Authorities in North America and Europe have participated in a law enforcement operation to disrupt First VPN, a popular cybercrime service used for ransomware and other attacks.
According to the FBI, First VPN has been active since 2014, providing 32 exit nodes across 27 countries at the time of its disruption. The service, advertised on Russian-language dark web cybercrime forums, has been used by at least 25 ransomware groups for network reconnaissance and intrusions.
IP addresses associated with First VPN have been involved in scanning, botnets, DoS attacks, and hacking.
The FBI has published an alert with technical details, IoCs, MITRE ATT&CK mappings, and recommendations.
According to Europol, law enforcement and partners dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal activity. The takedown targeted the 1vpns.com, 1vpns.net, 1vpns.org, and onion domains.
