First VPN Cybercrime Service Disrupted, Alleged Administrator Arrested
Summary
Authorities dismantled 33 servers linked to First VPN and arrested its alleged administrator in Ukraine. Europol said information on 506 users was shared internationally; investigators will determine which users are linked to criminal activity.
Key points
- Authorities in North America and Europe disrupted First VPN, a service reportedly used by at least 25 ransomware groups for reconnaissance and intrusions.
- Europol said 33 servers linked to the service were dismantled, disrupting infrastructure supporting cybercrime.
- The operation targeted the service’s 1vpns[.]com, 1vpns[.]net, 1vpns[.]org and onion domains.
- The service’s alleged administrator was arrested in Ukraine.
- Europol said information on 506 users was shared internationally; Bitdefender said investigators must determine which users can be linked to criminal operations.
- The FBI published an alert with technical details, indicators of compromise, MITRE ATT&CK mappings and recommendations.
Article Details
- Event Type
- International law enforcement disruption of First VPN, a cybercrime VPN service, and arrest of its alleged administrator.
- Impact
- Authorities dismantled 33 servers linked to First VPN and disrupted infrastructure used for criminal activity. The FBI said the service had been active since 2014, with 32 exit nodes across 27 countries, and had been used by at least 25 ransomware groups for reconnaissance and intrusions. Europol said information on 506 users was shared internationally; Bitdefender noted that investigators still need to determine which users were linked to criminal operations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1vpns[.]com | First VPN domain targeted in the takedown of the cybercrime service’s supporting infrastructure. |
| DOMAIN | 1vpns[.]net | First VPN domain targeted in the takedown of the cybercrime service’s supporting infrastructure. |
| DOMAIN | 1vpns[.]org | First VPN domain targeted in the takedown of the cybercrime service’s supporting infrastructure. |