Law enforcement shuts down VPN service used by two dozen ransomware gangs

A major international law enforcement operation has successfully dismantled a widely-used virtual private network (VPN) service that served as a haven for cybercriminals. Announced on Thursday, authorities revealed that First VPN was utilized by at least 25 ransomware gangs to obscure their illegal activities. The FBI highlighted that this VPN was not only a tool for hiding malicious behavior but was also employed for internet scanning, botnet management, and orchestrating distributed denial-of-service (DDoS) attacks. Operating across 27 countries, First VPN provided cybercriminals with features that ensured anonymity. Europol detailed how the service not only facilitated anonymous connections but also offered payment options and infrastructure tailored specifically for hackers. "First VPN had become a crucial element in the cybercrime landscape, appearing in nearly every significant cybercrime investigation supported by Europol in recent years," the agency stated. Criminals were drawn to First VPN for its promises of anonymity, boasting a strict policy of not retaining logs that could link users to their activities. In one of its promotional posts, First VPN claimed, "We are for anonymity. We do not store any logs that would allow us or third parties to link an IP address in a specific period of time with a user of our service." However, Europol revealed that users of First VPN were informed of the service’s shutdown and that their identities had been compromised. Authorities managed to access the user database and identify connections, revealing thousands of individuals involved in the cybercrime network. The operation led to the arrest of the VPN’s administrator and the dismantling of numerous servers, marking a significant victory in an investigation that began in December 2021.