International law enforcement operation dismantles First VPN

An international operation led by France and the Netherlands has dismantled the VPN service First VPN. The service had been heavily used by cybercriminals for years and featured in the majority of cybercrime cases Europol has investigated in recent years.

The operation resulted in the arrest of the administrator and the takedown of 33 servers.

What this means for your business

Operations like this remove infrastructure that ransomware actors rely on to hide, but they do not remove the motive. Experience suggests actors migrate to other services within weeks. The value for organisations lies elsewhere: law enforcement gains seized material that can link past incidents to named actors. That makes reporting incidents and preserving evidence more worthwhile, including in cases the organisation itself considers closed.

Berigo recommends

• Report cyber attacks to the police even when the odds of resolution look low, and do it early.
• Preserve logs and evidence before recovery begins, with a fixed procedure for who does what.
• Define in your incident plan who handles police contact and what may be shared.
• Retain logs long enough that they still hold value in an investigation starting months later.

Source

• europol.europa.eu