An international law enforcement coalition dismantled the notorious First VPN service on Thursday, arresting its administrator and exposing thousands of cybercriminals who used the network to mask global ransomware attacks.
A Safe Haven for Global Cybercrime
The FBI revealed in an alert that First VPN was so popular within the cyber underworld that “at least” 25 ransomware syndicates relied on the platform to conceal their malicious activities. According to the bureau, the service operated servers across 27 different countries, enabling threat actors to scan the internet, manage botnets, launch distributed denial-of-service (DDoS) attacks, and execute financial scams.
Deeply Embedded in the Cyber Underworld
Europol confirmed in an official announcement that, far from offering standard privacy, First VPN actively catered to the criminal market. The service provided hackers with anonymous payment methods, hidden infrastructure, and specialised hosting solutions designed specifically to evade law enforcement.
“First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years,” the agency stated. Officials noted that criminals routinely utilised the platform to hide their identities and infrastructure whilst executing ransomware campaigns, large-scale fraud, and massive data theft.
The False Promise of Total Anonymity
The operators of First VPN actively marketed their services on notorious cybercrime forums, including at least two Russian-language marketplaces, promising absolute protection from tracking.
“We are for anonymity. We do not store any logs that would allow us or third parties to link an IP address in a specific period of time with a user of our service,” the service claimed in a promotional post seen by TechCrunch. The operators insisted that they only stored usernames and email addresses, making it “impossible” to trace online activity back to individual users.
Thousands of Users Exposed
However, that promise of privacy was shattered during the operation. Europol revealed that investigators successfully seized First VPN’s user database and mapped active connections. This breakthrough allowed authorities to identify and notify thousands of users linked to the cybercrime ecosystem that their identities are no longer secret.
var playerInstance_jwplayer_6a7a0dbe77fc8 = jwplayer( “jwplayer_6a7a0dbe77fc8” );
playerInstance_jwplayer_6a7a0dbe77fc8.setup({
playlist: “https://cdn.jwplayer.com/v2/media/lv0GaEwB”,
});
A Multi-Year Investigation Culminates
The successful disruption is the result of a complex international investigation launched in December 2021. Alongside the arrest of the service’s administrator, law enforcement agencies dismantled dozens of servers and permanently disrupted the platform’s core infrastructure, marking a significant blow to global cybercrime operations.