Police seize First VPN service used in ransomware and data-theft operations
Summary
Authorities seized 33 First VPN servers across 27 countries and arrested its administrator. Europol says analysis of collected user data exposed links to thousands of users in the cybercrime ecosystem.
Key points
- An international law-enforcement operation seized 33 servers linked to First VPN and disrupted infrastructure supporting the service.
- Authorities arrested the administrator and searched a location in Ukraine; a Dutch police release said the service’s users were identified and notified.
- Investigators infiltrated the VPN infrastructure and collected its user database and information about connections used by cybercriminals.
- Europol said information about 506 users was shared internationally and 83 intelligence packages were prepared to support investigations.
- Europol said the gathered intelligence exposed links to thousands of users and generated leads connected to ransomware, fraud and other serious offenses.
Article Details
- Event Type
- Coordinated international law-enforcement seizure and disruption of the First VPN service, which was used in ransomware and data-theft operations.
- Impact
- Authorities seized 33 servers and related domains in 27 countries, collected the service's user database, and arrested its administrator. Europol says information on 506 users was shared internationally and 83 intelligence packages were generated; the Dutch police said identified users were notified.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 1vpns[.]com | First VPN service domain seized in the operation; the service was used in ransomware and data-theft attacks. |
| DOMAIN | 1vpns[.]net | First VPN service domain seized in the operation; the service was used in ransomware and data-theft attacks. |
| DOMAIN | 1vpns[.]org | First VPN service domain seized in the operation; the service was used in ransomware and data-theft attacks. |