Authorities Dismantle First VPN Service Used by at Least 25 Ransomware Groups

May 23, 2026 · Original article ↗

Summary

Authorities in Europe and North America dismantled First VPN Service, seizing infrastructure and taking down 33 servers. Europol and the FBI say at least 25 ransomware groups used the service to hide their activity.

Key points

The operation, led by France and the Netherlands with international support, took place between May 19 and 20.
Authorities took down 33 servers, seized related infrastructure, interviewed the service administrator, and searched a residence in Ukraine.
The FBI said the service had operated since about 2014, with 32 exit nodes in 27 countries.
Authorities say at least 25 ransomware groups, including Avaddon, used the service for reconnaissance and intrusions; this is attributed reporting, not independent confirmation of specific incidents.
First VPN offered anonymous payments and protocols including OpenConnect, WireGuard, Outline, and VLESS TCP Reality.

Article Details

Event Type: Multinational law enforcement takedown of First VPN Service, a criminal VPN platform.
Impact: Authorities dismantled the service, took down 33 servers, and seized related infrastructure. The service had been active since about 2014 and was reportedly used by at least 25 ransomware groups to conceal their origins during reconnaissance and intrusions.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`1vpns[.]com`	Confiscated domain associated with the dismantled First VPN criminal service.
DOMAIN	`1vpns[.]net`	Confiscated domain associated with the dismantled First VPN criminal service.
DOMAIN	`1vpns[.]org`	Confiscated domain associated with the dismantled First VPN criminal service.
IPV4	`2[.]223[.]66[.]103`	Listed by the FBI as a First VPN exit node used to obscure customers’ origins.
IPV4	`5[.]181[.]234[.]59`	Listed by the FBI as a First VPN exit node used to obscure customers’ origins.
IPV4	`92[.]38[.]148[.]58`	Listed by the FBI as a First VPN exit node used to obscure customers’ origins.

Threat Actors

Avaddon RansomwareIdentified as one of the ransomware groups said to have used First VPN infrastructure; the article does not independently confirm its use.

Products

First VPN ServiceAuthorities in Europe and North America have dismantled First VPN Service, a criminal VPN platform used to hide the origins of ransomware attacks, data theft, scanning, and denial-of-service activity.

Countries

FranceThe disruption of First VPN Service was led by France and the Netherlands, with several other nations supporting the investigation since December 2021, including Luxembourg, Romania, Switzerland, Ukraine, the U.K.,NetherlandsThe disruption of First VPN Service was led by France and the Netherlands, with several other nations supporting the investigation since December 2021, including Luxembourg, Romania, Switzerland, Ukraine, the U.K.,Ukrainenations supporting the investigation since December 2021, including Luxembourg, Romania, Switzerland, Ukraine, the U.K., Canada, Germany, the U.S., Spain, Sweden, Denmark, Estonia, Latvia, Lithuania, Poland, and United Statessince December 2021, including Luxembourg, Romania, Switzerland, Ukraine, the U.K., Canada, Germany, the U.S., Spain, Sweden, Denmark, Estonia, Latvia, Lithuania, Poland, and Portugal.