Police op targets VPN service favoured by ransomware gangs | Computer Weekly

A VPN favored by cyber criminals to mask data exfiltration, fraud, ransomware attacks, and other criminal activity was dismantled in Operation Saffron. The Franco-Dutch led action received support from Europol and other agencies, including the UK’s National Crime Agency, and private sector partner Bitdefender. The First VPN service was heavily used by Russian-speaking threat actors and was reportedly present in almost every major cyber investigation conducted in recent years. The service obscured malicious traffic from law enforcement surveillance and also provided anonymised payments and hidden infrastructure. Taking it offline removed a critical layer of protection criminals relied on to operate, communicate, and evade law enforcement. The operation demonstrated public-private collaboration and sent a message that criminals cannot rely on the dark web for guaranteed anonymity.

"A virtual private network (VPN) favoured by cyber criminals to mask data exfiltration, fraud ransomware attacks and other criminality has been dismantled in Operation Saffron, a Franco-Dutch led action supported by Europol and other agencies, including the UK's National Crime Agency (NCA), and private sector partner Bitdefender."

"The First VPN service was heavily used among Russian-speaking threat actors, and according to Europol, was used in "almost every" major cyber investigation it has undertaken in the past few years. Besides obscuring malicious traffic from law enforcement surveillance, First VPN's operators are also known to have offered services such as anonymised payments and hidden infrastructure."

""For years, cyber criminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement. This operation proves them wrong. Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate and evade law enforcement," said Edvardas Šileris, head of the European Cybercrime Centre at Europol."

"Operation Saffron exemplifies the power of collaboration between the public and private security sector in dismantling illegal online activities, in this case, a VPN service designed to conceal attacks. It also serves a message to criminals who believe the dark web covers their actions and guarantees their anonymity. If they become the target of an international effort, they can't hide."

Read at ComputerWeekly.com