logo

Authorities dismantle First VPN, used by ransomware actors

ID: 81b4f5f8-f2d6-5d80-b9a5-a3d626c37617

STIX ID: report--81b4f5f8-f2d6-5d80-b9a5-a3d626c37617

Feed Name: Help Net Security

Threat Score
70/100

Date Published: 2026-05-21

Date Updated: 2026-05-21

Author: Anamarija Pogorelec

...
...

Law enforcement (French and Dutch authorities with Europol/Eurojust) dismantled First VPN — a criminally advertised VPN service — seizing 33 servers and multiple domains and interviewing the operator; investigators accessed user traffic, identified thousands of accounts (service operated since 2014, >5,000 accounts), and produced intelligence linking users to ransomware (including Phobos), fraud, and other cybercrimes.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.