Authorities Have Taken Down “First VPN” Used in Ransomware Attacks

Operation Saffron was a coordinated international law‑enforcement operation that dismantled "First VPN," a criminal VPN service used to facilitate ransomware, hacking and fraud. Authorities seized 33 servers across 27 countries, shut down 1vpns domains and associated onion sites, identified thousands of users (506 specifically highlighted), questioned an administrator, publicly posted 65 IP addresses, and produced intelligence packages for ongoing investigations.