Signal
Authorities dismantle First VPN service used by ransomware actors
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-05-21 13:09 UTCUpdated 2026-05-21 16:05 UTC
rss
vpnransomwarelaw_enforcementeuropolcybercrime
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
European law enforcement agencies have taken down First VPN, a virtual private network service widely used by cybercriminals for ransomware, data theft, and fraud. The operation, named Operation Saffron, involved French and Dutch authorities with support from Europol, Eurojust, and eight other countries.
Entities
First VPNOperation SaffronEdvardas Šileris
Score total
1.67
Momentum 24h
5
Posts
5
Origins
5
Source types
1
Duplicate ratio
0%
Why now
- Operation Saffron was executed recently, reflecting ongoing efforts to combat ransomware.
- First VPN was implicated in nearly every major recent Europol cybercrime investigation.
- The arrest of the operator and server seizures mark a significant disruption to cybercriminal networks.
Why it matters
- Removing First VPN disrupts a key anonymity tool for ransomware and cybercriminals.
- The takedown demonstrates effective international cooperation against cybercrime infrastructure.
- It sets a precedent for targeting services that facilitate criminal operations online.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- First VPN was widely used by ransomware actors and other cybercriminals to hide their identities and infrastructure.
- Operation Saffron involved multiple countries and law enforcement agencies, including Europol and Eurojust, resulting in the seizure of servers and arrest of the operator.
How sources frame it
- Europol: neutral
All evidence
All evidence
European authorities take down prolific cybercrime VPN service
CyberScoop · cyberscoop.com · 2026-05-21 16:05 UTC
Cybercriminal VPN Dismantled in Europol Crackdown
Infosecurity Magazine · infosecurity-magazine.com · 2026-05-21 15:30 UTC
Police op targets VPN service favoured by ransomware gangs
ComputerWeekly IT Security · computerweekly.com · 2026-05-21 14:36 UTC
Authorities dismantle First VPN, used by ransomware actors
Help Net Security · helpnetsecurity.com · 2026-05-21 14:03 UTC
Police seize “First VPN” service used in ransomware, data theft attacks
BleepingComputer · bleepingcomputer.com · 2026-05-21 13:09 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 5Origin domains: 5Duplicates: -
Showing 5 / 0
Top publishers (this list)
- CyberScoop (1)
- Infosecurity Magazine (1)
- ComputerWeekly IT Security (1)
- Help Net Security (1)
- BleepingComputer (1)
Top origin domains (this list)
- cyberscoop.com (1)
- infosecurity-magazine.com (1)
- computerweekly.com (1)
- helpnetsecurity.com (1)
- bleepingcomputer.com (1)