logo

First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups

ID: 7e821479-e3a2-5737-9d6e-1f5f2e2424ca

STIX ID: report--7e821479-e3a2-5737-9d6e-1f5f2e2424ca

Feed Name: The Hacker News

Threat Score
75/100

Date Published: 2026-05-22

Date Updated: 2026-05-22

Author: [email protected] (The Hacker News)

...
...

Authorities across Europe and North America coordinated to dismantle "First VPN Service", a criminal VPN marketed on Russian-language forums and used by ransomware and other cybercriminal groups to obscure attack origins; investigators seized domains and 33 servers, interviewed the administrator, and published exit-node IPs and technical details (protocols, payment methods) showing widespread misuse by at least 25 ransomware families.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.