European and North American law enforcement agencies have dismantled First VPN Service, a criminal virtual private network platform allegedly used by cybercriminals to hide the origin of ransomware attacks, data theft, scanning activity, fraud, and denial-of-service operations.
The international action, codenamed Operation Saffron, was led by France and the Netherlands, with support from multiple countries including Luxembourg, Romania, Switzerland, Ukraine, the United Kingdom, Canada, Germany, the United States, Spain, Sweden, Denmark, Estonia, Latvia, Lithuania, Poland, and Portugal.
The takedown is another reminder that cybercrime does not depend only on malware. Criminal infrastructure — including VPNs, proxies, bulletproof hosting, encrypted communications, and anonymization services — plays a major role in enabling attacks at scale.
What Was First VPN?
First VPN Service was marketed as an anonymity-focused VPN platform. However, according to Europol and other authorities, the service was designed and promoted specifically for criminal use.
It allegedly allowed customers to hide their identities while carrying out:
- ransomware attacks
- large-scale fraud
- network reconnaissance
- intrusions
- data theft
- scanning activity
- denial-of-service attacks
The service was promoted on Russian-speaking cybercrime forums such as Exploit[.]in and XSS[.]is, where it was advertised as a way to evade law enforcement and conceal attacker infrastructure.
First VPN claimed that it did not cooperate with judicial authorities, did not store activity logs, and was not subject to any jurisdiction. Those claims were central to its appeal among cybercriminal users.
Operation Saffron proved that the promise was unreliable.
The International Takedown
The coordinated enforcement action took place between May 19 and May 20.
Authorities carried out several simultaneous steps, including:
- interviewing the service administrator
- conducting a house search in Ukraine
- taking down 33 servers
- seizing infrastructure used to support global cybercriminal activity
- confiscating related domains and Tor onion services
The seized domains included:
1vpns[.]com1vpns[.]net1vpns[.]org- related onion domains operating on the Tor network
Europol also stated that First VPN users have been notified of the shutdown and warned that their identities are now known to authorities.
This is an important psychological and operational message. Criminal VPN users may believe anonymization services protect them, but those services can become points of exposure when investigated or seized.
A Long-Running Criminal Service
According to the FBI, First VPN had been active since around 2014, making it a long-running part of the cybercriminal ecosystem.
The service reportedly operated 32 exit node servers across 27 countries, including three in the United States.
Other exit nodes were located across countries such as Australia, Austria, Belgium, Canada, Cyprus, Finland, France, Germany, Hong Kong, Italy, Latvia, Luxembourg, Moldova, the Netherlands, Panama, Poland, Romania, Russia, Serbia, Singapore, Spain, Sweden, Switzerland, Turkey, Ukraine, and the United Kingdom.
This global footprint gave users the ability to route malicious activity through different jurisdictions and disguise the real origin of attacks.
Used by Ransomware Groups
The FBI stated that at least 25 ransomware groups, including actors associated with Avaddon Ransomware, used First VPN infrastructure for reconnaissance and intrusions.
This shows how anonymization services can support the early stages of ransomware operations.
Before ransomware is deployed, attackers often need to:
- scan exposed systems
- probe VPN and RDP services
- test stolen credentials
- access victim networks
- move laterally
- stage tools
- exfiltrate data
- prepare encryption or extortion activity
A criminal VPN helps obscure the source of these actions. It gives attackers a layer of separation between their real infrastructure and the victim environment.
Cheap Access to Criminal Infrastructure
First VPN was also accessible and affordable.
Subscription periods ranged from one day to one year, with prices reportedly starting at around $2 for a single day and reaching approximately $483 for a full year.
The service accepted several payment methods, including:
- Bitcoin
- Perfect Money
- WebMoney
- EgoPay
- InterKassa
This low-cost model made anonymized infrastructure available even to less sophisticated cybercriminals. Instead of building their own complex infrastructure, attackers could simply purchase temporary access.
That is why takedowns of services like First VPN matter. They disrupt the “turnkey” criminal services that lower the barrier to entry for ransomware and fraud.
