Cybercrime has become increasingly challenging as efforts to disrupt it have shifted beyond the threat actors themselves towards the infrastructure that enables them to operate at scale have increased. First VPN has been dismantled in a significant enforcement action targeting that ecosystem by authorities. First VPN was alleged to be used as a means of concealing malicious activity and evading investigation by ransomware operators, fraud networks, and data thieves.
Through the coordinated operation, infrastructure spanning dozens of countries was seized, a suspected administrator was identified, and a service disrupted that investigators say had become a recurring element within major cybercrime investigations.
In light of this development, the focus has shifted away from pursuing the individuals responsible for carrying out illicit operations to dismantling the technical foundations which support illicit operations.
Despite playing a legitimate role in modern cybersecurity by encrypting internet traffic, masking IP addresses, and facilitating secure communications across untrusted networks, virtual private network services have also been used to conceal malicious activities.
It has been alleged that First VPN developed beyond a conventional privacy service, becoming an integral part of the cybercriminal infrastructure stack, providing threat actors with a means for concealing operating footprints, anonymizing network activity, and complicating attribution.
Europol reports that references to the service have surfaced repeatedly throughout nearly every major cybercrime investigation it has assisted, highlighting its extensive use in preventing money laundering, fraud, and identity theft.
On the 19th and 20th of May, authorities conducted a coordinated enforcement action targeting the infrastructure supporting the service, interviewed its suspected administrator, and conducted a house search in Ukraine while at the same time dismantling 33 servers and disrupting global systems thought to facilitate criminal activity.
Additionally, the operation resulted in the seizure of core domains, including 1vpns.com, 1vpns.net, and 1vpns.org, and associated onion services, effectively removing key access points relied upon by its user base. Further, investigators informed users that the service had been discontinued and that they were being scrutinized by law enforcement.
The platform was taken down as a result of an investigation initiated in December 2021 in which Europol's European Cybercrime Centre and cybersecurity firm Bitdefender assisted authorities in gaining access to the platform's infrastructure and user database.
By analysing the collected data, investigators were able to map VPN connections that were believed to facilitate criminal activity, uncovered intelligence on thousands of users, and generated actionable leads related to ransomware campaigns, fraud networks, and other serious cyber-enabled crimes across multiple jurisdictions.
The investigation has also revealed a fundamental contradiction in the core of criminal anonymity services, namely, that the promise of complete invisibility is very often dependent on the trustworthiness of the very operators who earn their profits from that promise.
It has been alleged that intelligence recovered during Operation Saffron included a database of VPN users which was capable of identifying specific VPN activities and individuals. This raises serious concerns about the extent to which a service that reportedly marketed itself as unreachable by law enforcement retains data.
These findings are consistent with a recurring reality within the underground economy, in which threat actors routinely entrust operational trust in infrastructure providers whose internal practices remain opaque and largely undisclosed.
Considering the investigation of First VPN as part of the cybercrime supply chain, First VPN plays an essential role in enabling malicious actors to maintain operations while minimizing their vulnerability to detection and attribution.
The dismantling of its operations aligns with Europol’s broader strategic approach to targeting shared infrastructure rather than individual groups in isolation.
By disrupting common operational dependencies, multiple criminal networks can be affected simultaneously, resulting in cascading effects.
It is evident that this approach has both effectiveness and limitations, as demonstrated by enforcement actions against Safe-Inet in 2020 and VPNLab.net in 2022.
Cybercriminal operators frequently migrate to alternative providers during such operations; however, the intelligence obtained as a result of such operations frequently exceeds the value of infrastructure seizures over the long run.
The investigation into First VPN resulted in a significant amount of operational intelligence obtained by investigators. This information has already been translated into tangible investigation outcomes for the investigation.
Over 80 intelligence packages have been disseminated globally, 506 known users of the service were identified, and at least 21 investigations have been supported by the information derived from the operation.
The recovered dataset not only exposes individuals allegedly involved in ransomware campaigns and fraud operations, but also enables law enforcement agencies to map relationships, infrastructure dependencies, and historical activity patterns that would otherwise remain concealed behind layers of anonymity.
According to industry observers, this intelligence-driven approach is increasingly based on the evolving nature of cybercrime disruption, in which not only is it advantageous to eliminate malicious infrastructure but also to turn seized systems into sources of actionable intelligence that can assist law enforcement efforts across jurisdictions in coordinating enforcement efforts.
Dismantling First VPN illustrates an emerging reality in cybercrime enforcement: it is becoming increasingly necessary to target infrastructure providers and technology companies that enable malicious activity, as well as the actors committing the crime.
Cybercriminal ecosystems have repeatedly demonstrated the capability to adapt and rebuild, but the information recovered from such operations can serve as a lasting investigative tool that extends beyond the initial takedown.
As a result of this development, organizations must continuously evaluate the assumptions surrounding trust regarding anonymization services, proxy networks, and other privacy-focused infrastructure within security monitoring strategies, especially since they serve as a reminder.
Continuing to evolve threat actors' tactics, it is critical to maintain visibility into remote access activity, strengthen identity controls, and apply risk-based authentication. In addition to the increasing efforts of law enforcement and cybersecurity partners against cybercrime's infrastructure layer, the contest is increasingly driven by intelligence, attribution, and operational resilience.
