An international alliance of law enforcement agencies has successfully dismantled a widely used virtual private network (VPN) service that facilitated cybercriminal activities. The operation, announced on Thursday, resulted in the arrest of the VPN's administrator and the shutdown of its infrastructure.
The FBI highlighted that the VPN, known as First VPN, was utilized by at least 25 ransomware gangs to obscure their illicit operations. This service was integral for cybercriminals to conduct various activities, including internet scanning, launching distributed denial-of-service attacks, and executing scams. According to the FBI, First VPN maintained servers in 27 countries.
Europol elaborated on the VPN's capabilities, noting that it offered not only anonymous connections but also services tailored for cybercriminals, such as anonymous payment options and concealed infrastructure. In their announcement, Europol stated, "First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years." This service allowed criminals to mask their identities while engaging in serious offenses like ransomware attacks and data theft.
First VPN was actively promoted on well-known cybercrime forums, including several Russian-speaking marketplaces, which advertised its ability to protect users from detection. In a promotional message, the service claimed, "We are for anonymity. We do not store any logs that would allow us or third parties to link an IP address in a specific period of time with a user of our service." While they maintained minimal data storage, Europol indicated that the user database was accessed during the investigation, leading to the identification of numerous users involved in cybercrime.
Following the shutdown, Europol informed First VPN users that they had been identified, marking a significant step in the global crackdown on cybercrime. The initiative also led to the arrest of the VPN's administrator and the dismantling of dozens of servers, stemming from an investigation that began in December 2021.
This operation illustrates the ongoing commitment of international law enforcement to combat cybercrime and enhance digital security. As technology continues to evolve, such proactive measures may significantly reduce the operational capabilities of cybercriminals, paving the way for a safer online environment.
