A VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offences has been dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust.

For years, the service, known as ‘First VPN’, was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement. It offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.

‘First VPN’ had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years. Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.

Authorities arrest administrator and dismantle infrastructure

The coordinated action took place between 19 and 20 May and targeted the infrastructure behind one of the most widely used VPN services in the cybercrime underground.

During the action days, authorities:

• interviewed the administrator and conducted a house search in Ukraine;
• dismantled 33 servers linked to the criminal service;
• disrupted infrastructure used to support cybercriminal activity worldwide.

The target domain names have been shut down thanks to the joint international law enforcement and judicial cooperation with the following domain names seized:

• 1vpns.com
• 1vpns.net
• 1vpns.org
• Associated onion domains

Users of the criminal service have been notified of the shutdown and informed that they have been identified. 

Investigators identified thousands of users linked to cybercrime activity

The takedown follows an investigation launched in December 2021.

Working with Europol’s European Cybercrime Centre, investigators gained access to the service, obtained its user database and identified VPN connections used by cybercriminals seeking to conceal their activities.

The operation also benefited from support provided by cybersecurity partner Bitdefender through Europol.

The gathered intelligence exposed thousands of users linked to the cybercrime ecosystem and generated operational leads connected to ransomware attacks, fraud schemes, and other serious offences worldwide.

Intelligence shared worldwide to support ongoing investigations

A joint investigation team was set up with Eurojust’s support in November 2023, enabling French and Dutch authorities to work closely together, exchange evidence and information, and decide on a prosecutorial strategy. Eurojust hosted 16 coordination meetings among the involved authorities to prepare for the joint action day taking place this week, underscoring the need for complex judicial cooperation.

This setup was mirrored by an Operational Taskforce (OTF) set up at Europol which brought together investigators from 16 countries to analyse the seized data and coordinate intelligence sharing with international partners.

The Joint Cybercrime Action Taskforce (J-CAT) hosted at Europol also supported coordination, liaison, and deconfliction efforts with national authorities.

The operation has already generated significant operational results at Europol’s level:

• 83 intelligence packages disseminated;
• information linked to 506 users shared internationally;
• 21 Europol-supported investigations advanced through the intelligence obtained.

With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide.

The action day was carried out by the following authorities:

• France: Paris Prosecution Office (J3) and investigative judge Paris; The Court of Paris Cybercrime Unit and the Préfecture de Police Cybercrime Unit (BL2C); Central Office Cybercrime Unit (OFAC);
• Netherlands: National Public Prosecutor's Office; Team High Tech Crime of the National Investigation Unit;
• Luxembourg: District Prosecution Office; Luxembourg Judicial Police;
• Romania: Directorate for Investigating Organised Crime and Terrorism; Directorate for Fighting Organised Crime, Romanian Police;
• Switzerland: Zurich Public Prosecutor's Office III;  Zurich Cantonal Police;
• Ukraine: Prosecutor General’s Office of Ukraine; Cyber Department of the Security Service of Ukraine (SBU); Main Investigation Department of the National Police of Ukraine; Division for Combating Cyber Security Crimes;
• United Kingdom: National Crime Agency – National Cyber-Crime Unit.

Countries participating in the action days

• Luxembourg, Switzerland, Romania, Ukraine, United Kingdom

Countries supporting the investigation

• Canada, Germany, Romania, United States of America