First VPN criminal VPN service taken offline
On the 19th and 20th of May, in an international action, the criminal VPN service First VPN was taken offline. This was done by Team High Tech Crime of the National Investigation Unit, under the authority of the National Public Prosecutor's Office, in cooperation with the French authorities. Before the service went offline, the police had access to the criminal traffic of the users of the service, who mistakenly believed themselves to be safe. At the request of the French authorities, the operator of the service was interviewed in Ukraine.
First VPN service
The VPN service that was taken offline is First VPN. A Virtual Private Network (VPN) encrypts the user's network traffic and protects their IP address. It concerns websites that contain ‘1vpns’ in their URL. In this way, an Internet service provider or network administrator does not know which websites a user visits or where a website visit comes from.
The First VPN service was considered criminal, because it specifically targeted cyber criminals and gave them the opportunity to protect their identity. The service in question in this investigation mainly advertised on the cyber criminal forums known to the police and thus expressly approached cyber criminals as potential clients. The website of the service also stated that any cooperation with the judiciary would be denied, that the service was not subject to any jurisdiction and that no data on users was stored. As a result, the service pretended to be reliable and its users safe, which in reality was not the case.
The VPN service provided was used to keep criminals out of the reach of the law and facilitate illegal activities such as ransomware attacks and hacking computer systems and accounts.
The investigation
During the criminal investigation, extensive investigations were carried out into the service and its users. In this context, insight has been gained into criminal communication of all users. This data has not only been used in the investigation itself but also shared with other ongoing (inter)national operations. The Operational Taskforce (OTF) hosted at Europol supported coordination and analysis of the data. In total 83 intelligence packages were disseminated. During the action 33 servers were dismantled, which were linked to the criminal service. Additionally, all users of this service have received a message stating that the VPN service has been taken offline and they have been identified as the user of the service.
For more information, read the article on the website of Europol [LINK: ]
International cooperation
The investigation took place in an international context. Eurojust supported a joint investigation team (JIT) between the French and Dutch authorities and hosted a coordination centre that allowed the simultaneous action days in Ukraine, Switzerland, the United Kingdom, Romania and Luxembourg.
Find out more about the actions and international cooperation on the Eurojust website.