European agencies dismantle VPN service popular among cyber criminals

An international law enforcement operation supported by Europol has succeeded in taking down a VPN service that cybercriminals used to conceal ransomware attacks and other cyber crimes.

 

Europol said in a press release that the VPN service, known as First VPN, was marketed in Russian-speaking cyber criminal forums as a handy tool that enabled malicious actors to conceal their digital identities, make anonymous payments, hide their criminal infrastructure and use custom services to enhance the effectiveness of criminal operations.

 

Europol said the VPN service had become extremely common in cyber crime circles, so much so that it appeared in every cyber crime investigation and cyber criminals used it widely to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.

 

Considering the platform’s usefulness to malicious actors, an international law enforcement operation led by France and the Netherlands dismantled the VPN service and its supporting infrastructure between 19 and 20 May. Authorities successfully dismantled 33 servers linked to VPN First, interviewed an administrator, conducted a house search in Ukraine and disrupted infrastructure used to support cybercriminal activity worldwide. 

 

"For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement," said Edvardas Šileris, Head of Europol’s European Cybercrime Centre. "This operation proves them wrong. Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate and evade law enforcement."

 

According to Europol, law enforcement investigators had infiltrated VPN First in 2021 itself. Investigators then used their access to obtain the service’s user database and identify cyber criminals who used the VPN service to conceal their malicious activities.

 

"With the infrastructure dismantled and the administrator under arrest, investigators across multiple jurisdictions are now using the intelligence gathered to support ongoing cybercrime investigations worldwide," Europol said.

The law enforcement operation uncovered the identities of more than 500 cyber criminals and obtained valuable intelligence to support 21 additional investigations into criminal activities.

 

The pan-European operation was carried out by law enforcement agencies from France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine and the UK, and was supported by agencies in Canada, Germany and the US.