXPORTADORA SA

• AKA:
  • ANTEX EXPORTING CORPORATION S.A.
  • ANTEX S.A.
  • ANTILLEAN EXPORTER PLC
  • CORPORACION ANTEX, S.A.
  • CORPORACION COMERCIAL ANTEX, S.A.
• Address: Havana, Cuba
• Organization Established Date: 01 Jan 1998
• Organization Type: Management consultancy activities
• Party Type: State-Owned Enterprise
• Entity Code: 60245 (Cuba)
• Linked to: GRUPO DE ADMINISTRACION EMPRESARIAL S.A.

Supplemental Information: Designated under Sec. 2(a)(i)(B) for being owned or controlled by, or acting on behalf of, Cuba’s GAESA (Grupo de Administracion Empresarial S.A.), a person already blocked under E.O. 14404. State identifies ANTEX S.A. as the Cuban state-owned entity managing the export of Cuban forced labor to Angola.

ENETEC S.A.

• Address: Havana, Cuba
• Organization Established Date: 09 Dec 2019
• Organization Type: Wholesale of solid, liquid and gaseous fuels and related products
• Entity Code: 60631 (Cuba)

Supplemental Information: Designated under Sec. 2(a)(i)(A) for operating in the energy sector of the Cuban economy. State identifies it as a Cuban entity engaged in the import and export of fuels and lubricants.

GRUPO EMPRESARIAL DE TRANSPORTE MARITIMO PORTUARIO

• AKA: “GEMAR”
• Address: Havana, Cuba
• Organization Established Date: 2015
• Organization Type: Activities of holding companies
• Party Type: State-Owned Enterprise

Supplemental Information: Designated under Sec. 2(a)(i)(B) as owned/controlled by, or acting on behalf of, the Cuban government. State describes GEMAR as a Cuban state-owned entity with a strong presence in the country’s maritime sector.

GRUPO EMPRESARIAL DEL COMERCIO EXTERIOR

• AKA: GECOMEX
• Address: Havana, Cuba
• Organization Established Date: 04 Jun 2013
• Organization Type: Wholesale and retail trade
• Party Type: State-Owned Enterprise

Supplemental Information: Designated under Sec. 2(a)(i)(B). State identifies GECOMEX as the Cuban state-owned business group managing the country’s foreign trade, handling a significant share of imports and exports.

MILICIAS DE TROPAS TERRITORIALES

• AKA:
  • “MTT”
  • “TERRITORIAL TROOP MILITIAS”
• Address: Cuba
• Organization Established Date: 20 Jan 1980
• Party Type: Government Entity

Supplemental Information: Designated under Sec. 2(a)(i)(F) for being a political subdivision, agency, or instrumentality of the Cuban government. State describes MTT as a part-time civilian paramilitary force under the command of Cuba’s Ministry of the Revolutionary Armed Forces (MINFAR, already designated).

MINISTRY OF TOURISM OF CUBA

• AKA:
  • MINISTERIO DE TURISMO DE CUBA
  • “MINTUR”
• Address: Havana, Cuba
• Organization Established Date: 21 Apr 1994
• Party Type: Government Entity

Supplemental Information: Designated under Sec. 2(a)(i)(F). State describes MINTUR as Cuba’s ministry responsible for regulating tourism in and out of the country, and the largest single tourism-sector player outside of GAESA.

ORGANIZACION SUPERIOR DE DIRECCION EMPRESARIAL CAUDAL S.A.

• AKA:
  • GRUPO CAUDAL S.A.
  • OSDE CAUDAL S.A.
• Address: Havana, Cuba
• Organization Established Date: 31 Mar 2000
• Organization Type: Activities of holding companies
• Party Type: State-Owned Enterprise

Supplemental Information: Designated under Sec. 2(a)(i)(B). State identifies CAUDAL as a Cuban state-owned entity specializing in insurance, reinsurance, financial services, and related professional services.

RAPID RESPONSE BRIGADES

• AKA:
  • BRIGADAS DE ACCION RAPIDA
  • BRIGADAS DE RESPUESTA RAPIDA
  • DESTACAMENTOS DE RESPUESTA RAPIDA
• Address: Cuba
• Organization Established Date: Jun 1991
• Organization Type: Public order and safety activities

Supplemental Information: Designated under Sec. 2(a)(i)(B). State describes these brigades as armed civilian para-police groups organized and trained by the Cuban government.

---

Sources (beyond the update and press release/fact sheet PDFs):

• OFAC, “Program Tag Definitions for OFAC Sanctions Lists” — https://ofac.treasury.gov/specially-designated-nationals-list-sdn-list/program-tag-definitions-for-ofac-sanctions-lists
• FBI, “First VPN Service Used by Ransomware Actors to Compromise Systems” (Flash Advisory, May 21, 2026) — https://www.fbi.gov/investigate/cyber/alerts/2026/first-vpn-service-used-by-ransomware-actors-to-compromise-systems
• The Record from Recorded Future News, “VPN service favored by ransomware groups is sanctioned by US” — https://therecord.media/first-vpn-administrator-us-sanctions-ransomware-groups