Law enforcement shuts down VPN service used by two dozen ransomware gangs | TechCrunch

An international coalition of law enforcement agencies dismantled First VPN and arrested its administrator. The FBI reported that at least 25 ransomware gangs used the service to conceal malicious activity. First VPN supported criminal operations including internet scanning, botnet activity, distributed denial-of-service attacks, and scams. The service operated servers in 27 countries and provided features beyond anonymity, including anonymous payments and hidden infrastructure marketed to hackers. Europol stated the service appeared in nearly every major cybercrime investigation it supported in recent years. First VPN advertised on cybercrime forums and claimed it stored no logs linking users to activity. Investigators obtained the user database, identified VPN connections, and notified users that they had been identified.

"The FBI said in an alert that First VPN was so popular that "at least" 25 ransomware gangs used the service to hide their malicious activity. Cybercriminals also relied on the VPN to scan the internet, run botnets, launch distributed denial-of-service attacks, and for running scams. First VPN operated servers across 27 different countries, according to the bureau."

"Europol said in an announcement that, apart from offering anonymous connections, First VPN offered cybercriminals anonymous payments, hidden infrastructure, and other services specifically marketed for criminal hackers. "First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years," read the announcement."

""Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences." The service advertised on known cybercrime forums, including at least two Russian-speaking marketplaces, promising criminals protection against being identified."

""We are for anonymity. We do not store any logs that would allow us or third parties to link an IP address in a specific period of time with a user of our service," FirstVPN said in one post that TechCrunch has seen. "The only data we store is e-mail and username, but it is impossible to link a user's online activity with a specific user of our service." Europol, however, said that First VPN users were notified of the shutdown and "informed that they have been identified.""

Read at TechCrunch