Europol Takes Down VPN Used by Ransomware Threat Actors

An underground VPN service used by hackers and ransomware groups to cover their tracks was taken down in a joint operation spearheaded by the Dutch police, assisted by a number of international authorities including Europol and the FBI. The VPN in question was called DoubleVPN and was advertised frequently on dark web forums frequented by hackers.

DoubleVPN servers have been seized by the authorities and the domains used by the VPN have been taken down, with police going over logs and account information. The VPN service was used by hackers and ransomware threat actors to hide their tracks and cover up their illegal activities, the Europol report states, citing DoubleVPN used to offer up to quadruple VPN connections to its users, while the cheapest packages available started at 25 US dollars or about 22 Euros.

The focus of the operation is first and foremost disabling any ransomware groups and threat actors who have been using the VPN service to mask their activities, and secondly - to potentially track those threat actors down using the logs and customer information collected by DoubleVPN.

VPN services are popular with legitimate users as well as threat actors, as they allow a high degree of anonymity and make tracking a user particularly difficult. Statistics published in 2021 show that just under a third of all computer users still do not use a VPN, either in their personal life or for business.

The operation was a long, coordinated effort and included dozens of meetings and discussions before the final blow was struck this week, in late June.

Assuming DoubleVPN was indeed as heavily used as evidence suggests and that many threat actors were among its customers, this takedown might have lasting implications. Police and international authorities being able to access logs and customer information, looking to pinpoint what they called threat actors who were "facilitating large-scale cybercrime operations", could potentially be a big victory against hackers and ransomware in particular.

Of course, it won't be long before threat actors who manage to dodge this blow will find a new service and a new provider of similar services, but in a world where we are starting to get used to major ransomware attacks that cost millions and often cripple entire industries taking place on a weekly basis, you have to take what you get.