Law enforcement shuts down VPN service used by ransomware gangs

An international coalition of law enforcement agencies, including the FBI (the US law enforcement agency) and Europol (the EU law enforcement agency), has shut down the virtual private network service First VPN and arrested its administrator. The shutdown, which was announced on Thursday, represents the outcome of a multi-year investigation that was originally launched in December 2021. According to an alert issued by the FBI, the service was used by two dozen ransomware gangs, with at least 25 ransomware groups relying on First VPN to conceal their malicious activities.

The law enforcement operation successfully dismantled the service’s infrastructure, which previously operated servers across 27 different countries. Europol characterized the platform as deeply embedded in the cybercrime ecosystem, stating that “First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years.” According to Europol’s announcement, First VPN offered cybercriminals anonymous payments, hidden infrastructure, and other services specifically marketed for criminal hackers. To build its user base, the service advertised on known cybercrime forums, including at least two Russian-speaking marketplaces, promising criminals protection against being identified by law enforcement.

These marketing promises of anonymity stood in direct contrast to the service’s actual security and data practices. In one post, First VPN claimed that it stood for anonymity and did not store any logs that would allow the service or third parties to link an IP address in a specific period of time with a user of the service. Despite these claims, investigators successfully obtained the service’s user database and identified specific VPN connections, exposing thousands of users linked to the cybercrime ecosystem. Following the infrastructure seizure, Europol announced that First VPN users were notified of the shutdown and informed that they have been identified.

Why it matters

The takedown of First VPN marks a significant disruption in the cybercrime ecosystem, demonstrating the efficacy of long-term international investigations in dismantling infrastructure that facilitates ransomware and large-scale fraud.