Police dismantle First VPN, a service used to hide ransomware attacks
Police led by France and the Netherlands dismantled First VPN, a virtual private network service marketed to criminals, seizing 33 servers and its domains on May 19 and 20, Europol announced May 21. Canada, Germany and the United States supported the investigation, according to reporting by Teiss and Heise.
Ransomware crews use services like this to hide where they connect from when they break into networks, run extortion operations and move stolen data. Europol said First VPN showed up in "almost every major cybercrime investigation" it had supported in recent years.
What happened
The action, which Bitdefender identified as Operation Saffron, took place in Luxembourg, Switzerland, Romania, Ukraine and the United Kingdom, Heise reported. Investigators searched a home in Ukraine and questioned the service's alleged administrator. Several outlets, including Heise and InCyber, reported that Ukrainian police arrested him with support from French cybercrime investigators; others described him only as interviewed. He was not named.
Seized domains included 1vpns.com, 1vpns.net and 1vpns.org, plus associated onion addresses, CyberInsider reported.
The bigger prize may be the data. Investigators had access to the platform and recovered its user database. Information on 506 users was shared with other countries, and French police estimated the total user base at up to 5,000. Europol said the intelligence produced 83 packages for partner agencies and advanced 21 investigations it supports.
The service was advertised on Russian-speaking cybercrime forums. Dutch police said it promised not to co-operate with judicial authorities, claimed to be outside any jurisdiction and said it kept no user data. Heise reported that at least 25 ransomware groups, including Avaddon, had used its infrastructure, and that the FBI published a warning with a list of known First VPN IP addresses.
Background
Europol's investigation began in December 2021. French authorities spotted the service on forums in 2022, and France and the Netherlands formed a joint investigation team in November 2023. "This operation proves them wrong," Edvardas Šileris, head of Europol's European Cybercrime Centre, said of the service's promises of anonymity.
What we don't know yet
Authorities did not say which Canadian agency supported the case or whether any of the identified users are in Canada. Europol described the investigation as continuing.
What to do
- Security teams can check VPN and firewall logs for connections from IP addresses in the FBI's First VPN list.
- Investigate any successful logins from those addresses as possible compromise.
