EU authorities start seizing VPN services

[alani123]

It hit the news recently that EU authorities have begun major operations against VPN services.
A couple of days ago a VPN service called first VPN was seized electronically in an operation where multiple state authorities from all over Europe collaborated:
https://www.securityweek.com/first-vpn-cybercrime-service-disrupted-administrator-arrested/
https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown

Now today we have need of another seizure, this time with server seizures and arrests:




It seems like the EU is doing it's best to play hardball with VPNs, especially those not having KYC or bank payments as their primary payment method.


Be careful out there. I'm not sure how this could be mitigated from an opsec perspective. Maybe we need a decentralised VPN network.

[OmegaStarScream]

-snip-

Be careful out there. I'm not sure how this could be mitigated from an opsec perspective. Maybe we need a decentralised VPN network.

We already do, most popular one probably being nym: https://nym.com/

There are a couple of other ones, although I have not tried them and I'm not sure how good they are (in terms of privacy and decentralization) or how do they compare to each other.

[Upgrade00]

NYM VPN is the top choice if you're looking for open source and decentralized options. I discovered then last year and would recommend.

Mullvad is also a good option and they allow you mail in cash payments for those who wants extra privacy.

[TryNinja]

NYM VPN is the top choice if you're looking for open source and decentralized options. I discovered then last year and would recommend.

Besides, it literally costs $28,68 for 2 years if paid with their coin $NYM (which you can just buy and send to the checkout address).

$1,20 per month for a VPN.

[Z-tight]

It seems like the EU is doing it's best to play hardball with VPNs, especially those not having KYC or bank payments as their primary payment method.

Yeah, any service that facilitates privacy is a target, they would accuse them of money laundering or aiding criminals to perpetrate their crime. Surely, it cannot be only criminals who use these services, right? But that counts for nothing i guess and as long as it has a single point of failure, there is a chance they would eventually take it down.

[CreepyUncleJoe]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

[rat03gopoh]

According to the news, FirstVPN had previously been flagged for deliberately serving cybercrime for years. So I think your headline is a bit hyperbolic. This wasn't an operation against global VPN services.

For years, the service, known as "First VPN," was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

And also added that DoubleVPN was shut down in 2021. www.secnews.gr/en/358169/doublevpn-arxes-ekleisan-vpn-ipiresia-xrisimopoiountan-apo-egklimaties/

[Free Market Capitalist]

According to the news, FirstVPN had previously been flagged for deliberately serving cybercrime for years. So I think your headline is a bit hyperbolic. This wasn't an operation against global VPN services.

For years, the service, known as "First VPN," was promoted on Russian-speaking cybercrime forums as a trusted tool for remaining beyond the reach of law enforcement.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

And also added that DoubleVPN was shut down in 2021. www.secnews.gr/en/358169/doublevpn-arxes-ekleisan-vpn-ipiresia-xrisimopoiountan-apo-egklimaties/

Thanks for that. I found that OP's FUD strange, given that the EU has no laws against VPNs:

There is currently no legislation in the European Union that bans or criminalizes the use of Virtual Private Networks (VPNs). VPNs are entirely legal to use across all EU member states for online privacy, secure browsing, and accessing remote corporate networks.

However, while the technology itself is legal, EU regulators are heavily scrutinizing VPNs in two specific contexts:

Online Age Verification: As the EU tightens child protection frameworks under the Digital Services Act, some policymakers are viewing VPNs as a "loophole" that minors can use to bypass parental controls and age-verification sites. While total VPN bans are not on the table, the EU is debating how to make age-verification systems harder to bypass.

Anti-Piracy Enforcement: Localized legal actions have targeted VPNs in specific copyright battles. For example, a court in Spain ordered major VPN providers to block IP addresses linked to illegal streaming of football matches, marking a shift where privacy tools are being pressured to assist in content controls.Because VPNs are treated as standard privacy infrastructure, they remain fully protected by EU privacy frameworks, including the General Data Protection Regulation (GDPR).

The quote comes from Gemini AI after doing a Google search.

[alani123]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

The EU claims to have had some of these VPN services on their watchlist for a good while and acted only now.

Is it coincidence that there is now talk to ban VPNs too? Probably not. They're trying to create a false image that VPN use is dangerous for the general public and has nothing to offer.
Why else wouldn't they target these supposedly criminal operations earlier?

[Yamane_Keto]

If law enforcement agencies obtain the logs and all the IP addresses of subscribers who used the service's servers, then the privacy service is what caused their privacy to be exposed.

We already do, most popular one probably being nym: https://nym.com/

My subscription ends next month, I will give them a try.

[Lucius]

As far as I'm concerned, they (the EU) can ban every VPN that exists for any crazy reason they can think of, but if they think that's going to achieve anything, they're sorely mistaken. Real criminals use Tor and various other much more sophisticated methods to conceal their identity, not VPNs, whose security is actually at a very low level.

When I just remember that years ago they started withdrawing EUR 500 banknotes because they were allegedly used by criminals, I wonder what is in the minds of these people - Switzerland has banknotes of 1000 francs, which is worth approximately the same as the euro, and they have no problems with criminals and terrorists.

[TryNinja]

This isn’t really the EU going after regular VPNs in general. The service was mainly being advertised on cybercrime forums and marketed toward ransomware actors and other criminal groups.

Also not the first time this has happened. Back in 2022 they shut down VPNLab for pretty much the same reasons.

Still, that's weird.

We all know cybercriminals and ransomware actors use all kinds of "regular" VPNs, like Mullvad or ProvonVPN. Is it only a crime if they are actively marketing themselves as "criminals-friendly"?

[ingiltere]

I haven't used Nym but I know Mullvad is very popular. Unfortunately a VPN has become a necessity for people living in countries like mine. Because when you try to access the internet normally, half the websites don't even load. The government has arbitrarily blocked everything.
It's not good that the EU is taking this approach. It seems they're becoming more authoritarian as well. It's up to people to decide why they use a VPN. If there's a crime involved, they should investigate it and punish the culprit. Not everyone who uses that service.

[CreepyUncleJoe]

Still, that's weird.

We all know cybercriminals and ransomware actors use all kinds of "regular" VPNs, like Mullvad or ProvonVPN. Is it only a crime if they are actively marketing themselves as "criminals-friendly"?

Yeah, that’s basically the legal distinction.

Samourai Wallet devs made a similar mistake when they publicly posted stuff like “welcome Russian oligarchs.” That kind of marketing makes it way easier for authorities to argue you’re knowingly catering to sanctions evasion or criminal activity, instead of just providing neutral privacy tools.

[rat03gopoh]

Why else wouldn't they target these supposedly criminal operations earlier?

I don't know the exact reason; I assume the surveillance duration determines how much evidence they can gather. Or more importantly, they actually want to uncover a larger criminal network that's still using this service.