Like all communication systems, such as telephone networks, Internet service providers, and even email, VPN services can be used by both honest citizens and criminals.
In terms of staying within the bounds of the law, the important factor is whether the communications provider or service actively and knowingly encourages or facilitates illegal activities. According to an announcement from Europol, a VPN provider VPNLab seems to have crossed the line.
VPNLabs domain seized, service shut down
Previously, historical visitors to the VPNLab.net website were greeted with the kind of message associated with many privacy-focused services.
โVPNLab is a service that provides your Internet security by encrypting the original traffic. Our service is designed for a broad spectrum of clients: webmasters, SEO optimizers, merchants, entrepreneurs, and people who care about their personal security," the site reads.
"Average users do not see the need for the described procedure and may even find it useless, however, the latest legal proceedings filed involving people who were simply expressing their opinions in their own web diaries show the seriousness of the Internet security problem."
Following a lengthy international investigation by authorities in Germany, the Netherlands, Canada, the Czech Republic, France, Hungary, Latvia, Ukraine, the United Kingdom, and the United States, a new message appears suggesting that the service was more than just a simple vehicle to allow freedom of expression.
VPNLab โ 2008 to 2022
According to a Europol announcement, VPNLab began operations in 2008, offering an OpenVPN-based service designed to provide online anonymity for as little as $60 per year. Exactly when the service came to the attention of law enforcement remains unclear, but according to Europol, at some point VPNLab became popular with cybercriminals.
โPolice became interested in the provider after multiple investigations uncovered criminals using the VPNLab.net service to facilitate illicit activities such as malware distribution. Other cases showed the use of the service in the creation of infrastructure and communications behind ransomware campaigns, as well as the actual deployment of ransomware,โ says Europol.
The European Union Agency for Law Enforcement Cooperation adds that, as a result of VPNLab's investigation, more than 100 companies have been identified as "at risk of cyber attacks" and law enforcement agencies are currently working with these potential victims to mitigate their exposure.
International cooperation
There seems to be little doubt that law enforcement authorities viewed VPNLab as a major cybersecurity problem.
In Germany, the Hanover Police Department played a key role and in the Netherlands, the country's High-Tech Crime Unit was called in. The operation also involved the Royal Canadian Mounted Police, the National Organized Crime Agency of the Czech Republic, the National Crime Agency of the United Kingdom, the FBI of the United States and specialized agencies from all over Europe.
โOn January 17, disruptive actions were carried out in a coordinated manner in Germany, the Netherlands, Canada, the Czech Republic, France, Hungary, Latvia, Ukraine, the United States and the United Kingdom. Law enforcement authorities have now seized or disrupted all 15 servers hosting the VPNLab.net service, making it no longer available,โ Europol adds.
Criminals โare running out of places to hideโ
According to Edvardas ล ileris, director of Europol's European Cybercrime Center, the action against VPNLab shows that criminals cannot take anonymity for granted.
โThe actions taken under this investigation make it clear that criminals are running out of ways to hide their tracks online. Each investigation we undertake informs the next, and the information gained on potential victims means we may have anticipated several serious cyberattacks and data breaches,โ says ล ileris.
An important feature of the ad lies in the description of VPNLab. Rather than just another VPN provider offering anonymity on the regular internet, the service is claimed to have been advertised on the dark web. While that is certainly not a crime in and of itself, Hanover Police Department Chief Volker Kluwe suggests an unacceptable level of involvement in the illegal activities of VPNLabs customers.
โAn important aspect of this action is also to show that if service providers support illegal actions and do not provide any information on legal requests from law enforcement authorities, these services are not bulletproof,โ says Kluwe. .
"This Operation shows the result of effective cooperation of international law enforcement agencies, which makes it possible to shut down a global network and destroy such brands."
The action against VPNLab follows a similar operation in June 2021 pointing to DoubleVPN. In that matter, it was also claimed that the VPN provider was complicit in the actions of its users, not only by providing anonymity, but by advertising on cybercrime forums as a means for ransomware operators and phishing scammers to hide their locations.
