What Happened
Law enforcement agencies across Europe and North America have dismantled a virtual private network service that was actively marketed to cybercriminals on Russian language forums. Codenamed Operation Saffron, the coordinated effort was led by authorities in France and the Netherlands with support from over a dozen other nations including the United States, Canada, and the United Kingdom. The VPN service, known as First VPN, was advertised on underground forums as a tool to evade law enforcement and avoid data retention.
Impact and Scope
Between May 19 and 20, investigators conducted a house search in Ukraine, interviewed the service’s administrator, seized 33 servers, and took down the infrastructure supporting criminal activity worldwide. The VPN had been used by at least 25 ransomware groups to hide their identities while launching attacks, conducting data theft, scanning systems, and executing denial of service campaigns. Europol confirmed that users of the service have been notified of the shutdown and warned that their identities are now known to authorities. Cybersecurity firm Bitdefender supported the investigation by sharing intelligence on 506 users, noting that while new anonymization services will inevitably emerge, each takedown disrupts the criminal ecosystem and raises operational costs for attackers.
Source: The Hacker News
