Cybercriminals’ favourite VPN taken down in global action

Law enforcement wiretapped the very service used by criminals to evade interception

The virtual private network (VPN) Safe-Inet used by the world’s foremost cybercriminals has been taken down yesterday in a coordinated law enforcement action led by the German Reutlingen Police Headquarters together with Europol and law enforcement agencies from around the world.

The Safe-Inet service was shut down and its infrastructure seized in Germany, the Netherlands, Switzerland, France and the United States. The servers were taken down, and a splash page prepared by Europol was put up online after the domain seizures. This coordinated takedown was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

Turning the table on the criminals

Active for over a decade, Safe-Inet was being used by some of the world’s biggest cybercriminals, such as the ransomware operators responsible for ransomware, E-skimming breaches and other forms of serious cybercrime.

This VPN service was sold at a high price to the criminal underworld as one of the best tools available to avoid law enforcement interception, offering up to 5 layers of anonymous VPN connections.

Law enforcement were able to identify some 250 companies worldwide which were being spied on by the criminals using this VPN. These companies were subsequently warned of an imminent ransomware attack against their systems, allowing them to take measures to protect themselves against such an attack.
The service has now been rendered inaccessible.

Investigations are ongoing in a number of countries to identify and take action against some of Safe-Inet’s users.

International cyber sweep

International police cooperation was central to the success of this investigation as the critical infrastructure was scattered across the world.

Europol’s European Cybercrime Centre (EC3) supported the investigation from the onset, bringing together all the involved countries to establish a joint strategy and to organise the intensive exchange of information and evidence needed to prepare for the final phase of the takedown.

The Police President of the Reutlingen Police Headquarters, Udo Vogel, said:

The investigation carried out by our cybercrime specialists has resulted in such a success thanks to the excellent international cooperation with partners worldwide. The results show that law enforcement authorities are equally as well connected as criminals.

The Head of Europol’s European Cybercrime Centre, Edvardas Šileris, said:

The strong working relationship fostered by Europol between the investigators involved in this case on either side of the world was central in bringing down this service. Criminals can run but they cannot hide from law enforcement, and we will continue working tirelessly together with our partners to outsmart them.

Participating agencies

• Germany: Reutlingen Police Headquarters (Polizeipräsidium Reutlingen)
• The Netherlands: National Police (Politie)
• Switzerland: Cantonal Police of Argovia (Kantonspolizei Aargau)
• United States: Federal Bureau of Investigation
• France: Judicial Police (Direction Centrale de la Police Judiciaire)
• Europol: European Cybercrime Centre (EC3)

‏Source www.europol.europa.eu