TL;DR
Law enforcement agencies across multiple countries have taken down the First VPN service, which was used by cybercriminals under the false assumption of safety. The operation resulted in arrests, server dismantling, and international intelligence sharing. The investigation began in 2021 and culminated in May 2026.
Law enforcement agencies from multiple countries have dismantled the First VPN infrastructure, arresting its administrator and seizing servers, after a years-long investigation into its use by cybercriminals who believed themselves to be protected from detection.
The operation involved authorities from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the UK, supported by agencies from Canada, Germany, the US, and other nations. On May 19 and 20, they carried out coordinated actions that included interviewing the VPN’s administrator in Ukraine, dismantling 33 servers linked to the service, and seizing domain names including 1vpns.com, 1vpns.net, and 1vpns.org, along with associated onion domains.
The FBI described the activity as consistent with adversary efforts to identify open ports, services, and network configurations, with VPN infrastructure being used to enumerate systems within target networks and facilitate password spraying or brute-force attacks against exposed services such as SSH, RDP, or web applications. Europol reported that the operation produced 83 intelligence packages, shared information on 506 users internationally, and supported 21 ongoing investigations.
Why It Matters
This development is significant because it exposes a major cybercriminal infrastructure that operated under the false belief of safety among its users. The takedown not only disrupts ongoing criminal activities but also provides law enforcement with valuable intelligence to pursue further investigations globally. It underscores the importance of international cooperation in combating cybercrime and highlights the ongoing efforts to dismantle hidden networks used for illegal purposes.
IPVanish: Fast & Secure VPN
High-speed access to over 3,200 VPN servers in 150+ locations
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Background
The investigation into the First VPN service began in December 2021, with a significant escalation in November 2023, supported by Eurojust’s coordination efforts. The operation reflects a broader trend of authorities targeting VPN services used by cybercriminals, who often rely on such tools to hide their activities. The recent takedown is part of a series of efforts aimed at disrupting cybercrime infrastructure and increasing accountability among cybercriminal groups.
“With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide.”
— Europol
“VPN infrastructure may be used to enumerate systems within a target network following initial access, facilitating password spraying or brute-force attacks against exposed services.”
— FBI
Deeper Connect Mini(2026 Version) Decentralized VPN Router Lifetime Free for Travel Home Enterprise-Level Cybersecurity Wi-Fi Router with Dual Antennas Wi-Fi Adapter
1. True VPN Router – Network Protection for Every Device: This VPN router secures your entire homenetwork at…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Remains Unclear
It is not yet clear how many users of the VPN service have been identified or prosecuted, and whether additional infrastructure linked to the service remains active or will be targeted in future operations. The full extent of the criminal activities conducted via this VPN is still being analyzed.
GL.iNet MT2500A(Brume 2) Professional Mini VPN Security Gateway, Home Office Remote Work Site-to-Site, WireGuard OpenVPN Server Client 24/7 Connection, 2.5G WAN USB3.0 OpenWrt NO Wi-Fi Ethernet Only
【Compatible with 30+ VPN service providers】Pre-installed with OpenVPN and WireGuard. OpenVPN speeds up to 150 Mbps; WireGuard speeds…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What’s Next
Law enforcement agencies will continue analyzing seized data, sharing intelligence with international partners, and pursuing investigations into individual users and related networks. Future operations may target other similar VPN services used for cybercrime.
Global Lifetime Free Rapid Walkie Talkies Unlimited Range 4G LTE PoC(Push-to-Talk Over Cellular) Radios Nationwide PTT Two Way Radios Long Distance for Family, Logistics, Company 2pcs with sim Card
[Unlimited Range Walkie talkies Adopts Noise Filtering]:This two-way radio is equipped with a highly sensitive microphone, which can…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is the First VPN service?
First VPN was a virtual private network service that was reportedly used by cybercriminals to hide their activities and conduct illegal operations online.
Authorities coordinated actions across multiple countries, seized servers, arrested the administrator, and took control of key domain names and onion sites, supported by judicial orders and international cooperation.
Will users of the VPN be prosecuted?
It is still unclear how many users have been identified or prosecuted. Authorities are analyzing seized data to determine the scope of individual involvement.
What does this mean for cybercriminals using VPNs?
This operation demonstrates that law enforcement is increasingly capable of penetrating VPN services used by criminals, which may deter some illegal activities or lead to further takedowns.
Source: Ars Technica
