Operation Saffron

Operation Saffron was the joint French and Dutch case against First VPN, an anonymisation service sold to criminals. Investigators opened it in December 2021, and 18 countries were eventually involved, 16 of them in a dedicated taskforce, with Europol and Eurojust in support. During two days of raids, 19 and 20 May 2026, officers dismantled 33 servers and police in Ukraine searched and questioned the service's administrator.

According to the Paris prosecutor, First VPN had operated since 2014, held more than 5,000 accounts and yielded evidence for ransomware investigations such as Phobos. Europol reported sharing intelligence on 506 users with partner countries. Neither Europol nor Eurojust named a ransomware gang among the customers.

Public trackers show no fall in ransomware volume after Saffron. BlackFog recorded 95 disclosed attacks in May and 102 in June, when a newly emerged group called 2019 led the count. Bitdefender reported in June that MedusaLocker, rebranded as Bavacai, had entered the top ten after the takedown.