In one of the most significant coordinated cybercrime enforcement actions in recent years, international law enforcement agencies have dismantled a criminal virtual private network service allegedly used by ransomware gangs, fraud networks, and data thieves to conceal malicious online activity across the globe.
The operation targeted a service known as “First VPN,” a platform investigators say was specifically engineered to support cybercriminal operations by offering anonymous infrastructure, encrypted communications, and routing services designed to frustrate digital investigations.
Authorities from Europe and North America announced the takedown this week following a multinational investigation that began in late 2021 and culminated in simultaneous raids, server seizures, and forensic operations carried out between May 19 and May 20.
The crackdown was spearheaded by authorities in France and the Netherlands, with operational support from more than a dozen countries including the United States, Canada, Germany, the United Kingdom, Ukraine, Spain, Sweden, Poland, Portugal, and several Baltic and Eastern European nations.
Investigators described the dismantled platform as a “criminal safe haven” for ransomware operators and cybercriminal syndicates seeking to hide their identities while launching attacks against businesses, governments, and institutions worldwide.
A VPN Service Built for Criminal Anonymity
According to European law enforcement agencies, First VPN was not marketed as a typical privacy-focused VPN service aimed at consumers seeking online security or bypassing geographic restrictions. Instead, investigators allege the platform openly catered to cybercriminals by advertising anonymity guarantees and resistance to law enforcement requests.
The service reportedly operated for more than a decade, with investigators tracing its activities back to approximately 2014.
Officials from Europol said the VPN service was heavily promoted on Russian-speaking cybercrime forums including Exploit[.]in and XSS[.]is — two platforms long monitored by cybersecurity researchers for facilitating ransomware partnerships, malware sales, and illicit hacking services.
Authorities say the operators behind First VPN promised customers that:
- no activity logs would be stored,
- user identities could not be traced,
- servers would remain outside the reach of judicial authorities,
- and payments could be made anonymously using cryptocurrency and digital payment systems.
The service’s own promotional material allegedly emphasized “Anonymity, Stability, Security,” while claiming it would never cooperate with investigators or disclose customer data.
Archived versions of the company’s website reportedly stated that the platform retained only usernames and email addresses and could not associate internet activity with specific subscribers.
However, investigators now believe the infrastructure was deeply embedded in global cybercriminal ecosystems.
Used by Ransomware Groups Across Multiple Continents
Authorities say at least 25 ransomware groups used First VPN infrastructure to conduct cyberattacks, network intrusions, reconnaissance operations, and data theft campaigns.
Among the ransomware groups identified was the notorious Avaddon ransomware operation, which previously targeted businesses and organizations worldwide through extortion-based attacks that encrypted victim systems and demanded cryptocurrency payments.
Investigators allege cybercriminals relied on the VPN service to:
- mask the origin of attacks,
- bypass geographic attribution,
- route malicious traffic through multiple countries,
- conceal command-and-control communications,
- and evade law enforcement tracking efforts.
The infrastructure was also reportedly used in:
- distributed denial-of-service (DDoS) attacks,
- credential theft campaigns,
- online fraud operations,
- and unauthorized network scanning.
Criminal VPN services like First VPN play a critical role in modern ransomware ecosystems because they provide attackers with operational anonymity while complicating international digital investigations.
Unlike conventional consumer VPN providers, so-called “bulletproof” infrastructure services are often designed to intentionally ignore abuse complaints and law enforcement requests.
Massive International Operation Unfolded Across Europe and North America
The takedown operation involved coordinated actions in multiple jurisdictions simultaneously.
According to officials from Eurojust, investigators conducted:
- interviews with the service administrator,
- searches of residences in Ukraine,
- forensic examinations of digital infrastructure,
- and the seizure of dozens of servers linked to the operation.
Authorities confirmed that 33 servers associated with First VPN were taken offline during the operation.
Several domains connected to the service were also confiscated, including:
- 1vpns[.]com
- 1vpns[.]net
- 1vpns[.]org
In addition, investigators seized related onion domains operating on the Tor anonymity network.
Officials described the operation as a major disruption to cybercriminal infrastructure rather than a simple website takedown, noting that the seized systems had supported malicious activity affecting victims worldwide.
FBI Details Global Server Network
In a coordinated advisory, the Federal Bureau of Investigation revealed additional technical details about the network’s global infrastructure.
According to the FBI, First VPN operated 32 exit node servers distributed across 27 countries.
