Europol has shut down a VPN service that provided anonymity to approximately two dozen ransomware groups. The agency notified identified users they have been exposed.
European law enforcement authorities have successfully dismantled a VPN service that functioned as a critical infrastructure for ransomware operations across multiple criminal organizations.
The unnamed VPN marketed itself to hackers with promises of complete anonymity for conducting cyberattacks. Despite these assurances, Europol penetrated the service's operations and gathered intelligence on its user base.
According to the enforcement action, around two dozen ransomware gangs relied on the platform to mask their identities and coordinate attacks. The service represented a significant chokepoint in the ransomware ecosystem, suggesting its removal could disrupt multiple criminal networks simultaneously.
In a notable development, Europol notified the identified users—including operators from active ransomware gangs—that their identities have been compromised. This notification serves both as a tactical move to pressure offenders and as a message that anonymizing services cannot guarantee protection against determined law enforcement.
The operation highlights an ongoing strategy by European authorities to target the infrastructure supporting ransomware operations rather than pursuing individual attacks. By dismantling shared tools and services, law enforcement aims to increase operational costs and friction for criminal groups.
Ransomware has become one of the most damaging forms of cybercrime, generating billions in ransom payments annually while affecting hospitals, government agencies, and businesses worldwide. Recent enforcement actions have focused on disrupting payment channels, cryptocurrency exchanges, and now the anonymization services that enable these operations.
The VPN shutdown follows other recent successes including the takedown of major darknet marketplaces and the disruption of ransomware payment infrastructure. However, security experts note that determined cybercriminals typically adapt by migrating to alternative anonymization methods or developing new tools.
U.S. federal prosecutors have unsealed charges against three Russian nationals accused of operating a bulletproof hosting service that supported ransomware gangs responsible for over $62 million in damages worldwide.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that attackers are actively exploiting three vulnerabilities in Internet-exposed on-premises SharePoint Server instances. Organizations running affected versions must patch immediately.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.