First VPN

First VPN was a criminal anonymisation service marketed as a bulletproof VPN — meaning it was deliberately structured to resist law-enforcement takedown requests and hosted infrastructure across jurisdictions with weak mutual legal assistance cooperation. Active since 2014, First VPN was used as an anonymisation layer by at least 25 ransomware gangs including Phobos and Avaddon, allowing affiliates to mask command-and-control traffic, exfiltration channels and ransom negotiation communications.

On 21 May 2026, Europol announced Operation Saffron had seized 33 servers across 27 countries linked to First VPN's infrastructure. The service's administrator was located in Ukraine. The seizure removed a shared operational asset from the criminal ecosystem but did not arrest the administrator or directly disrupt the ransomware groups that used it; those groups were expected to migrate to alternative anonymisation services.

Bulletproof VPN services occupy a critical enabling role in the ransomware-as-a-service (RaaS) economy: they provide affiliates with a layer of operational security that separates criminal activity from attributable internet identifiers. First VPN's 12-year operational lifespan reflects the difficulty of dismantling infrastructure spread across multiple jurisdictions. Law enforcement's pattern across Operation Saffron, the E-Note exchange seizure and the Scattered Spider arrest is consistent: infrastructure and services are taken off the board, but affiliate supply — the human pool carrying out attacks — is not meaningfully reduced, and tempo holds as attackers reconstitute around remaining tooling.