Authorities from seven countries have taken down 'First VPN', seizing 33 servers. The VPN was heavily promoted as a safe haven for ransomware operators, and its takedown led to the exposure of thousands of cybercriminals.
See also: SonicWall: The “incomplete patching” trap that leaves the door open to attacks
An alliance of European law enforcement authorities has succeeded in dismantling a massive virtual private network (VPN) that was allegedly acting as a digital shield for ransomware groups and cybercriminals. The joint operation, coordinated by Europol and Eurojust, targeted the criminal service known as 'First VPN'.
While everyday consumers use VPN services to protect their privacy on public Wi-Fi or to securely stream geo-blocked content, 'First VPN' was built specifically for the criminal underworld. The platform explicitly offered a "safe environment for carrying out illegal activities," according to Eurojust, assuring users that it kept no logs, avoided global jurisdiction, and would never cooperate with authorities.
That promise collapsed between May 19 and 20. In a coordinated attack codenamed “Operation Saffron,” police from seven countries seized 33 servers, shut down the platform’s main online domains (including 1vpns.com, 1vpns.net, 1vpns.org, and related onion sites), and conducted a home search and interrogation of a key suspect in Ukraine.
See also: Proton VPN's promises of post-quantum security
For everyday users, the removal of this malicious provider is a significant victory. Cybercriminals relied heavily on 'First VPN' to hide their true locations while carrying out ransomware attacks, stealing consumer data, and organizing large-scale fraud. Removing this layer of anonymity leaves these malicious users exposed, making the digital landscape significantly safer for the general public.
'First VPN' was heavily promoted on Russian-speaking cybercrime forums and had become a key tool for cybercriminals. It was so deeply embedded in the malware ecosystem that, according to Europol, the service has appeared in almost every major cybercrime investigation supported by Europol in recent years.
The operation to dismantle the network began to gain momentum in December 2021. By pooling resources through a Joint Investigation Team established by Eurojust in November 2023, and with the participation of organizations such as the Paris Public Prosecutor's Office, the Dutch National High-Tech Unit and the UK National Crime Agency, authorities managed to infiltrate the network before shutting it down.
See also: Cure53: Tor Project moves forward with mobile VPN launch
Eurojust played a crucial role in navigating the complex legal landscape, hosting 16 coordination meetings to prepare for the operation. This multinational infiltration allowed investigators to obtain the platform’s heavily guarded user database. As a result, users of the criminal service who thought they were browsing anonymously have now been immediately informed by police that their real identities have been compromised.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
