Counterintelligence & Tradecraft — 2026-05-22

International Law Enforcement Seizes First VPN Service Used by 25 Ransomware Gangs in Operation Saffron

BLUFBeyond the servers seized this week, the operation's true payoff lies in the 506 identified users, with at least one public arrest from the distributed intelligence packages likely by May 2027.

French and Dutch authorities, supported by Europol and Eurojust, ran Operation Saffron on May 19 and 20, seizing 33 servers, shutting down First VPN's domains, and arresting the service's administrator in Ukraine 12. The FBI stated that at least 25 ransomware gangs used the service, which had operated since approximately 2014 across servers in 27 countries and advertised on cybercriminal forums including Exploit.in and XSS.is 1. Europol reported that investigators obtained First VPN's full user database, encompassing over 5,000 accounts, and distributed 83 intelligence packages covering 506 prioritized users to partner countries, with leads including cases tied to the Phobos RaaS group 34. Dutch police and Europol stated that all users received notifications informing them the service was offline and that they had been identified 14.

Analysis
The 506 prioritized users now in partner-country investigative files are the operation's durable pressure point, and at least one public arrest drawn from the 83 distributed intelligence packages is likely by May 2027. Moderate confidence rests on Europol's established pattern of converting such packages into partner-country arrests, though timelines depend on jurisdictions whose investigative capacity and prosecutorial priorities remain partially opaque. The Europol press release is the single primary source, with secondary outlets providing no independent corroboration. The Phobos RaaS connection elevates triage priority for partners already running active ransomware cases. Countries receiving packages may instead prioritize ongoing undercover operations over public prosecutions, suppressing the public-arrest signal even as intelligence drives covert disruption. A YES resolution hands justice ministries concrete justification for expanded VPN-infrastructure targeting; a NO resolution turns the intelligence-to-prosecution conversion rate into a budget objection.

4 sources

Law enforcement shuts down VPN service used by two dozen ransomware gangs - TechCrunch
'First VPN' service used by cybercriminals dismantled in international operation - SC World
Cybercriminal VPN used by ransomware actors dismantled in global crackdown - Europol
Authorities dismantle First VPN, used by ransomware actors - Help Net Security