🇪🇺🇳🇱🇫🇷EuroPol: Cybercriminal VPN used by ransomware actors dismantled in global crackdown

VPN service featured in almost every major Europol-supported cybercrime investigation

A VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offences has been dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust.

For years, the service, known as ‘First VPN’, was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.

‘First VPN’ had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years.

Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.

The coordinated action took place between 19 and 20 May and targeted the infrastructure behind one of the most widely used VPN services in the cybercrime underground.

During the action days, authorities:

🟠Interviewed the administrator and conducted a house search in Ukraine

🟠 Dismantled 33 servers linked to the criminal service

🟠Disrupted infrastructure used to support cybercriminal activity worldwide. 

The target domain names have been shut down thanks to the joint international law enforcement and judicial cooperation with the following domain names seized:
🟠 1vpns.com
🟠 1vpns.net
🟠 1vpns.org
🟠 Associated onion domains

Users of the criminal service have been notified of the shutdown and informed that they have been identified. 

🔗europol

😎@QtimeNetwork | ⚡️ Boost
.