First VPN was a cybercrime anonymization service active since 2014, offering 32 exit nodes across 27 countries. It was advertised on Russian-language dark web forums and used by at least 25 ransomware groups for network reconnaissance and intrusions. The FBI and Europol coordinated a law enforcement operation that dismantled 33 servers linked to First VPN and disrupted its infrastructure, including multiple domain names and onion sites. The alleged administrator was arrested in Ukraine. The FBI published technical details, indicators of compromise, and MITRE ATT&CK mappings related to the service. Users of the service were notified of the shutdown and identification efforts, with 506 users' information shared internationally for further investigation. The disruption impacts cybercriminal anonymization capabilities and raises the risk for actors relying on such turnkey services.

First VPN facilitated malicious cyber activities including network reconnaissance, botnets, scanning, DoS attacks, and intrusions by ransomware groups and other cybercriminals. Its disruption and the arrest of its administrator significantly degrade the operational capabilities of multiple ransomware groups and other cybercrime actors who relied on the service for anonymity and infrastructure. The takedown also enables law enforcement to identify and potentially prosecute users involved in various cybercrime operations. This operation increases the risk and operational cost for cybercriminals using similar anonymization services.

The First VPN service has been disrupted and its administrator arrested, effectively shutting down the infrastructure supporting its criminal activities. Law enforcement has notified users and shared information on identified individuals involved in cybercrime. Organizations should review the FBI alert and associated indicators of compromise to detect any related activity in their environments. No direct patch or fix is applicable since this is a service disruption rather than a software vulnerability. Continued monitoring for new anonymization services and threat actor adaptations is recommended.