Home / Crime and Justice / VPN Used by 25 Ransomware Groups Dismantled
VPN Used by 25 Ransomware Groups Dismantled
29 May
Summary
- Europol and Eurojust dismantled First VPN domains last week.
- FBI linked 25 hacking groups, including Avaddon Ransomware, to First VPN.
- User data from First VPN is aiding 21 ongoing cybercrime investigations.
Last week, a significant international law enforcement operation, codenamed "Operation Saffron," successfully dismantled the First VPN service. Europol and Eurojust led the coordinated effort, resulting in the seizure of 33 servers and the European domain of the free VPN provider. The FBI identified at least 25 hacking groups actively using First VPN's infrastructure for their criminal enterprises.
Among the identified entities was the Avaddon Ransomware group, known for targeting various business sectors. The FBI's report detailed how First VPN actively marketed its services on dark web forums to cybercriminals, promising anonymity and a secure environment for illicit activities. Users could pay with cryptocurrencies for varying subscription periods, routing their traffic through multiple global nodes to obscure their origins.
Investigators obtained First VPN's user database, identifying 506 specific users. This data is proving invaluable, currently supporting 21 ongoing cybercrime investigations conducted by Europol. The FBI has recommended that organizations implement multi-layered security controls, including multi-factor authentication and continuous monitoring of unauthorized VPN connections, to mitigate risks from such services.
