Three VPNs popular with criminals and active for over a decade have had their servers and web domains seized by law enforcement from US, Germany, France, others
The three VPN services provided safe haven for cybercriminals to carry out ransomware attacks, web skimming operations, spearphishing, and account takeovers.
Context & Ripple Effects
This seizure is an early instance of what became a recurring playbook: rather than chasing individual operators, multi-country police action takes down the shared infrastructure criminals rent. The same template reappears three years later when the FBI and five allied nations seized ransomware gang ALPHV's dark web leak site.
It also lands inside a broader legitimacy fight over VPNs themselves. Hollywood's legal campaign had already widened beyond piracy to allege that providers like ExpressVPN enable hacking and worse ([[a:978440]]), while consumer trust in the category was dented by reporting that many popular VPNs sit under owners like Kape Technologies, which also runs review sites ([[a:971576]]). The counterweight: Washington was simultaneously pouring roughly 50% more funding into circumvention VPNs nthLink, Psiphon, and Lantern for Russian users ([[a:979928]]) — the same tool class is both geopolitical asset and criminal haven depending on who operates it.
First-order effects
- Criminal customers of the three services lose their anonymity layer overnight — active ransomware, web skimming, spearphishing, and account-takeover operations built on those servers are exposed or cut off.
- Seized servers put more than a decade of connection logs and payment records into investigators' hands, turning past subscribers of all three services into identifiable suspects.
Second-order effects
- Legitimate VPN providers face pressure to demonstrate abuse controls and verifiable no-logging practices, because prosecutors and litigants like Hollywood's now treat the whole category as enabling crime rather than just piracy.
- Ransomware crews accelerate migration toward self-hosted or decentralized infrastructure, raising the cost of the next takedown and pushing law enforcement toward targeting payment rails and affiliates instead.
Third-order effects
- If the pattern holds, VPNs split structurally into two markets: state-funded circumvention tools treated as foreign-policy instruments, and commercial providers operating under seizure-and-litigation risk — with jurisdiction shopping becoming a core business decision.
- Infrastructure-level takedowns by multinational coalitions become the default model against cybercrime, shifting the burden from victim response to supply-chain disruption across hosting, domains, and anonymization layers.
The trend: Law enforcement is moving up the cybercrime stack from prosecuting individuals to seizing the shared infrastructure — VPNs, leak sites, hosting — that criminal ecosystems rent.