Ransomware infrastructure takedowns and VPN abuse
Key Questions
What happened in Operation Saffron?
EU authorities seized First VPN, taking down 33 servers and affecting 506 users. The operation targeted infrastructure used in cybercrime activities.
How are ransomware groups abusing VPNs?
Groups like Avaddon continue to abuse VPN services for reconnaissance activities. Free and compromised VPNs remain attractive tools for attackers.
How is Proton VPN responding to Canadian demands?
Proton VPN has vowed to resist surveillance requirements under Canadian Bill C-22. The provider states it will not comply with demands that conflict with its privacy commitments.
EU seizes First VPN (33 servers, 506 users) in Operation Saffron. Ongoing abuse by Avaddon et al. for recon. Proton VPN resists Canadian Bill C-22 surveillance demands.
Sources (2)
Updated May 23, 2026