European Police Dismantle VPN Used in Ransomware Attacks

European law enforcement agencies have dismantled a virtual private network service called First VPN that was used to conceal ransomware attacks and other crimes. Europol announced the results of the operation yesterday. The agency said the service had been promoted on Russian-speaking cybercrime forums for years and offered anonymous payments along with infrastructure designed for criminal use.

The probe began in December 2021.

Investigators later gained access to the service, obtained its user database, and identified VPN connections used by individuals seeking to conceal their activities, according to Europol. Security vendor Bitdefender assisted law enforcement during the operation.

Europol stated that the gathered intelligence exposed thousands of users linked to the cybercrime ecosystem and generated leads connected to ransomware attacks, fraud schemes, and other offenses worldwide. A statement from the Dutch National Police Corps said police had access to the criminal traffic of the users of the service, who mistakenly believed themselves to be safe.

The First VPN website now displays a message stating that the domain was seized by a joint international law enforcement action. An Internet Archive capture of the former site shows it advertised the ability to conceal IP addresses, encrypt communications, and make a no-logs promise common among VPN providers.