Cybercrime ‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested The FBI says First VPN has been used by dozens of ransomware groups for network reconnaissance and intrusions. By Eduard Kovacs | May 22, 2026 (5:24 AM ET) Flipboard Reddit Whatsapp Whatsapp Email Authorities in North America and Europe have participated in a law enforcement operation to disrupt First VPN, a popular cybercrime service used for ransomware and other attacks. According to the FBI, First VPN has been active since 2014, providing 32 exit nodes across 27 countries at the time of its disruption. The service, advertised on Russian-language dark web cybercrime forums, has been used by at least 25 ransomware groups for network reconnaissance and intrusions. IP addresses associated with First VPN have been involved in scanning, botnets, DoS attacks, and hacking. The FBI has published an alert with technical details, IoCs, MITRE ATT&CK mappings, and recommendations. According to Europol , law enforcement and partners dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal activity. The takedown targeted the 1vpns.com, 1vpns.net, 1vpns.org, and onion domains. The alleged administrator of the cybercrime service has been arrested in Ukraine. Advertisement. Scroll to continue reading. “Users of the criminal service have been notified of the shutdown and informed that they have been identified,” Europol said, noting that information on 506 users was shared internationally. Bitdefender, which was involved in the takedown, pointed out that the 506 users are a subset of First VPN’s customer base, and investigators will determine which of them can be linked to criminal operations. “Some will be traced to known ransomware groups. Others will reveal fraud operations, data theft campaigns, or cybercrime-as-a-service infrastructure we didn’t know existed,” Bitdefender said . “New anonymization services will appear. The economic demand hasn’t changed. But each takedown shortens the operational window of the next service and raises the barrier for actors who relied on turnkey solutions,” the cybersecurity firm added. “First VPN advertised itself as a service criminals could trust to keep them beyond law enforcement’s reach. The operation proved that claim wrong, and every actor evaluating the next anonymization service now knows the same risk exists.” Related : Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ Related : RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement Related : Aisuru and Kimwolf DDoS Botnets Disrupted in International Operation Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI Anthropic Silently Patches Claude Code Sandbox Bypass Real-World ICS Security Tales From the Trenches Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’ Critical Vulnerability Exposes Industrial Robot Fleets to Hacking Millions Impacted Across Several US Healthcare Data Breaches 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand Latest News TrendAI Patches Apex One Zero-Day Exploited in the Wild Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack Cisco Patches Critical Vulnerability in Secure Workload Ocean Emerges From Stealth With $28M for Agentic Email Security Platform Apple Rejected 2 Million App Store Submissions in 2025 for Security and Fraud Prevention Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking Socket Raises $60 Million at $1 Billion Valuation Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days Trending Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Threat Detection and Incident Response Summit May 20, 2026 Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization. Register Webinar: Third-Party Risk in Practice June 4, 2026 Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice. Register People on the Move Joe Chen has become Chief Technology Officer at Trellix. Usercentrics has named Pawan Hegde as COO and Elena Ignatova as CPTO. SecureAuth has named Mark van Oppen as Chief Revenue Officer. More People On The Move Expert Insights Caught Off Guard: Securing AI After It Hits Production As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode. (Joshua Goldfarb) Cyber Resilience is the New Business Continuity Plan The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose. (Steve Durbin) Enhancing Data Center Security Without Sacrificing Performance For AI data centers, where the stakes are the highest and performance constraints are the tightest, security and performance are no longer a zero-sum game. (Nadir Izrael) Is the SOC Obsolete, and We Just Haven’t Admitted It Yet? Many AI-first enterprises have already embraced sovereign architectures for general AI initiatives; cybersecurity—and the SOC—should be next. (Danelle Au) The Mythos Moment: Enterprises Must Fight Agents with Agents Only with the right platform and an agentic, AI-driven defense, will enterprises be able to protect themselves in the agentic era. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email