Europol: Cybercriminal VPN used by ransomware actors dismantled in global crackdown

Ukraine took part in an international operation led by France and the Netherlands, with support from Europol and Eurojust, aimed at dismantling a VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offences.

For years, the service, known as ‘First VPN’, was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.

‘First VPN’ has become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years. Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.

The coordinated action took place between 19 and 20 May and targeted the infrastructure behind one of the most widely used VPN services in the cybercrime underground.

During the action days, authorities interviewed the administrator and conducted a house search in Ukraine, dismantled 33 servers linked to the criminal service, and disrupted infrastructure used to support cybercriminal activity worldwide. 

The following target domain names have been shut down: 1vpns.com, 1vpns.net, 1vpns.org, and associated onion domains. 

Thanks to the operation, 21 Europol-supported investigations advanced through the intelligence obtained.

In this operation, Ukraine was represented by the Prosecutor General’s Office of Ukraine, Cyber Department of the Security Service of Ukraine (SBU), Main Investigation Department of the National Police of Ukraine, and Division for Combating Cyber Security Crimes.

The operation was conducted as part of the European Multidisciplinary Platform Against Criminal Threats (EMPACT), which tackles the most important threats posed by organised and serious international crime affecting the EU.

Find out more

Press release