How the Takedown Unfolded
Law enforcement agencies from seven countries collaborated on May 19 and 20, 2026, to dismantle First VPN, a virtual private network service that catered specifically to cybercriminals. The operation, called Operation Saffron, was spearheaded by French and Dutch authorities with backing from Europol and Eurojust. Investigators seized 33 servers, took down multiple domains including 1vpns.com and 1vpns.net, and identified thousands of users who relied on the service for illegal activities. The case began when Eurojust opened a file in May 2022 after French authorities spotted the service on underground forums. A joint investigation team was formally established in November 2023, allowing investigators to share intelligence and coordinate prosecutorial strategies. Crucially, authorities gained covert access to First VPN’s infrastructure before shutting it down, allowing them to intercept live criminal traffic from users who believed their communications were fully encrypted.
Impact and Scope
First VPN was not an ordinary privacy tool. It explicitly marketed itself on Russian-speaking cybercrime forums, promising users that it would not cooperate with judicial authorities, would store no logs, and would evade any legal jurisdiction. These claims proved false as investigators demonstrated they could monitor the service. According to Europol, First VPN appeared in nearly every major cybercrime investigation the agency supported. The service facilitated ransomware attacks, computer system intrusions, fraud schemes, and account compromises globally by providing anonymous payment options and hidden infrastructure designed to evade detection. The coordinated effort included multiple European Investigation Orders and Mutual Legal Assistance requests, demonstrating how international cooperation can dismantle tools that enable widespread cybercrime.
Source: Cyber Security News
