TL;DR
Law enforcement agencies across multiple countries have taken down the First VPN service, which was used by cybercriminals under the false assumption of safety. The operation resulted in arrests, server dismantling, and international intelligence sharing. The investigation began in 2021 and culminated in May 2026.
Law enforcement agencies from multiple countries have dismantled the First VPN infrastructure, arresting its administrator and seizing servers, after a years-long investigation into its use by cybercriminals who believed themselves to be protected from detection.
The operation involved authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the UK, supported by agencies from Canada, Germany, the US, and other nations. On May 19 and 20, they carried out coordinated actions that included interviewing the VPN’s administrator in Ukraine, dismantling 33 servers linked to the service, and seizing domain names including 1vpns.com, 1vpns.net, and 1vpns.org, along with associated onion domains.
The FBI described the activity as consistent with adversary efforts to identify open ports, services, and network configurations, with VPN infrastructure being used to enumerate systems within target networks and facilitate password spraying or brute-force attacks against exposed services such as SSH, RDP, or web applications. Europol reported that the operation produced 83 intelligence packages, shared information on 506 users internationally, and supported 21 ongoing investigations.
Why It Matters
This development is significant because it exposes a major cybercriminal infrastructure that operated under the false belief of safety among its users. The takedown not only disrupts ongoing criminal activities but also provides law enforcement with valuable intelligence to pursue further investigations globally. It underscores the importance of international cooperation in combating cybercrime and highlights the ongoing efforts to dismantle hidden networks used for illegal purposes.
Privacy Tools in the Age of AI: Practical Strategies with VPNs, Secure DNS, Private Relay and Intelligent Defenses (Build Your Own VPN)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background
The investigation into the First VPN service began in December 2021, with a significant escalation in November 2023, supported by Eurojust’s coordination efforts. The operation reflects a broader trend of authorities targeting VPN services used by cybercriminals, who often rely on such tools to hide their activities. The recent takedown is part of a series of efforts aimed at disrupting cybercrime infrastructure and increasing accountability among cybercriminal groups.
“With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide.”
— Europol
“VPN infrastructure may be used to enumerate systems within a target network following initial access, facilitating password spraying or brute-force attacks against exposed services.”
— FBI
Vertiv Liebert IntelliSlot RDU120 – Network Card, Remote Monitoring Adapter, RS-485, USB Port, UL2900-1 Cybersecurity Certified, 1Gb Ethernet, Web Access, Data via SNMP, Modbus, BACNet (RDU120)
- Cybersecurity Certified: UL2900-1 certified for secure communication
- Secure Boot: Hardware trust anchor prevents tampering
- Flexible Protocols: Supports SNMP, Modbus, BACnet
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Remains Unclear
It is not yet clear how many users of the VPN service have been identified or prosecuted, and whether additional infrastructure linked to the service remains active or will be targeted in future operations. The full extent of the criminal activities conducted via this VPN is still being analyzed.
GL.iNet GL-MT5000 Brume 3 Wired VPN Security Gateway NO Wi-Fi
- High-Speed VPN: Up to 1100 Mbps VPN throughput
- Multi-Gigabit Ports: Three 2.5G Ethernet ports
- Multi-WAN Support: Dual-ISP and failover capabilities
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What’s Next
Law enforcement agencies will continue analyzing seized data, sharing intelligence with international partners, and pursuing investigations into individual users and related networks. Future operations may target other similar VPN services used for cybercrime.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the First VPN service?
First VPN was a virtual private network service that was reportedly used by cybercriminals to hide their activities and conduct illegal operations online.
Authorities coordinated actions across multiple countries, seized servers, arrested the administrator, and took control of key domain names and onion sites, supported by judicial orders and international cooperation.
Will users of the VPN be prosecuted?
It is still unclear how many users have been identified or prosecuted. Authorities are analyzing seized data to determine the scope of individual involvement.
What does this mean for cybercriminals using VPNs?
This operation demonstrates that law enforcement is increasingly capable of penetrating VPN services used by criminals, which may deter some illegal activities or lead to further takedowns.
Source: Ars Technica
