Europol Shuts Down VPNLab, Cybercriminals’ Favourite VPN Service

VPNLab.net, a VPN provider^[1]
that was used by malicious actors to deploy ransomware and
facilitate other cybercrimes, was taken offline following a
coordinated law enforcement operation.

Europol said it took action against the misuse of the VPN
service by grounding 15 of its servers on January 17 and rendering
it inoperable as part of a disruptive action that took place across
Germany, the Netherlands, Canada, the Czech Republic, France,
Hungary, Latvia, Ukraine, the U.S., and the U.K.

A second outcome of the seizure is that at least 100 businesses
that have been identified as at risk of impending cyber attacks are
being notified. Europol didn’t disclose the names of the
companies.

Established in 2008, the tool provided an advanced level of
anonymity by offering double VPN connections to its clients —
wherein the internet traffic is routed through two VPN servers
located in different countries instead of one — for as cheap as $60
a year.

“This made VPNLab.net a popular choice for cybercriminals, who
could use its services to carry on committing their crimes without
fear of detection by authorities,” Europol detailed^[2]
in a press release, adding it “provided a platform for the
anonymous commission of high value cybercrime cases, and was
involved in several major international cyberattacks.”

VPNLab.net is said to have caught the attention of law
enforcement officials when its infrastructure began to be widely
used to disseminate malware, with the investigators uncovering
evidence of the illicit service being advertised on the dark
web.

In a separate announcement, Ukraine’s Cyber Police said^[3]
the VPN service was used in more than 150 ransomware infections,
causing the victims to shell out a total of €60 million in ransom
payments.

The dismantling of VPNLab.net is the latest action taken by
authorities to close in on VPN providers with proven links to
criminal groups. In December 2020, bulletproof VPN service Safe-Inet^[4]
was shut down and this was followed by the takedown of DoubleVPN^[5]
in June 2021.

“The actions carried out under this investigation make clear
that criminals are running out of ways to hide their tracks
online,” Edvardas Šileris, head of Europol’s European Cybercrime
Centre (EC3), said. “Each investigation we undertake informs the
next, and the information gained on potential victims means we may
have pre-empted several serious cyberattacks and data
breaches.”