The Hague, – A joint investigation by the French and Dutch authorities, supported by Eurojust and Europol, has shut down a large-scale criminal virtual private network (VPN) service. The criminal service, known as First VPN, targeted cybercriminals by offering their services and promising a secure environment to carry out illegal activities such as hacking and ransomware attacks. Thanks to a joint action coordinated at Eurojust on the 19 and 20 May, authorities were able to dismantle critical infrastructure including 33 servers and conduct a search and interview of a suspect in Ukraine.
A VPN is commonly used to create a secure connection between a user’s device and the internet, protecting their network traffic and device location.
The criminal service First VPN allegedly targeted criminals, offering services to conceal their identities and enable cybercrime. Their grasp was far-reaching: according to Europol, the VPN service featured in almost every major cybercrime investigation supported by the Agency. First VPN’s website promoted itself by emphasising anonymity, promising its users that it would not cooperate with any judicial authority, that it would not store data, and that the service would not be subject to any jurisdiction.
Eurojust Support
Eurojust opened a case at the request of the French authorities in May 2022, after the VPN service was found to be advertised on known criminal forums. A joint investigation team was established through Eurojust in November 2023, enabling French and Dutch authorities to work closely together, exchange evidence and information, and decide on a prosecutorial strategy.
During the investigation, more countries became involved which resulted in the execution of several European Investigation Orders (EIOs) and requests for Mutual Legal Assistance (MLAs) facilitated by the national desks and liaison prosecutors stationed at Eurojust. This allowed authorities to gain access to the VPN service before it went offline, obtaining valuable insights and traffic data from users who believed they were conducting their criminal operations in a secure environment. Based on the data and the VPN service’s extensive reach, Eurojust hosted 16 coordination meetings among the involved authorities to prepare for the joint action day taking place this week, underscoring the need for complex judicial cooperation.
An Operational Taskforce was set-up at Europol which brought together investigators from 16 countries to analyse the seized data and coordinate intelligence sharing with international partners.
A coordination centre was set up at Eurojust in order to coordinate and adjust the prosecution strategy of the execution of the measures in the seven countries taking part in the joint action carried out on 19 – 20. May. It resulted in:
- the dismantling of more than 33 servers linked to the criminal service;
- A search and interview of a suspect in Ukraine
- the disruption of critical infrastructure used to support cybercriminal activity worldwide.
The target domain names have been shut down thanks to the joint international law enforcement and judicial cooperation with the following domain names seized:
- Associated onion domains
Users of the criminal service have been notified of the shutdown and informed that they have been identified.
The action day was carried out by the following authorities:
- France: Paris Prosecution Office (J3) and investigative judge Paris; The Court of Paris Cybercrime Unit and the Préfecture de Police Cybercrime Unit (BL2C); Central Office Cybercrime Unit (OFAC)
- Netherlands: National Public Prosecutor’s Office; Team High Tech Crime of the National Investigation Unit
- Luxembourg: District Prosecution Office; Luxembourg Judicial Police
- Romania: Directorate for Investigating Organized Crime and Terrorism; Directorate for Fighting Organized Crime, Romanian Police
- Switzerland: Zurich Public Prosecutor’s Office III; Zurich Cantonal Police,
- Ukraine: Prosecutor General’s Office of Ukraine; Cyber Department of the Security Service of Ukraine (SBU); Main Investigation Department of the National Police of Ukraine; Division for Combating Cyber Security Crimes;
- United Kingdom: National Crime Agency – National Cyber-Crime Unit
