Law Enforcement Shuts Down Popular VPN Service Used by Ransomware Gangs

A major crackdown on cybercrime has led to the shutdown of a popular virtual private network service used by ransomware gangs.

An international coalition of law enforcement agencies announced Thursday that they took down a popular virtual private network service used by cybercriminals and arrested its administrator. The FBI said in an alert that First VPN was so popular that “at least" 25 ransomware gangs used the service to hide their malicious activity. Cybercriminals also relied on the VPN to scan the internet, run botnets, launch distributed denial-of-service attacks, and for running scams.

First VPN operated servers across 27 different countries, according to the bureau.

Europol said in an announcement that, apart from offering anonymous connections, First VPN offered cybercriminals anonymous payments, hidden infrastructure, and other services specifically marketed for criminal hackers.

“First VPN had become deeply embedded in the cybercrime ecosystem, appearing in almost every major cybercrime investigation supported by Europol in recent years,” read the announcement. “Criminals used it to conceal their identities and infrastructure while carrying out ransomware attacks, large-scale fraud, data theft, and other serious offences.”

The service advertised on known cybercrime forums, including at least two Russian-speaking marketplaces, promising criminals protection against being identified.

“We are for anonymity. We do not store any logs that would allow us or third parties to link an IP address in a specific period of time with a user of our service,” FirstVPN said in one post that TechCrunch has seen. “The only data we store is e-mail and username, but it is impossible to link a user's online activity with a specific user of our service.”

However, Europol said that First VPN users were notified of the shutdown and "informed that they have been identified.” Investigators said they did this by obtaining the service’s user database and identifying VPN connections, which “exposed thousands of users linked to the cybercrime ecosystem.”

The international law enforcement agency also said First VPN’s administrator was arrested, dozens of servers “dismantled,” and its infrastructure was disrupted — all products of an investigation launched in December 2021.

What Does This Mean for Cybercrime?

The takedown of First VPN marks a significant blow to the cybercrime ecosystem, which has long relied on such services to hide their activities. While it's unclear what will happen to the users of First VPN, the shutdown of the service represents a major victory for law enforcement in their efforts to crack down on cybercrime.

How Did First VPN Get Away With It?

First VPN's administrators were able to evade law enforcement for so long by promising anonymity and hiding their infrastructure. However, Europol's investigation exposed the service's true nature, revealing that it was providing services specifically marketed for criminal hackers.

What's Next for Cybercrime?

The shutdown of First VPN is just the beginning of a larger crackdown on cybercrime. Law enforcement agencies must continue to work together to identify and disrupt the networks and services used by cybercriminals. By doing so, they can make it much harder for these individuals to carry out their malicious activities.

Conclusion

The takedown of First VPN is a significant victory for law enforcement in their efforts to crack down on cybercrime. However, it's clear that there is still much work to be done to disrupt the networks and services used by cybercriminals. By continuing to work together, law enforcement agencies can make a real difference in keeping the cybercrime ecosystem at bay.