- A criminal VPN service used by at least 25 ransomware groups was dismantled in a May 2026 global operation.
- The service, First VPN, advertised anonymity and promised it would not cooperate with judicial authorities.
- Subscriptions cost between $2 for a single day and $483 for a whole year and were paid via cryptocurrencies.
- The infrastructure included 33 servers across 27 countries, with three exit nodes located in the United States.
An international law enforcement operation between May 19 and 20, 2026, led by France and the Netherlands, dismantled a criminal virtual private network service used globally to obscure ransomware attacks and data theft. The service, known as First VPN, had been active since approximately 2014 and was promoted on Russian-speaking cybercrime forums.
According to Europol, it offered services specifically designed for criminal use, allowing anonymous payments and hidden infrastructure. Authorities interviewed the service’s administrator, conducted a house search in Ukraine, and took down 33 servers during the coordinated action.
Consequently, the domains 1vpns[.]com, 1vpns[.]net, 1vpns[.]org, and related Tor onion domains were seized. Eurojust noted in a statement that the service promoted itself by emphasizing anonymity and promising it would not cooperate with any judicial authority. Its website claimed, “We do not store any logs that would allow us or third parties to associate an IP address in a specific period of time with the user of our service.”
Meanwhile, a flash alert from the U.S. Federal Bureau of Investigation (FBI) detailed that the infrastructure provided 32 exit node servers in 27 countries, including the U.S., Australia, and Germany. No less than 25 ransomware groups, such as Avaddon Ransomware, used this infrastructure for network reconnaissance and intrusions. Subscription plans ranged from one day to one year and accepted payments through Bitcoin, Perfect Money, and other methods.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
