Europol's Operation Saffron Dismantles First VPN Cybercrime Service
In a coordinated international law enforcement effort led by France and the Netherlands, Operation Saffron dismantled First VPN, a "bulletproof" VPN service used by at least 25 ransomware groups and linked to numerous cybercrimes. Authorities arrested the administrator in Ukraine, seized 33 servers across 27 countries, and identified 506 users. The service, promoted on Russian-language cybercrime forums since 2014, provided anonymity for ransomware, fraud, and data theft. Europol notified users that their identities are now known, generating leads for 21 ongoing global investigations.
Cross-source coverage
Wire timeline
Europol and Eurojust Shut Down VPN Service Built for Criminals
European authorities, led by Europol and Eurojust, conducted a continent-wide operation this week to dismantle 'First VPN,' a VPN service specifically marketed to cybercriminals. The service had been promoted for years on Russian-language underground forums as a trusted platform for malicious online activities. The takedown targets a key infrastructure element used by criminals to anonymize their activities and evade law enforcement.
TechSpotFirst VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups
Authorities in Europe and North America, led by France and the Netherlands, have dismantled First VPN Service, a criminal VPN used by at least 25 ransomware groups to obscure their origins. Codenamed Operation Saffron, the operation involved 18 countries and took place between May 19-20, 2024. Actions included interviewing the administrator in Ukraine, conducting a house search, taking down 33 servers, and seizing infrastructure. The service, active since 2014, offered anonymous payments and hidden infrastructure, promoted on Russian-speaking cybercrime forums. Europol notified users that their identities are now known. Bitdefender supported the investigation, sharing data on 506 users. The FBI identified 32 exit node servers in 27 countries, including three in the US. Subscription costs ranged from $2 for one day to $483 for a year, accepted via Bitcoin and other anonymous payment methods.
The Hacker NewsEuropol's Operation Saffron Shuts Down First VPN Service Linked to Ransomware Attacks
Europol's Operation Saffron, a coordinated international law enforcement effort involving 18 countries, has taken down First VPN, a 'bulletproof' VPN service allegedly used by cybercriminals for ransomware attacks and other illegal activities. Authorities seized 33 servers spread across 27 countries, identified 506 users, and traced the operation to a residence in Ukraine. The investigation, which began in 2021, was led by France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom. First VPN reportedly advertised itself on Russian-language cybercrime forums, promising anonymity and non-cooperation with judicial authorities. Europol stated the service appeared in nearly every cybercrime investigation it pursued. The service's regular and .onion domains now display a seizure banner.
Latest from Tom's HardwareEuropol's Operation Saffron Takes Down First VPN Service Over Ransomware Attacks
Europol's Operation Saffron, a coordinated international law enforcement effort involving 18 countries, has dismantled First VPN, a 'bulletproof' VPN service allegedly used extensively in ransomware attacks and other cybercrime. Authorities seized 33 servers across 27 countries, identified 506 users, and led investigators to a residence in Ukraine. The service, which advertised itself as not cooperating with judicial authorities and exclusively marketed on Russian-language cybercrime forums, was found to be linked to most Europol cybercrime investigations. The operation, which also seized First VPN's regular and .onion domains, was five years in the making, having started in 2021. Key participating countries included France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom.
Latest from Tom's HardwareEuropol's Operation Saffron Takes Down First VPN Service Over Ransomware Attacks
Europol's Operation Saffron, a coordinated international law enforcement effort involving 18 countries, has dismantled First VPN, a 'bulletproof' VPN service allegedly used by cybercriminals for ransomware attacks and other illegal activities. Authorities seized 33 servers spread across 27 countries, identified 506 users, and traced the operation to a residence in Ukraine. First VPN reportedly advertised itself on Russian-language cybercrime forums, promising anonymity and non-cooperation with judicial authorities. Europol stated the service appeared in nearly every cybercrime investigation it pursued. The investigation began in 2021 and involved key actors including France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom. Both the regular and .onion domains of First VPN were seized and now display a banner for the operation.
Latest from Tom's HardwareEuropol's Operation Saffron Takes Down First VPN Service Over Ransomware Attacks
Europol's Operation Saffron, a coordinated international law enforcement effort involving 18 countries, has dismantled First VPN, a 'bulletproof' VPN service allegedly used extensively in ransomware attacks and other cybercrime. Authorities seized 33 servers spread across 27 countries, identified 506 users, and traced the operation to a residence in Ukraine. The service, which advertised itself on Russian-language cybercrime forums as not cooperating with judicial authorities and being outside any jurisdiction, was linked to most Europol cybercrime investigations. The investigation began in 2021 and involved key actors including France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom. Both First VPN's regular and .onion domains were seized and now display a banner for the operation.
Latest from Tom's HardwareEuropean authorities take down prolific cybercrime VPN service
European law enforcement agencies, led by France and the Netherlands with support from Europol, Eurojust, and eight other countries, have dismantled First VPN, a virtual private network service widely used by cybercriminals. The alleged administrator was arrested in Ukraine, and authorities seized 33 servers and multiple domains, including 1vpns.com, 1vpns.net, and 1vpns.org. Europol stated that First VPN appeared in nearly every major recent cybercrime investigation, providing anonymity for ransomware attacks, fraud, and data theft. Investigators obtained the service's user database, identifying thousands of users linked to cybercrime and generating leads for 21 ongoing global inquiries. The operation began in November 2023, and users have been notified that their identities are now known to authorities.
CyberScoop