Operation Saffron Brings Down Criminal VPN
French and Dutch law enforcement agencies, backed by Europol and Eurojust, have dismantled First VPN — a virtual private network service that served as a critical anonymity shield for ransomware gangs, phishing operators, and other cybercriminals. The coordinated takedown, codenamed Operation Saffron, took place between May 19 and 20, 2026, and marks one of the most significant infrastructure-focused cybercrime actions of the year.
First VPN had built a reputation on Russian-speaking cybercrime forums as a go-to service for staying invisible online. It offered anonymous payment options, concealed infrastructure, and purpose-built systems designed to help criminal operators evade law enforcement detection. Over time, the platform became deeply embedded in the operational toolkit of ransomware groups, fraud networks, and data theft campaigns active across multiple countries.
Administrator Arrested, 33 Servers Seized
Ukrainian authorities played a central role in the operation, interviewing the alleged administrator and conducting a house search. In total, 33 servers connected to First VPN’s infrastructure were seized. Multiple domains tied to the service — including 1vpns.com, 1vpns.net, and 1vpns.org — were taken offline, along with associated dark web onion addresses. Users who attempted to visit these domains were met with a seizure notice, along with a warning that investigators had already identified them.
The investigation itself had been running since December 2021, when authorities first began working with Europol’s European Cybercrime Centre to penetrate the service and examine its internal systems. That long-running access eventually led investigators to the platform’s full user database.
Thousands of Users Now Exposed to Investigators
Perhaps the most significant outcome of Operation Saffron is not the infrastructure takedown itself, but the intelligence it generated. Europol confirmed that seized data exposed thousands of users connected to cybercrime activity and produced investigative leads linked to ransomware attacks, online fraud schemes, and other serious offences. Authorities in multiple countries are now reviewing this data to identify suspects and build cases.
Michael Jepson, Head of Penetration Testing at CybaVerse, noted the growing strategic importance of targeting criminal infrastructure rather than only individual threat actors. Speaking on the operation, Jepson stated that services like First VPN function as the operational backbone of many criminal enterprises, enabling attackers to conceal their systems and identities. When such platforms are dismantled and their user data seized, the downstream impact on criminal networks can be far-reaching.
“These operations often contain large amounts of data on thousands of criminals and threat actors, which authorities can leverage for further investigation and prosecution,” Jepson explained.
Part of a Broader Europol Crackdown
Operation Saffron was conducted with the involvement of law enforcement agencies from 16 countries, including France, the Netherlands, Ukraine, the United Kingdom, Luxembourg, Romania, Switzerland, Canada, Germany, and the United States. This level of multinational coordination significantly reduces the delays that typically hamper cross-border cybercrime investigations.
The operation fits into a broader pattern of aggressive Europol-led actions in recent months. In January 2026, 34 suspected members of the Black Axe criminal network were arrested in Spain following an investigation into romance scams and business email fraud. In March, Europol seized LeakBase, a cybercrime forum with over 140,000 members. April saw Operation PowerOFF dismantle DDoS-for-hire platforms, with suspects arrested and warning notices sent to approximately 75,000 users.
For the cybersecurity community, Operation Saffron reinforces a clear message: the infrastructure enabling cybercrime is now firmly in the crosshairs of international law enforcement, and those who rely on such services for cover should expect that anonymity to be short-lived.
