A coordinated international law enforcement operation resulted
in the takedown of a VPN service called DoubleVPN for providing a
safe haven for cybercriminals to cover their tracks.
“On 29th of June 2021, law enforcement took down DoubleVPN,” the
agencies said[1]
in a seizure notice splashed on the now-defunct site. “Law
enforcement gained access to the servers of DoubleVPN and seized
personal information, logs and statistics kept by DoubleVPN about
all of its customers. DoubleVPN’s owners failed to provide the
services they promised.”
The criminal investigation was conducted by agencies from
Bulgaria, Canada, Germany, Italy, Sweden, Switzerland, the
Netherlands, U.K., and the U.S., alongside authorities from
Eurojust[2]
and Europol’s[3]
European Cybercrime Centre (EC3).
DoubleVPN is said to have been heavily advertised on both
Russian and English-speaking underground cybercrime forums as a
means to mask the location and identities of ransomware operators
and phishing fraudsters.
In addition to providing an advanced level of anonymity by
offering single, double, triple, and even quadruple VPN connections
to its clients — wherein internet traffic is routed through two or
more VPN servers, while simultaneously encrypting the data as many
times — DoubleVPN’s cheapest VPN connection[4]
cost as little as $25 per month.
Prior to its takedown, DoubleVPN’s site also claimed the service
kept no logs or statistics on its users, stating “we don’t spy on
our clients” and that “we can speak responsibly that there is no
logging client activity on our servers.”
Tuesday’s incident isn’t the first time a VPN service has been
caught in the crosshairs of law enforcement.
In December 2020, Europol and agencies from the Netherlands,
U.S., Germany, Switzerland, and France took down Safe-Inet[5], a popular virtual
private network (VPN) service that offered bulletproof hosting
services to facilitate criminal activity.