FBI Warns ‘First VPN Service’ Used by Ransomware Gangs for Cyberattacks

Europol said the service has been featured in ‘almost every major cybercrime investigation’ supported by the agency in recent years.

The J. Edgar Hoover FBI building in Washington on March 11, 2026. Madalina Kilroy/The Epoch Times

The FBI issued an alert on Thursday, warning consumers that a virtual private network (VPN) provider called “First VPN Service” was being used by malicious actors to carry out hacking attacks

“The service has been active since approximately 2014 and currently provides 32 exit node servers in 27 countries. At least 25 ransomware groups, such as Avaddon Ransomware, have used First VPN Service infrastructure to perform network reconnaissance and intrusions. First VPN Service IP addresses have been used for scanning activity, botnets, denial of service attacks, scams, and hacking,” the May 21 FBI alert said.