FBI Shuts Down First Ever Dedicated VPN Cybercrime Service

Post Views: 11

Law Enforcement Operation Disrupts Popular Ransomware Service

A coordinated effort by authorities in North America and Europe has resulted in the disruption of First VPN, a widely-used cybercrime service employed by numerous ransomware groups for network reconnaissance and intrusion purposes.

According to the Federal Bureau of Investigation (FBI), “The First VPN service’s IP addresses have been involved in various malicious activities, including scanning, botnet operations, denial-of-service attacks, and hacking.”

Background Information

First VPN was active since 2014 and had established 32 exit nodes across 27 countries prior to its disruption. It was promoted on Russian-language dark web forums and utilized by at least 25 ransomware groups.

Operation Details

The law enforcement agencies and their partners dismantled 33 servers related to First VPN and took down the infrastructure supporting the cybercrime service.
The operation targeted the domains 1vpns.com, 1vpns.net, 1vpns.org, and onion, effectively disrupting the service’s operations.
The alleged administrator of First VPN has been apprehended in Ukraine.

Aftermath

Following the disruption, users of the service were notified of the shutdown and informed that they had been identified. Europol stated that information regarding 506 users was shared among international law enforcement agencies.

Bitdefender noted that the 506 users represent a subset of First VPN’s customer base. Investigators will determine which of these individuals can be linked to criminal operations.

The company concluded that every actor evaluating the next anonymization service now knows the same risk exists.