Pierluigi Paganini December 22, 2020

A joint operation conducted by law European enforcement agencies resulted in the seizure of the infrastructure of three bulletproof VPN services.

A joint operation conducted by law enforcement agencies from the US, Germany, France, Switzerland, and the Netherlands resulted in the seizure of the infrastructure used by three VPN bulletproof services.

VPN bulletproof services are widely adopted by cybercrime organizations to carry out malicious activities, including ransomware and malware attacks, e-skimming breaches, spear-phishing campaigns, and account takeovers.

“The virtual private network (VPN) Safe-Inet used by the world’s foremost cybercriminals has been taken down yesterday in a coordinated law enforcement action led by the German Reutlingen Police Headquarters together with Europol and law enforcement agencies from around the world.” reads the press release published by the Europol.

“The Safe-Inet service was shut down and its infrastructure seized in Germany, the Netherlands, Switzerland, France and the United States. The servers were taken down, and a splash page prepared by Europol was put up online after the domain seizures.”

The three VPN bulletproof services were hosted at insorg.org, safe-inet.com, and safe-inet.net, their home page currently displays a law enforcement banner.

The takedown of the VPN is part of an international takedown of a virtual private network (VPN), dubbed “Operation Nova.” 

“The coordinated effort was led by the German Reutlingen Police Headquarters together with Europol, the FBI and other law enforcement agencies from around the world.” reads the press release published by DoJ.

“The investigation revealed that three domains— INSORG.ORG; SAFE-INET.COM; SAFE-INET.NET.—offered “bulletproof hosting services” to website visitors.  A “bulletproof hosting service” is an online service provided by an individual or an organization that is intentionally designed to provide web hosting or VPN services for criminal activity.  These services are designed to facilitate uninterrupted online criminal activities and to allow customers to operate while evading detections by law enforcement.  Many of these services are advertised on online forums dedicated to discussing criminal activity.  A bulletproof hoster’s activities may include ignoring or fabricating excuses in response to abuse complaints made by their customer’s victims; moving their customer accounts and/or data from one IP address, server, or country to another to help them evade detection; and not maintaining logs (so that none are available for review by law enforcement).”

The three services were advertised on both Russian and English-speaking cybercrime forums. The services were offered for prices ranging from $1.3/day to $190/year.

According to the investigators, the three VPN bulletproof services are operated by the same threat actor and are active since at least 2010.

The VPN service shut down by law enforcement was used by crooks to avoid law enforcement interception, leveraging on up to 5 layers of anonymous VPN connections.

The law enforcement agencies identified roughly 250 companies worldwide that were being targeted by the criminals using this VPN service.

“These companies were subsequently warned of an imminent ransomware attack against their systems, allowing them to take measures to protect themselves against such an attack.” continues the Europol. “The service has now been rendered inaccessible.” 

“The investigation carried out by our cybercrime specialists has resulted in such a success thanks to the excellent international cooperation with partners worldwide. The results show that law enforcement authorities are equally as well connected as criminals,” said Udo Vogel, Police President of the Reutlingen Police Headquarters.

“The  strong working relationship fostered by Europol between the investigators involved in this case on either side of the world was central in bringing down this service.  Criminals can run but they cannot hide from law enforcement, and we will continue working tirelessly together with our partners to outsmart them.” said the Head of Europol’s European Cybercrime Centre, Edvardas Šileris.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Pierluigi Paganini

(SecurityAffairs – hacking, VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]