Technical Features Designed for Evasion
First VPN offered several VPN and tunneling protocols, including:
- OpenConnect
- WireGuard
- Outline
- VLess TCP Reality
- OpenVPN ECC
- L2TP/IPSec
- PPTP
The FBI noted that First VPN offered protocols such as VLESS and Reality, which can disguise VPN traffic as HTTPS traffic over common web ports.
This matters because many organizations allow outbound HTTPS traffic by default. If malicious VPN traffic can look like normal web traffic, it becomes harder for defenders to detect and block.
The service also reportedly provided technical support through a self-hosted Jabber server and Telegram encrypted messaging.
In other words, First VPN was not simply a privacy tool. It was allegedly a support-enabled infrastructure service for people conducting cybercrime.
Why Criminal VPN Takedowns Matter
Cybercriminal operations depend on infrastructure.
Malware, phishing kits, stolen credentials, and ransomware payloads are only part of the picture. Attackers also need ways to hide, route traffic, communicate, host payloads, receive stolen data, and maintain access.
Criminal VPN services help attackers:
- mask their real IP addresses
- bypass geographic blocking
- avoid simple reputation-based detection
- route traffic through trusted-looking regions
- conduct scanning at scale
- access victim networks through anonymized paths
- reduce the chance of attribution
Taking down such services does not eliminate cybercrime, but it raises the cost of doing business.
Attackers must find new providers, rebuild infrastructure, change workflows, and accept more operational risk.
Bitdefender’s Role and the Wider Impact
Bitdefender supported the investigation through Europol and shared information linked to 506 users.
The company noted that while new anonymization services will continue to appear, every takedown shortens the operational window of the next service and raises the risk for criminals who rely on ready-made infrastructure.
That point is important.
Cybercrime is an ecosystem. It includes malware developers, access brokers, ransomware affiliates, money launderers, phishing operators, hosting providers, and anonymization services. Disrupting one part of that ecosystem can make the entire chain less efficient.
Operation Saffron sends a clear message: services that advertise “no cooperation” and “no logs” to criminals can still be identified, seized, and exposed.
Defensive Lessons for Organizations
The takedown also provides lessons for defenders.
Organizations should not rely only on blocking known malicious IP addresses. Criminal VPN infrastructure changes frequently, and attackers may use commercial or semi-commercial services to rotate access points.
Security teams should focus on behavior and context.
Recommended actions include:
- monitor repeated login attempts from unusual VPN or hosting providers
- alert on impossible travel and suspicious geographic changes
- restrict access to administrative portals by trusted locations or devices
- enforce phishing-resistant MFA for VPN, RDP, cloud, and privileged access
- review failed and successful authentication attempts from anonymization services
- monitor scanning patterns against internet-facing systems
- block unnecessary inbound exposure
- apply strict conditional access policies
- use threat intelligence feeds for known proxy and VPN infrastructure
- investigate unusual data transfers from internal systems to external hosts
- segment critical systems to limit post-compromise movement
Organizations should also treat VPN-originated traffic carefully. Not all VPN usage is malicious, but administrative access from anonymization networks should be considered high risk unless explicitly approved.
Why Attack Surface Reduction Still Matters
Criminal VPN services are useful to attackers because they support the first stages of intrusion: scanning, probing, credential testing, and initial access.
Reducing exposed services remains one of the best ways to limit opportunity.
Organizations should regularly review:
- exposed RDP
- exposed VPN portals
- outdated firewalls
- vulnerable edge devices
- internet-facing admin panels
- unpatched web applications
- exposed cloud services
- weak remote access controls
If attackers cannot reach vulnerable services easily, the anonymization infrastructure becomes less valuable to them.
Final Thoughts
Operation Saffron is a significant disruption of criminal infrastructure used by ransomware actors and other cybercriminals.
First VPN allegedly promised anonymity, no cooperation with authorities, and protection from attribution. The international takedown showed that those guarantees can collapse under coordinated law enforcement pressure.
The operation will not end criminal VPN abuse, and new services will appear. But every takedown increases uncertainty for attackers and raises the cost of operating safely.
For defenders, the lesson is clear: ransomware prevention is not only about detecting malware. It is also about hardening access points, monitoring suspicious infrastructure, and understanding how attackers use anonymization services to reach their targets.
