An international law enforcement operation led by France and the Netherlands dismantled the criminal virtual private network service known as First VPN on May 19 and May 20, seizing its domains, hacking into its infrastructure to identify thousands of users, and arresting its administrator. Europol announced the results of the operation, which was supported by Eurojust and the security vendor Bitdefender.

"A VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offenses has been dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust." Europol said. The First VPN website now displays a message stating that the domain was seized by a joint international law enforcement action.

The investigation began in December 2021. Investigators gained access to the service, obtained its user database, and identified VPN connections used by cybercriminals seeking to conceal their activities. "Police had access to the criminal traffic of the users of the service, who mistakenly believed themselves to be safe." the Dutch National Police Corps said.

The investigation moved into a new phase in November 2023 with support from Eurojust, which hosted 16 coordination meetings among involved authorities to prepare for the joint action. Europol set up a task force bringing together investigators from different countries to analyze seized data and coordinate intelligence sharing. The operation produced 83 intelligence packages, information on 506 users was shared internationally, and it helped advance 21 Europol-supported investigations.

The direct actions on May 19 and May 20 were carried out by authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom, with varying levels of support from Canada, Germany, the U.S., Spain, Sweden, Denmark, Estonia, Latvia, Lithuania, Poland, and Portugal. Authorities interviewed the First VPN administrator, conducted a house search in Ukraine, and dismantled 33 servers linked to the service. Judicial orders authorized the seizure of the domains 1vpns.com, 1vpns.net, 1vpns.org, and associated onion domains. Users of the service were notified of the shutdown and informed that they had been identified.

"For years, the service, known as 'First VPN,' was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use." Europol said. First VPN had been active since 2014 and provided 32 exit node servers in 27 countries.

"At least 25 ransomware groups, such as Avaddon Ransomware, have used First VPN Service infrastructure to perform network reconnaissance and intrusions." the FBI said. The agency also said that First VPN IP addresses had been used for scanning activity, botnets, denial of service attacks, scams, and hacking, and that the scanning was consistent with adversary efforts to identify open ports, services, and network configurations.