In a significant international law enforcement operation, authorities from seven countries have successfully dismantled First VPN, a virtual private network service exploited by cybercriminals worldwide. The coordinated effort, known as Operation Saffron, took place on May 19 and 20, 2026, and was spearheaded by French and Dutch authorities, with support from Europol and Eurojust. This operation led to the seizure of 33 servers, the shutdown of multiple domains, and the identification of thousands of users engaged in illicit activities.
The Role of First VPN in Cybercrime
Unlike legitimate VPN services designed to protect user privacy, First VPN specifically catered to the criminal underworld. Operating through domains such as 1vpns.com, 1vpns.net, and 1vpns.org, the service advertised on underground and Russian-speaking cybercrime forums. It falsely claimed to operate beyond any jurisdiction, not to store user data, and to refuse cooperation with judicial authorities. These assurances attracted cybercriminals seeking anonymity for activities including ransomware attacks, system hacking, fraud schemes, and account compromises.
The Investigation and Takedown
The investigation into First VPN began in May 2022 when French authorities identified the service on known criminal forums. Eurojust opened a formal case, leading to the establishment of a Joint Investigation Team (JIT) in November 2023. This collaboration allowed French and Dutch investigators to share evidence and coordinate prosecutorial strategies. As the investigation expanded, additional countries joined, resulting in multiple European Investigation Orders (EIOs) and Mutual Legal Assistance (MLA) requests.
A critical breakthrough occurred when investigators gained covert access to First VPN’s infrastructure before it went offline. This access enabled them to intercept live criminal traffic from users who believed their activities were encrypted and anonymous. An Operational Taskforce (OTF) at Europol analyzed the seized data, producing 83 intelligence packages shared with ongoing international investigations and identifying 506 specific users whose data was distributed to partner agencies worldwide.
Outcomes of Operation Saffron
The joint action on May 19–20, 2026, yielded significant results:
– Seizure and dismantling of 33 servers across 27 countries.
– Shutdown of domains 1vpns.com, 1vpns.net, 1vpns.org, and associated onion sites.
– Questioning of a suspect, identified as First VPN’s administrator, in Ukraine at the request of French authorities.
– Public identification and online posting of 65 IP addresses associated with the service.
– Formal notification to all identified users about the shutdown and their flagging in connection with criminal activities.
International Collaboration
Operation Saffron exemplifies the effectiveness of international collaboration in combating cybercrime. Participating jurisdictions included France, the Netherlands, Luxembourg, Romania, Switzerland, Ukraine, and the United Kingdom, with additional support from Europol and Eurojust. This coordinated effort underscores the global commitment to dismantling infrastructures that facilitate cybercriminal activities.
Implications for Cybersecurity
The takedown of First VPN sends a clear message to cybercriminals that law enforcement agencies are increasingly capable of penetrating and dismantling services designed to provide anonymity for illegal activities. It also highlights the importance of vigilance among legitimate VPN providers to ensure their services are not exploited for criminal purposes.
Conclusion
The successful dismantling of First VPN marks a significant victory in the ongoing battle against cybercrime. It demonstrates the power of international cooperation and the commitment of law enforcement agencies to disrupt and dismantle networks that facilitate illegal activities. As cybercriminals continue to seek new methods to evade detection, such collaborative efforts will be crucial in maintaining cybersecurity and protecting global digital infrastructure.
