Europol announced Operation Saffron on 21 May 2026: French and Dutch authorities, with Europol and Eurojust support, dismantled 33 servers behind First VPN, a criminal anonymisation service, during action days on 19 and 20 May1. The Paris prosecutor said the service had run since 2014 for more than 5,000 accounts and yielded evidence for ransomware cases including Phobos, and the administrator was searched and interviewed in Ukraine2.
First VPN sat in the plumbing of the ransomware economy rather than on its front line. Gangs route command-and-control traffic and victim communications through services like it to break the link between an attack and an identifiable operator, so seizing the hosting strips a layer of operational cover from every crew that depended on it. For investigators, the 33 servers are also an evidence haul: logs that could expose which gangs connected when.
Saffron follows a now-routine takedown shape. When the FBI and Michigan State Police seized the E-Note exchange in April, they pulled a money-laundering channel out from under ransomware crews without eliminating the operators who used it. Saffron repeats the shape at the anonymisation layer: a shared dependency removed, a temporary friction imposed, but no reduction in the affiliate supply that keeps the monthly attack count flat. Crews migrate to the next bulletproof host, and the displacement buys defenders time rather than relief.
