An international law enforcement operation codenamed “Operation Saffron” (also referred to as “Operation Riptide”) has dismantled the “First VPN Service,” a criminal virtual private network explicitly designed to help ransomware groups evade detection. The takedown, announced June 9, was led by France’s BL2C cybercrime unit and the Dutch National High Tech Crime Unit, with support from the FBI, Europol, and agencies in Ukraine, the UK, Switzerland, and Luxembourg.
The operation resulted in the seizure of 33 servers across 27 countries, the takedown of associated domains (1vpns.com, 1vpns.net, 1vpns.org), and the arrest of the service’s administrator in Ukraine. Investigators obtained the full user database and criminal traffic logs, identifying 506 specific users. This intelligence is already feeding into 21 ongoing Europol cybercrime investigations.
First VPN had been operational since approximately 2014 and was marketed on Russian-language dark web forums. It explicitly advertised features designed for cybercriminals, including anonymous payment processing and hidden infrastructure. At least 25 ransomware groups — including Avaddon — used the service for network reconnaissance and intrusions.
Source
Official announcement from the FBI. Additional coverage from SecurityWeek and Bitdefender.
Commentary
Criminal VPN services are foundational infrastructure for ransomware operations — they’re the equivalent of a getaway car for digital heists. Taking down First VPN after 10+ years of operation is a significant win, but the real prize is the user database. With 506 identified users and 21 investigations already underway, this takedown has the potential to cascade into arrests and disruptions across multiple ransomware ecosystems. The cross-border coordination involving 27 countries also demonstrates that international cybercrime enforcement is maturing. That said, replacement services will inevitably emerge. The question is whether law enforcement can maintain the tempo of takedowns fast enough to keep operational costs high for attackers.