In a coordinated international operation, law enforcement agencies have shut down First VPN, a virtual private network service widely used by cybercriminals. The FBI reported that at least 25 ransomware gangs relied on the service to conceal their attacks, conduct large-scale fraud, and run botnets. First VPN operated servers in 27 countries and actively marketed anonymity to hackers on cybercrime forums, claiming it kept no logs linking users to IP addresses.

Europol confirmed that the service had become embedded in nearly every major cybercrime investigation in recent years. Investigators traced the network through a probe launched in December 2021, eventually obtaining user databases and mapping connections to expose thousands involved in the cybercrime ecosystem. The service’s administrator was arrested, and dozens of servers were dismantled.

The takedown marks a significant disruption in the infrastructure supporting ransomware operations globally. Authorities emphasized that users were notified they had been identified, signaling a shift in how hidden services are being unmasked. The move underscores the growing reach of cross-border cyber enforcement, though experts note that new services may quickly emerge to fill the gap.