:

LAW ENFORCEMENT DISMANTLES VPN USED BY 24 RANSOMWARE GANGS

SECURITY DESK2 MIN READ
THU, MAY 21, 2026

■ AI-SUMMARIZED FROM 1 SOURCE ▸ TIMELINE

Europol has shut down a VPN service that provided anonymity to approximately two dozen ransomware groups. The agency notified identified users they have been exposed.

European law enforcement authorities have successfully dismantled a VPN service that functioned as a critical infrastructure for ransomware operations across multiple criminal organizations. The unnamed VPN marketed itself to hackers with promises of complete anonymity for conducting cyberattacks. Despite these assurances, Europol penetrated the service's operations and gathered intelligence on its user base. According to the enforcement action, around two dozen ransomware gangs relied on the platform to mask their identities and coordinate attacks. The service represented a significant chokepoint in the ransomware ecosystem, suggesting its removal could disrupt multiple criminal networks simultaneously. In a notable development, Europol notified the identified users—including operators from active ransomware gangs—that their identities have been compromised. This notification serves both as a tactical move to pressure offenders and as a message that anonymizing services cannot guarantee protection against determined law enforcement. The operation highlights an ongoing strategy by European authorities to target the infrastructure supporting ransomware operations rather than pursuing individual attacks. By dismantling shared tools and services, law enforcement aims to increase operational costs and friction for criminal groups. Ransomware has become one of the most damaging forms of cybercrime, generating billions in ransom payments annually while affecting hospitals, government agencies, and businesses worldwide. Recent enforcement actions have focused on disrupting payment channels, cryptocurrency exchanges, and now the anonymization services that enable these operations. The VPN shutdown follows other recent successes including the takedown of major darknet marketplaces and the disruption of ransomware payment infrastructure. However, security experts note that determined cybercriminals typically adapt by migrating to alternative anonymization methods or developing new tools.

■ SOURCES

TechCrunch

■ SUMMARY WRITTEN BY AI FROM THE LINKS ABOVE

■ MORE FROM THE SECURITY DESK

Cybercriminals have transformed DDoS attacks into a polished, commercialized service complete with pricing tiers, customer support, and reseller programs. The DDoS-as-a-Service market has evolved from basic tools into sophisticated attack platforms.

6H AGOIndustry Desk

Microsoft faced backlash after threatening a security researcher with criminal investigation, reigniting debate over software vulnerability disclosure practices and corporate responsibility.

6H AGOSecurity Desk

Google is deploying Device Bound Session Credentials (DBSC) to all Chrome users, a security feature designed to prevent account takeovers by protecting session cookies from theft.

6H AGOIndustry Desk

Dutch authorities have dismantled a major botnet comprising 17 million infected devices and seized over 200 servers hosting the operation at a local provider.

6H AGOSecurity Desk

■ SUBSCRIBE TO THE DAILY BRIEF

ONE EMAIL, 5 STORIES, 06:00 UTC. UNSUBSCRIBE ANYTIME.