Operation Saffron Dismantles Criminal VPN Used by Ransomware Groups
Operation Saffron, an international law enforcement effort, has successfully dismantled First VPN, a virtual private network service used by at least 25 ransomware groups, including Avaddon and Phobos. The operation, led by French and Dutch authorities with support from Europol and Eurojust, resulted in the seizure of 33 servers and multiple domain takedowns. The VPN, operational since 2014, was marketed on Russian-speaking cybercrime forums and provided anonymization infrastructure for cybercriminals. Authorities arrested the service administrator in Ukraine and obtained user databases and criminal traffic logs, disrupting a critical layer for ransomware and fraud operations. 
