Authorities in North America and Europe have participated in a law enforcement operation to disrupt First VPN, a popular cybercrime service used for ransomware and other attacks.
According to the FBI, First VPN has been active since 2014, providing 32 exit nodes across 27 countries at the time of its disruption. The service, advertised on Russian-language dark web cybercrime forums, has been used by at least 25 ransomware groups for network reconnaissance and intrusions.
IP addresses associated with First VPN have been involved in scanning, botnets, DoS attacks, and hacking.
The FBI has published an alert with technical details, IoCs, MITRE ATT&CK mappings, and recommendations.
According to Europol, law enforcement and partners dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal activity. The takedown targeted the 1vpns.com, 1vpns.net, 1vpns.org, and onion domains.
The alleged administrator of the cybercrime service has been arrested in Ukraine.
“Users of the criminal service have been notified of the shutdown and informed that they have been identified,” Europol said, noting that information on 506 users was shared internationally.
Bitdefender, which was involved in the takedown, pointed out that the 506 users are a subset of First VPN’s customer base, and investigators will determine which of them can be linked to criminal operations.
“Some will be traced to known ransomware groups. Others will reveal fraud operations, data theft campaigns, or cybercrime-as-a-service infrastructure we didn’t know existed,” Bitdefender said.
“New anonymization services will appear. The economic demand hasn’t changed. But each takedown shortens the operational window of the next service and raises the barrier for actors who relied on turnkey solutions,” the cybersecurity firm added. “First VPN advertised itself as a service criminals could trust to keep them beyond law enforcement’s reach. The operation proved that claim wrong, and every actor evaluating the next anonymization service now knows the same risk exists.”
Related: Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’
Related: RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement
Related: Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation
