First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups

Authorities in Europe and North America dismantled a criminal VPN service used to obscure the origins of ransomware attacks, data theft, scanning, and denial-of-service activity. The operation targeting First VPN was led by France and the Netherlands, with support from many other countries. The service provided anonymous payments and hidden infrastructure that helped customers conceal identities while conducting ransomware attacks, large-scale fraud, and data theft. First VPN was promoted on Russian-speaking cybercrime forums as a tool to evade law enforcement. During actions carried out between May 19 and 20, investigators interviewed an administrator, searched a residence in Ukraine, took down 33 servers, and seized infrastructure used globally. Confiscated domains and Tor onion domains were listed.

"Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service used by criminal actors to obscure the origins of ransomware attacks, data theft, scanning, and denial-of-service attacks."

"First VPN, per Europol, offered services designed specifically for criminal use, allowing anonymous payments and a hidden infrastructure that enabled paying customers to hide their identities when carrying out ransomware attacks, large-scale fraud, and data theft. It was promoted on Russian-speaking cybercrime forums such as Exploit[.]in and XSS[.]is as a tool to evade law enforcement."

"The international operation took place between May 19 and 20, during which authorities took a series of concurrent actions that involved interviewing the service's administrator, conducting a house search in Ukraine, taking down 33 servers, and seizing infrastructure used to support cybercriminal activity globally."

""First VPN's website promoted itself by emphasizing anonymity, promising its users that it would not cooperate with any judicial authority, that it would not store data, and that the service would not be subject to any jurisdiction," Eurojust said."

Read at The Hacker News