'Operation Saffron': Global Authorities Shutter First VPN Used by Ransomware Groups

An unprecedented international efforts has led to the dismantling of 'First VPN', a virtual private network service that, for over a decade, empowered ransomware syndicates and cybercriminals to hide their tracks. The operation, executed in May 2026, saw coordination between law enforcement across 18 countries, culminating in the arrest of the network’s administrator and the seizure of its infrastructure.

Key Takeaways

• First VPN supported at least 25 ransomware groups since 2014.

• Led by French and Dutch authorities, the takedown involved 18 countries and major agencies such as Europol and the FBI.

• 33 servers, primary domains, and crucial criminal data were seized; the Ukrainian administrator was arrested.

• Operation shortens ransomware groups’ anonymity and creates new investigative leads.

How the Operation Unfolded

Known as Operation Saffron, the investigation began in 2021 following multiple cybercrimes traced back to First VPN. Law enforcement executed raids, server seizures, and forensics simultaneously between May 19 and May 20, 2026. The coordinated action led to the takedown of 33 servers, confiscation of key domains, and the arrest of the alleged administrator in Ukraine.

Investigators accessed First VPN’s user database, identifying and exposing hundreds of cybercrime-linked customers across borders. Intelligence from the operation generated new leads for ongoing and future cybercrime investigations globally.

The Role of First VPN in Cybercrime

First VPN was marketed not to everyday privacy-seeking consumers, but to cybercriminals. Promoted on Russian-speaking forums, the service promised complete anonymity, refused to cooperate with authorities, and claimed a strict no-logs policy.

The VPN provided advanced features such as multiple tunneling protocols (OpenConnect, WireGuard, VLESS TCP Reality) and encryption options, alongside anonymous payment methods including Bitcoin and other e-currencies. Subscription plans ranged from $2 for a day’s use to nearly $500 annually.

Ransomware Ecosystem Dependency

First VPN was a backbone for at least 25 ransomware groups, including notorious names like Avaddon and Phobos. Ransomware actors relied on the service to mask:

• Reconnaissance activities

• Network intrusions

• Data exfiltration

• Command-and-control communications

The VPN’s wide geographic footprint—spanning 27 countries—allowed attackers to shift traffic to evade detection and legal jurisdiction, complicating efforts to track or stop them.

Impact and Ongoing Investigations

Disrupting the anonymizing infrastructure is a significant blow to ransomware and cyberfraud operations. Law enforcement now holds data that may link cyberattacks, large-scale frauds, and data thefts directly back to actors previously hidden behind First VPN.

Officials and cybersecurity experts agree this takedown raises the operational risks for cybercriminals and shortens the lifecycle of future criminal anonymization services. Although alternative services will emerge, each takedown increases costs and risks for ransomware groups—and deters potential new actors.

Lessons Learned & Next Steps for Organizations

Recommended Actions:

1. Review organizational logs for any connections to First VPN’s IPs or domains.

2. Strengthen controls against unauthorized or suspicious VPN usage.

3. Update internal policies and educate staff about risks from anonymization services.

4. Collaborate with cybersecurity agencies to stay abreast of emerging threats and infrastructure takedowns.

The First VPN takedown signals a strategic shift toward undermining cybercriminal infrastructure at its core—showing that even the most secretive services are within the reach of international law enforcement.

Sources

• First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups, The Hacker News.

• Operation Saffron Dismantles Criminal VPN Used by 25 Ransomware Groups (2014–2026) –Rescana, Rescana.

• Global Crackdown Dismantles “First VPN,” Cybercriminal Network Linked To Ransomware Syndicates Worldwide, LinkedIn.

• Operation Saffron: Bitdefender Joins “First VPN” Takedown, Bitdefender.

• Cybercriminal VPN used by ransomware actors dismantled in global crackdown – VPN service featured in almostevery major Europol-supported cybercrime investigation, Europol.