A VPN service used by ransomware operators, fraudsters and data thieves to mask their activity has been taken offline in a coordinated operation led by France and the Netherlands.

According to Europol, the law enforcement action ran from May 19 to 20 and resulted in 33 servers being dismantled, three domains being seized and the service's administrator being interviewed during a house search in Ukraine.

The VPN service had been advertised for years on Russian-language cybercrime forums, marketed as a way to stay invisible to law enforcement. It accepted anonymous payments and ran infrastructure tailored to illicit use.

Embedded in the Cybercrime Ecosystem

Europol said First VPN had appeared in almost every major cybercrime investigation it had supported in recent years. The service let attackers hide where they were operating from while running ransomware campaigns, fraud operations and bulk data theft.

The seized domains include 1vpns.com, 1vpns.net and 1vpns.org alongside associated onion-routed addresses. Investigators have reached out to the service's users, letting them know they have been identified.

Read more on cybercriminal takedowns: Europol Busts Albanian Scam Call Centers in Major Online Fraud Case

The investigation behind the takedown began in December 2021, with investigators eventually gaining access to the service and obtaining its user database. Cybersecurity firm Bitdefender supported the work through Europol.

Thousands of Users Linked to Active Cases

The intelligence haul has already produced 83 intelligence packages shared with international partners, information on 506 users disseminated globally, and 21 Europol-supported investigations advanced through the data gathered.

Michael Jepson, head of penetration testing at CybaVerse, said the strategic value of takedowns like this lies in the data they generate as much as the immediate disruption.

"These operations often contain large amounts of data on thousands of criminals and threat actors, which authorities can leverage for further investigation and prosecution," he said.

"The data gathered from this takedown will fuel follow-on investigations into activity conducted via First VPN."