Three servers were reportedly located in the United States, while additional infrastructure was identified in:
- Australia,
- Austria,
- Belgium,
- Canada,
- Cyprus,
- Finland,
- France,
- Germany,
- Hong Kong,
- Italy,
- Latvia,
- Luxembourg,
- Moldova,
- the Netherlands,
- Panama,
- Poland,
- Romania,
- Russia,
- Serbia,
- Singapore,
- Spain,
- Sweden,
- Switzerland,
- Turkey,
- Ukraine,
- and the United Kingdom.
The geographic dispersion of the servers allegedly enabled cybercriminals to rapidly shift traffic between jurisdictions, complicating attribution and delaying legal response efforts.
Dstributed VPN infrastructures are especially valuable to ransomware operators because they allow malicious traffic to blend in with legitimate encrypted internet communications.
Sophisticated Encryption and Traffic Obfuscation
Investigators say First VPN offered multiple connection protocols and encryption methods commonly associated with advanced privacy and tunneling technologies.
According to the FBI, supported protocols included:
- OpenConnect,
- WireGuard,
- Outline,
- and VLESS TCP Reality.
The service also reportedly supported:
- OpenVPN ECC,
- L2TP/IPSec,
- and PPTP encryption methods.
One of the most concerning features highlighted by investigators was the platform’s use of “VLESS” and “Reality” technologies, which allegedly enabled VPN traffic to imitate standard HTTPS web traffic.
This capability made malicious activity significantly more difficult to detect because traffic could appear identical to ordinary encrypted browsing sessions.
These technologies are increasingly used in sophisticated evasion techniques that allow attackers to bypass network monitoring systems and security filters.
Technical support for users was reportedly provided through encrypted channels including Telegram and a self-hosted Jabber server.
Anonymous Payments and Criminal Accessibility
Authorities also revealed details about the service’s payment model, which investigators say was structured to maximize anonymity and accessibility for cybercriminal users.
Subscription plans reportedly ranged from:
- $2 for one-day access,
- to $483 for annual subscriptions.
The service accepted several payment methods commonly favored in cybercriminal ecosystems, including:
- Bitcoin,
- Perfect Money,
- WebMoney,
- EgoPay,
- and InterKass.
The relatively low pricing structure likely made the service accessible not only to sophisticated ransomware groups but also to lower-level fraud actors and cybercriminal newcomers.
Law Enforcement Increasingly Targets Cybercrime Infrastructure
The dismantling of First VPN reflects a broader global shift in cybercrime enforcement strategy.
Rather than focusing exclusively on arresting individual hackers, international authorities are increasingly targeting the infrastructure that enables ransomware ecosystems to function — including hosting providers, VPN services, cryptocurrency laundering networks, malware distribution platforms, and illicit online forums.
Over the past several years, multinational cyber operations have increasingly focused on:
- disrupting ransomware payment systems,
- seizing criminal infrastructure,
- dismantling botnets,
- and infiltrating dark web communication channels.
Infrastructure takedowns can have wider operational impacts because they disrupt entire criminal supply chains rather than isolated threat actors.
However, cybercriminal groups often rebuild quickly by migrating to alternative hosting providers, decentralized infrastructure, or underground replacement services.
The Growing Global Threat of Ransomware
The takedown comes amid continuing international concern over the scale and sophistication of ransomware attacks.
Governments and cybersecurity agencies worldwide have repeatedly warned that ransomware groups increasingly operate like organized criminal enterprises, complete with affiliate structures, technical support systems, negotiation teams, and revenue-sharing arrangements.
Many modern ransomware groups rely on interconnected underground services, including:
- anonymization networks,
- stolen credential marketplaces,
- malware-as-a-service platforms,
- cryptocurrency laundering tools,
- and bulletproof hosting providers.
Disrupting those enabling services is becoming essential to slowing the global ransomware economy.
While authorities have not yet announced criminal charges connected directly to the First VPN operation, investigators indicated that forensic analysis of the seized servers and infrastructure remains ongoing.
Law enforcement agencies believe the operation could yield additional intelligence about ransomware groups and cybercriminal networks that relied on the service over the past decade.
Questions Remain Over the Future of Criminal VPN Networks
Despite the takedown, cybersecurity researchers caution that the broader underground market for criminal anonymization services remains highly active.
Services advertising “no logs,” offshore hosting, and law-enforcement-resistant infrastructure continue to circulate on dark web marketplaces and cybercrime forums.
Demand for such tools is unlikely to disappear as ransomware groups continue searching for ways to evade tracking and attribution.
Still, officials described the dismantling of First VPN as a significant symbolic and operational victory in the international fight against cybercrime.
This operation demonstrates that cybercriminal infrastructure is not beyond the reach of international law enforcement. The message is clear: services built to facilitate ransomware and online extortion will continue to be targeted globally.
