First VPN Service Used by Ransomware Actors to Compromise Systems

The service has been active since approximately 2014 and currently provides 32 exit node servers in 27
countries. At least 25 ransomware groups, such as Avaddon Ransomware, have used First VPN Service
infrastructure to perform network reconnaissance and intrusions.

First VPN Service IP addresses have been used for scanning activity, botnets, denial of service attacks, scams, and hacking. First VPN Service was almost exclusively advertised in known criminal dark web forums such as Exploit[.]in and XSS[.]is, two of the most prominent Russian-language online forums which provide marketplaces for cyber criminals to buy and sell unauthorized access to computer systems, stolen personal identifying information, hacking tools, and contraband.

The release of this report follows the coordinated takedown of the First VPN Service through a joint law
enforcement operation supported by the FBI. This operation was conducted by France’s Direction
Régionale de la Police Judiciaire Brigade de Lutte Contre la Cybercriminalité (BL2C), and the Dutch
National Police, National High Tech Crime Unit (NHTC), with assistance from Ukraine, the United Kingdom,
Switzerland, and Luxembourg.

First VPN Service’s website was accessible at 1vpns[.]com, 1vpns[.]org, and 1vpns[.]net, as well
as an onion service accessible via the Tor Network. First VPN Service also hosted a Jabber server at
1jabber[.]com. As of April 2026, First VPN Service offered a range of pricing options and included
approximately 32 servers, known as “nodes,” in approximately 27 countries for users to choose from.

Some of the subscription options allowed users to select up to four different nodes to increase anonymity
online. There were three US-based exit nodes, 92.223.66[.]103, 5.181.234[.]59, and
92.38.148[.]58. First VPN Service offered subscription durations ranging from one day to one year,
with users paying for the service in cryptocurrency.

Further details – https://www.ic3.gov/CSA/2026/260521.pdf