Cybercriminal VPN Used by Ransomware Actors Dismantled in Global Crackdown

A VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offences has been dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust.

For years, the service, known as ‘First VPN’, was on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.

‘First VPN’ had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years. Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.

Authorities arrest administrator and dismantle infrastructure

The coordinated action took place between 19 and 20 May and targeted the infrastructure behind one of the most widely used VPN services in the cybercrime underground.

During the action days, authorities:

The target domain names have been shut down thanks to the joint international law enforcement and judicial cooperation with the following domain names seized:

Users of the criminal service have been notified of the shutdown and informed that they have been identified.

Investigators identified thousands of users linked to cybercrime activity

The takedown follows an investigation launched in December 2021.

Working with Europol’s European Cybercrime Centre , investigators gained access to the service, obtained its user database and identified VPN connections used by cybercriminals seeking to conceal their activities.

The operation also benefited from support provided by cybersecurity partner Bitdefender through Europol.

The gathered intelligence exposed thousands of users linked to the cybercrime ecosystem and generated operational leads connected to ransomware attacks, fraud schemes, and other serious offences worldwide.

Intelligence shared worldwide to support ongoing investigations

A joint investigation team was set up with Eurojust’s support in November 2023, enabling French and Dutch authorities to work closely together, exchange evidence and information, and decide on a prosecutorial strategy. Eurojust hosted 16 coordination meetings among the involved authorities to prepare for the joint action day taking place this week, underscoring the need for complex judicial cooperation.

This setup was mirrored by an Operational Taskforce (OTF) set up at Europol which brought together investigators from 16 countries to analyse the seized data and coordinate intelligence sharing with international partners.

The Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol also supported coordination, liaison, and deconfliction efforts with national authorities.

The operation has already generated significant operational results at Europol’s level:

With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide.

The action day was carried out by the following authorities:

Countries participating in the action days

Countries supporting the investigation