European Agencies Shutter VPN Service Used for Ransomware Attacks

Law enforcement agencies in France, the Netherlands and partners carried out “Operation Saffron,” seizing 33 servers and multiple domains (1vpns.com/.net/.org and associated onion domains) belonging to First VPN—a service long promoted on Russian-language criminal forums and used by over 25 ransomware groups and other cybercriminals to hide scanning, intrusions, DDoS, fraud and data theft. Investigators gained access to the service’s user database, generated intelligence packages (including details on 506 international users), and are using those leads to support ongoing global investigations.