Law enforcement has blocked VPN services used by dozens of criminal groups

A global security watchdog announced Thursday that it will take down a popular online service used by cybercriminals and arrest its administrator.

The FBI he said warningly that First VPN was so popular that “at least” 25 ransomware groups used the service to hide their malicious activities. Cybercriminals also relied on VPNs to scan the Internet, run botnets, launch distributed denial-of-service attacks, and run scams. The first VPN servers operated in 27 different countries, according to the office.

Europol he said in the announcement that, in addition to providing anonymous connections, First VPN provided cyber criminals with anonymous money, hidden infrastructure, and other services that were sold mainly to criminals.

The announcement read: “Firstly, VPNs have become increasingly involved in cybercrime, which has been seen in nearly every major cyber investigation supported by Europol in recent years. “Criminals have used it to hide their information and devices while carrying out ransomware attacks, mass fraud, identity theft, and other serious crimes.”

The service was advertised in popular cybercrime forums, including two Russian-speaking markets, and promised protection against criminals.

“We are anonymous. We do not store logs that would allow us or third parties to associate the IP address in real time with the user of our service,” FirstVPN said in one post that TechCrunch has seen. “The information we store is the email address and the username, but it is impossible to connect the user’s online information with another person of our service.”

Europol, however, said that First VPN users were notified of the suspension and “have been informed that they will be identified.” The researchers said they did this by accessing a database of users and identifying VPN links, which “revealed thousands of users connected to the cybercrime ecosystem.”

The international security agency also said that the First VPN Manager was arrested, many servers were “taken down,” and its equipment was compromised – all of which were investigated in December 2021.