The international operation was led by France and the Netherlands, with the support of Europol and Eurojust. Law enforcement officials accused First VPN of being used by cybercriminals to conceal ransomware attacks, data theft, and "other serious crimes."
The investigation began in December 2021 and was conducted jointly by French and Dutch authorities. They formed an investigative team in November 2023. The operation was dubbed "Operation Saffron."
The active phase of the operation took place on May 19 and 20: critical infrastructure, including 33 servers, was dismantled in seven countries, and a search and interrogation of a suspect was conducted in Ukraine . In addition to France and the Netherlands, Luxembourg, Switzerland, Romania, Ukraine, and the United Kingdom participated in the operation.
During the operation, the service's main domain names—1vpns.com, 1vpns.net, and 1vpns.org—were also seized and disabled. Law enforcement also disabled the associated onion domains.
According to Europol, First VPN "had been promoted for years on Russian-language cybercriminal forums as a reliable tool for maintaining anonymity." It allegedly offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.
[td]"For years, cybercriminals have viewed this VPN service as a means of anonymity. They believed it would keep them out of reach of law enforcement. This operation proves them wrong," boasted Edvardas Šileris, head of Europol's European Cybercrime Centre.[/td]Eurojust stated that investigators managed to infiltrate the VPN infrastructure before it was shut down and collect traffic data that allowed them to identify the service's users. Europol established a task force, bringing together investigators from 16 countries to analyze the seized data and coordinate intelligence sharing "with international partners."
The operation resulted in the identification of thousands of service users linked to criminal activity, and the data on 506 of them was shared with "international partners." Users of the service received notifications about its closure and were informed that their identities had been established, the agency added.
According to Europol, the name First VPN has appeared in virtually every major cybercrime investigation the agency has conducted in recent years.
__________________
The investigation began in December 2021 and was conducted jointly by French and Dutch authorities. They formed an investigative team in November 2023. The operation was dubbed "Operation Saffron."
The active phase of the operation took place on May 19 and 20: critical infrastructure, including 33 servers, was dismantled in seven countries, and a search and interrogation of a suspect was conducted in Ukraine . In addition to France and the Netherlands, Luxembourg, Switzerland, Romania, Ukraine, and the United Kingdom participated in the operation.
During the operation, the service's main domain names—1vpns.com, 1vpns.net, and 1vpns.org—were also seized and disabled. Law enforcement also disabled the associated onion domains.
According to Europol, First VPN "had been promoted for years on Russian-language cybercriminal forums as a reliable tool for maintaining anonymity." It allegedly offered users anonymous payments, hidden infrastructure, and services designed specifically for criminal use.
The operation resulted in the identification of thousands of service users linked to criminal activity, and the data on 506 of them was shared with "international partners." Users of the service received notifications about its closure and were informed that their identities had been established, the agency added.
According to Europol, the name First VPN has appeared in virtually every major cybercrime investigation the agency has conducted in recent years.
__________________