Europol announced Operation Saffron on 21 May 2026, seizing 33 servers across 27 countries that hosted First VPN, a criminal anonymisation service running since 2014 1. At least 25 ransomware gangs used it to mask their operations, including Phobos and Avaddon, and the service's administrator was located in Ukraine 2.
First VPN sat in the plumbing of the ransomware economy rather than on its front line. Gangs route command-and-control traffic and victim communications through services like it to break the link between an attack and an identifiable operator, so seizing the hosting strips a layer of operational cover from every crew that depended on it. For investigators, the 33 servers are also an evidence haul: logs that could expose which gangs connected when.
Saffron follows a now-routine takedown shape. When the FBI and Michigan state Police seized the E-Note exchange in April , they pulled a money-laundering channel out from under ransomware crews without eliminating the operators who used it. Saffron repeats the shape at the anonymisation layer: a shared dependency removed, a temporary friction imposed, but no reduction in the affiliate supply that keeps the monthly attack count flat. Crews migrate to the next bulletproof host, and the displacement buys defenders time rather than relief.
