Law enforcement shuts down First VPN used in cybercrime operations

A virtual private network service used extensively by cybercriminals to conceal ransomware attacks, fraud, and data theft has been dismantled in a coordinated international law enforcement operation. The action, led by authorities in France and the Netherlands, targeted the service known as First VPN and unfolded over two days, May 19 and 20.

Officials from Europol and Eurojust, alongside agencies from multiple other countries, seized 33 servers across 27 nations and took control of the service’s primary domains, including 1vpns.com, 1vpns.net, and 1vpns.org, as well as associated onion-routed addresses. The service’s administrator was interviewed during a house search in Ukraine.

First VPN had been advertised for years on Russian-language cybercrime forums as a tool to evade law enforcement, offering anonymous payments and infrastructure tailored for illicit use. According to Europol, the service was deeply embedded in the cybercrime ecosystem and had appeared in almost every major cybercrime investigation the agency supported in recent years.

The investigation, which began in December 2021, allowed authorities to eventually gain access to the service and obtain its user...