Operation Saffron: First VPN Dismantled — 33 Servers Seized, Ukrainian Admin Arrested, User Database Captured Exposing 25+ Ransomware Groups Including Avaddon and Phobos

On May 19–20, 2026, French and Dutch authorities executed Operation Saffron, dismantling First VPN — a criminal bulletproof anonymization service operational since 2014 and used by at least 25 ransomware groups including Avaddon and Phobos — seizing 33 servers across 27 countries, shutting down 1vpns.com and related onion domains, and arresting the service's administrator in Ukraine. Critically, investigators had covert access to First VPN's infrastructure prior to the takedown, intercepting live criminal traffic and capturing the full user database of over 5,000 criminal accounts who falsely believed the service kept no logs. The seizure of the user database transforms this from a simple infrastructure disruption into a long-running prosecution engine, and every ransomware group now forced to find replacement infrastructure faces an elevated operational security failure window during transition.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.