Police boast of hacking VPN where criminals “believed themselves to be safe”

Law enforcement agencies from multiple countries have dismantled the First VPN infrastructure, arresting its administrator and seizing servers, after a years-long investigation into its use by cybercriminals who believed themselves to be protected from detection.

The operation involved authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the UK, supported by agencies from Canada, Germany, the US, and other nations. On May 19 and 20, they carried out coordinated actions that included interviewing the VPN’s administrator in Ukraine, dismantling 33 servers linked to the service, and seizing domain names including 1vpns.com, 1vpns.net, and 1vpns.org, along with associated onion domains.

The FBI described the activity as consistent with adversary efforts to identify open ports, services, and network configurations, with VPN infrastructure being used to enumerate systems within target networks and facilitate password spraying or brute-force attacks against exposed services such as SSH, RDP, or web applications. Europol reported that the operation produced 83 intelligence packages, shared information on 506 users internationally, and supported 21 ongoing investigations.

Why It Matters

This development is significant because it exposes a major cybercriminal infrastructure that operated under the false belief of safety among its users. The takedown not only disrupts ongoing criminal activities but also provides law enforcement with valuable intelligence to pursue further investigations globally. It underscores the importance of international cooperation in combating cybercrime and highlights the ongoing efforts to dismantle hidden networks used for illegal purposes.

Background

The investigation into the First VPN service began in December 2021, with a significant escalation in November 2023, supported by Eurojust’s coordination efforts. The operation reflects a broader trend of authorities targeting VPN services used by cybercriminals, who often rely on such tools to hide their activities. The recent takedown is part of a series of efforts aimed at disrupting cybercrime infrastructure and increasing accountability among cybercriminal groups.

“With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide.”

— Europol

“VPN infrastructure may be used to enumerate systems within a target network following initial access, facilitating password spraying or brute-force attacks against exposed services.”

— FBI

What Remains Unclear

It is not yet clear how many users of the VPN service have been identified or prosecuted, and whether additional infrastructure linked to the service remains active or will be targeted in future operations. The full extent of the criminal activities conducted via this VPN is still being analyzed.

What’s Next

Law enforcement agencies will continue analyzing seized data, sharing intelligence with international partners, and pursuing investigations into individual users and related networks. Future operations may target other similar VPN services used for cybercrime.

Key Questions

What is the First VPN service?

First VPN was a virtual private network service that was reportedly used by cybercriminals to hide their activities and conduct illegal operations online.

How did authorities manage to dismantle the VPN infrastructure?

Authorities coordinated actions across multiple countries, seized servers, arrested the administrator, and took control of key domain names and onion sites, supported by judicial orders and international cooperation.

Will users of the VPN be prosecuted?

It is still unclear how many users have been identified or prosecuted. Authorities are analyzing seized data to determine the scope of individual involvement.

What does this mean for cybercriminals using VPNs?

This operation demonstrates that law enforcement is increasingly capable of penetrating VPN services used by criminals, which may deter some illegal activities or lead to further takedowns.

Source: Ars Technica