First VPN was a criminal VPN service extensively used by ransomware groups, fraudsters, and data thieves to conceal their operations. It was advertised on Russian-language cybercrime forums and accepted anonymous payments. A law enforcement operation from May 19-20, 2026, led by France and the Netherlands, dismantled the service by seizing 33 servers and three domains, and searching the administrator's residence in Ukraine. Investigators gained access to the user database, generating intelligence packages and advancing multiple investigations internationally. The service had been involved in almost every major Europol-supported cybercrime investigation recently. The domains 1vpns.com, 1vpns.net, and 1vpns.org were associated with this service. There is no software patch or vendor remediation because this is a criminal infrastructure takedown.

The takedown disrupts a key infrastructure used by cybercriminals for anonymizing ransomware, fraud, and data theft operations. It enables law enforcement to gather intelligence on hundreds of users and supports ongoing investigations globally. The dismantling reduces the ability of threat actors to conceal their activities via this VPN service. However, no direct impact to software or systems from a vulnerability perspective is indicated.

No patch or software remediation is applicable as this is a law enforcement takedown of a criminal VPN service. Organizations should note the domains 1vpns.com, 1vpns.net, and 1vpns.org as indicators of compromise and block or monitor traffic to these domains. Continued collaboration with law enforcement and sharing of intelligence related to this infrastructure is recommended.