An international law enforcement operation led by France and the Netherlands has dismantled a VPN platform widely used by cybercriminals to hide ransomware attacks, data theft and online fraud activities.
The service, known as ‘First VPN’, was promoted for years on Russian-speaking cybercrime forums as a secure tool designed to help criminals avoid detection. The platform offered anonymous payments, hidden infrastructure and services specifically tailored for illegal cyber operations.
According to Europol, the VPN service had appeared in several major cybercrime investigations in recent years. Criminals allegedly used it to conceal identities and infrastructure while carrying out ransomware campaigns, fraud schemes and data theft operations globally.
Edvardas Šileris said, “For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement. This operation proves them wrong. Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate and evade law enforcement.”
The coordinated crackdown took place between May 19 and May 20. Authorities interviewed the administrator in Ukraine, conducted house searches and dismantled 33 servers linked to the criminal network. Investigators also shut down several associated domain names and onion domains connected to the service.
Officials said users of the platform were informed that the service had been seized and that they had been identified during the investigation.
The investigation began in December 2021, with authorities gaining access to the service and obtaining its user database. Investigators identified thousands of users connected to cybercrime activities, including ransomware attacks and fraud operations.
The operation generated major intelligence results, including 83 intelligence packages, information linked to 506 users shared internationally and support for 21 ongoing investigations.
The international operation involved law enforcement and judicial authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine and the United Kingdom, with support from several other countries and cybersecurity partners.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.