Authorities in North America and Europe conducted a law enforcement operation to disrupt First VPN, a cybercrime service used for ransomware and other attacks. The FBI reported that First VPN operated since 2014 and provided 32 exit nodes across 27 countries. The service was advertised on Russian-language dark web forums and was used by at least 25 ransomware groups for network reconnaissance and intrusions. Europol reported that 33 servers linked to First VPN were dismantled and infrastructure supporting cybercriminal activity was disrupted, targeting 1vpns.com, 1vpns.net, 1vpns.org, and onion domains. The alleged administrator was arrested in Ukraine. Europol stated that 506 users were identified and notified internationally, and Bitdefender said investigators will determine which users connect to criminal operations.
"Authorities in North America and Europe have participated in a law enforcement operation to disrupt First VPN, a popular cybercrime service used for ransomware and other attacks. According to the FBI, First VPN has been active since 2014, providing 32 exit nodes across 27 countries at the time of its disruption. The service, advertised on Russian-language dark web cybercrime forums, has been used by at least 25 ransomware groups for network reconnaissance and intrusions."
"IP addresses associated with First VPN have been involved in scanning, botnets, DoS attacks, and hacking. The FBI has published an alert with technical details, IoCs, MITRE ATT&CK mappings, and recommendations. According to Europol, law enforcement and partners dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal activity."
"The takedown targeted the 1vpns.com, 1vpns.net, 1vpns.org, and onion domains. The alleged administrator of the cybercrime service has been arrested in Ukraine. "Users of the criminal service have been notified of the shutdown and informed that they have been identified," Europol said, noting that information on 506 users was shared internationally."
"Bitdefender, which was involved in the takedown, pointed out that the 506 users are a subset of First VPN's customer base, and investigators will determine which of them can be linked to criminal operations. "Some will be traced to known ransomware groups. Others will reveal fraud operations, data theft campaigns, or cybercrime-as-a-service infrastructure we didn't know existed," Bitdefender said. "New anonymization services will appear. The economic demand hasn't changed. But each takedown shortens the operational window of the next service and raises the barrier for actors who relied on turnkey solutions," the cybersecurity firm added."
Read at SecurityWeek
Unable to calculate read time
Collection
[
|
...
]