Law enforcement agencies from multiple countries have successfully dismantled a major VPN service that ransomware groups and other cybercriminals used to hide their attacks. The operation, led by France and the Netherlands with Ukrainian participation, targeted ‘First VPN’ – a service that had become a cornerstone of the international cybercrime ecosystem.
The coordinated crackdown represents a significant blow to cybercriminal operations worldwide. For years, First VPN was heavily promoted on Russian-speaking cybercrime forums as a reliable way for criminals to stay anonymous while conducting illegal activities online.
Ukraine played a key role in the May 19-20 operation, as reported by EU Neighbours East. Ukrainian authorities conducted house searches, interviewed the service’s administrator, and helped dismantle 33 servers that supported the criminal infrastructure. The country’s Prosecutor General’s Office, Security Service (SBU), National Police, and cybercrime units all participated in the operation.
First VPN had become deeply embedded in cybercriminal operations, appearing in almost every major cybercrime investigation that Europol has supported in recent years. The service offered features specifically designed for illegal use, including anonymous payment methods and hidden server infrastructure that helped criminals avoid detection.
The operation shut down multiple domain names associated with the service:
- 1vpns.com
- 1vpns.net
- 1vpns.org
- Associated onion domains on the dark web
The takedown has already produced concrete results for ongoing investigations. Europol confirmed that 21 of its supported cybercrime investigations advanced thanks to intelligence gathered during the operation. This demonstrates how criminal VPN services create bottlenecks that, when disrupted, can impact multiple criminal enterprises simultaneously.
This operation highlights the growing international cooperation needed to combat modern cybercrime. Ransomware attacks have become increasingly sophisticated and damaging, with criminal groups using services like First VPN to operate across borders while staying hidden from law enforcement. The service’s popularity on Russian-speaking forums also underscores how certain regions have become hubs for cybercriminal activity.
The takedown was conducted under the European Multidisciplinary Platform Against Criminal Threats (EMPACT), which focuses on the most serious international crime threats facing the EU. As cybercriminals continue to professionalize their operations, law enforcement agencies are responding with increasingly coordinated international efforts to disrupt the infrastructure that makes these crimes possible.