‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested

Authorities in North America and Europe have participated in a legislation enforcement operation to disrupt First VPN, a preferred cybercrime service used for ransomware and different assaults.

In accordance with the FBI, First VPN has been lively since 2014, offering 32 exit nodes throughout 27 nations on the time of its disruption. The service, marketed on Russian-language darkish net cybercrime boards, has been utilized by no less than 25 ransomware teams for community reconnaissance and intrusions.

IP addresses related to First VPN have been concerned in scanning, botnets, DoS assaults, and hacking. 

The FBI has revealed an alert with technical particulars, IoCs, MITRE ATT&CK mappings, and suggestions. 

In accordance with Europol, legislation enforcement and companions dismantled 33 servers linked to First VPN and disrupted the infrastructure that supported cybercriminal exercise. The takedown focused the 1vpns.com, 1vpns.internet, 1vpns.org, and onion domains.

The alleged administrator of the cybercrime service has been arrested in Ukraine.

“Customers of the prison service have been notified of the shutdown and knowledgeable that they’ve been recognized,” Europol stated, noting that data on 506 customers was shared internationally.

Bitdefender, which was concerned within the takedown, identified that the 506 customers are a subset of First VPN’s buyer base, and investigators will decide which ones could be linked to prison operations. 

“Some can be traced to recognized ransomware teams. Others will reveal fraud operations, knowledge theft campaigns, or cybercrime-as-a-service infrastructure we didn’t know existed,” Bitdefender stated.

“New anonymization companies will seem. The financial demand hasn’t modified. However every takedown shortens the operational window of the subsequent service and raises the barrier for actors who relied on turnkey options,” the cybersecurity agency added. “First VPN marketed itself as a service criminals may belief to maintain them past legislation enforcement’s attain. The operation proved that declare fallacious, and each actor evaluating the subsequent anonymization service now is aware of the identical threat exists.”

Associated: Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’

Associated: RedVDS Cybercrime Service Disrupted by Microsoft and Legislation Enforcement

Associated: Aisuru and Kimwolf DDoS Botnets Disrupted in Worldwide Operation