NewsPublished 22 May 2026

‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested

Source SecurityWeek

Description

The FBI says First VPN has been used by dozens of ransomware groups for network reconnaissance and intrusions. The post ‘First VPN’ Cybercrime Service Disrupted, Administrator Arrested appeared first on SecurityWeek .

Impact

First VPN facilitated malicious cyber activities including network reconnaissance, botnets, scanning, DoS attacks, and intrusions by ransomware groups and other cybercriminals. Its disruption and the arrest of its administrator significantly degrade the operational capabilities of multiple ransomware groups and other cybercrime actors who relied on the service for anonymity and infrastructure. The takedown also enables law enforcement to identify and potentially prosecute users involved in various cybercrime operations. This operation increases the risk and operational cost for cybercriminals using similar anonymization services.

Defensive guidance

The First VPN service has been disrupted and its administrator arrested, effectively shutting down the infrastructure supporting its criminal activities. Law enforcement has notified users and shared information on identified individuals involved in cybercrime. Organizations should review the FBI alert and associated indicators of compromise to detect any related activity in their environments. No direct patch or fix is applicable since this is a service disruption rather than a software vulnerability. Continued monitoring for new anonymization services and threat actor adaptations is recommended.

References

securityweek.com/first-vpn-cybercrime-service-disrupted-administrator-arrested/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 May 2026, 09:29 UTC

References

Community reviews