Europol Takes Down Criminal VPN at the Heart of Ransomware Operations

A VPN built to help cybercriminals disappear has become the latest target in the global fight against ransomware.

First VPN, a service promoted for years on Russian-speaking cybercrime forums, was dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust (Europol, 2026). The service was designed for criminal use, offering anonymous payments, concealed infrastructure, and tools that helped users mask their identities while carrying out ransomware attacks, fraud, data theft, and other serious offenses.

The operation, carried out in May, struck at the infrastructure behind the service. Authorities interviewed the administrator and conducted a house search in Ukraine, dismantled 33 servers, and seized domains including 1vpns.com, 1vpns.net, 1vpns.org, and associated onion domains. Users were also notified that the service had been shut down and that they had been identified.

The takedown followed an investigation that began in December 2021. Investigators working with Europol’s European Cybercrime Centre gained access to the platform, obtained its user database, and traced VPN connections used to conceal criminal activity. The intelligence exposed thousands of users linked to the cybercrime ecosystem and generated leads connected to ransomware attacks, fraud schemes, and data theft worldwide.

The results were immediate and wide-reaching. Europol said the operation produced 83 intelligence packages, shared information linked to 506 users internationally, and helped advance 21 Europol-supported investigations.

Each intelligence package can become a starting point for a separate investigative thread: a ransomware affiliate, a fraud network, a data theft operation, a server cluster, a payment trail, or a connection between previously separate cases. The information linked to 506 users is especially significant, as anonymity services are valuable precisely for obscuring identity and activity. Once investigators obtain user data, connection records, or infrastructure links, the service can shift from a shield into a map.

The significance of the case goes beyond one VPN. First VPN functioned as part of the hidden machinery of cybercrime. Ransomware groups depend on services like this to hide their infrastructure, communicate securely, and slow down attribution. By removing that layer of protection, investigators weakened a tool criminals relied on to operate across borders.

“For years, cybercriminals saw this VPN service as a gateway to anonymity. They believed it would keep them beyond the reach of law enforcement,” Edvardas Šileris, Europol’s European Cybercrime Centre chief, said in a release, describing the service as a major infrastructure for cybercriminals. “This operation proves them wrong. Taking it offline removes a critical layer of protection that criminals depended on to operate, communicate and evade law enforcement.”

A criminal VPN helps them build distance between their real infrastructure and the attack. It may conceal logins, disguise command and control activity, or complicate efforts to connect a user to a wider criminal network. Removing that layer does not solve ransomware by itself, but it makes the environment more hostile for attackers.

First VPN promised invisibility. Instead, it became a source of evidence. That reversal captures the new direction of cybercrime enforcement: dismantle the systems criminals trust, identify the users behind them, and turn their anonymity tools into investigative leads.