First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups

Overview

Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service known as First VPN, used by criminal actors — including more than 25 ransomware groups — to anonymize the origins of ransomware attacks, data theft campaigns, network scanning, and denial-of-service attacks.

The operation marks one of the most significant VPN infrastructure takedowns targeting ransomware enablement infrastructure in 2026, reflecting growing coordination between law enforcement agencies across jurisdictions.

What Is First VPN?

First VPN was a criminal-operated VPN service that sold anonymization and traffic-obfuscation capabilities to cybercriminals. Unlike legitimate commercial VPN providers, First VPN was marketed on underground forums specifically to individuals seeking to conduct illegal activities without attribution.

The service was used at multiple stages of ransomware attack chains:

• Reconnaissance — scanning target networks without revealing attacker origin
• Initial access — connecting to compromised credentials and VPNs through First VPN infrastructure
• Data exfiltration — routing stolen data through anonymous nodes
• Post-attack — avoiding attribution and monitoring during extortion

The Takedown

The disruption of First VPN was led by France, in coordination with law enforcement partners across Europe and North America. The operation involved:

• Server seizures across multiple hosting jurisdictions
• Domain takedowns preventing new connections to the service
• Administrator arrest of the individual(s) operating the service
• Intelligence gathering on subscriber activity for downstream investigations

The coordinated action follows a pattern established by prior operations including Operation PowerOff, which targeted DDoS-for-hire platforms, and the dismantling of several bulletproof hosting providers used by threat actors.

Ransomware Groups Using First VPN

More than 25 ransomware groups are reported to have used First VPN infrastructure, making the service a common link across a significant portion of the ransomware ecosystem. The takedown creates an intelligence windfall for law enforcement, as subscriber and usage logs from First VPN servers may expose:

• IP addresses used by ransomware affiliates during attacks
• Timing data linking First VPN sessions to known ransomware incidents
• Payment records tying cryptocurrency transactions to operator identities
• Victim targeting information from reconnaissance sessions

This intelligence model — dismantling supporting infrastructure to expose the criminals who used it — has proven effective in prior operations. The Emotet takedown in 2021 similarly generated leads that led to follow-on arrests of affiliated actors.

Criminal VPN Services and the Ransomware Ecosystem

Criminal VPN services occupy a specific niche in the cybercrime supply chain. They differ from legitimate VPN providers in several key ways:

First VPN's takedown removes a critical anonymization layer for the ransomware groups that relied on it, forcing them to seek alternative infrastructure — and potentially exposing historical operational data to investigators.

Impact on Ransomware Operations

The disruption of First VPN is expected to have several short and medium-term effects on ransomware group operations:

Short term:

• Forced migration to alternative VPN and proxy infrastructure
• Disruption to ongoing operations that relied on First VPN connections
• Potential operational security failures as groups scramble to re-establish anonymization

Medium term:

• Law enforcement exploitation of First VPN subscriber data for follow-on arrests
• Increased scrutiny of alternative criminal anonymization services
• Possible attribution of historical attacks to specific First VPN subscribers

Defender Implications

For organizations that may have been targeted by ransomware groups using First VPN infrastructure:

• Review incident response records from 2024–2026 — if your network was compromised, First VPN IP ranges may appear in your logs
• Contact law enforcement if you have evidence of attacks involving First VPN infrastructure — the takedown creates new opportunities for cooperation
• Update threat intelligence feeds to include First VPN IP ranges and known exit node addresses

For security teams monitoring threat intelligence:

• Watch for new bulletproof VPN services emerging to fill the void left by First VPN
• Monitor underground forums for advertising of alternative criminal anonymization services targeting ransomware operators

Sources

• The Hacker News — First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups

Related Reading

• 'First VPN' Cybercrime Service Disrupted, Administrator Arrested
• Operation PowerOff Seizes 53 DDoS Domains
• Europe Dismantles VPN Service Used by Ransomware Groups