First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups
2026-05-22T19:24:14Z•d599d39f628367754b08f6ebc83aec2e3086802d5efa8abb96ddc604c5d88bfb
backdoorbotnetcisa-kevcisco-secure-workloadddosghostwritergithub-breachgrafana-breachkimwolflangflowlinux-malwaremalicious-ci-cdmalicious-vscode-extensionmalware-signing-as-a-servicemegalodonmicrosoft-defenderphishingprometheus-luresransomwareshowboatsupply-chain-compromisetanstack-npmtrend-micro-apex-onevpn-takedownwebworm
What happened
A wide-ranging security surge: international law enforcement dismantled a criminal VPN used by ~25 ransomware groups; multiple high-impact supply-chain and repository compromises (GitHub, Grafana, malicious VS Code extension, TanStack npm) and an automated campaign (Megalodon) pushed thousands of malicious CI/CD commits. Microsoft disrupted a malware‑signing‑as‑a‑service operation and warned of actively exploited Defender flaws. CISA added exploited vulnerabilities (notably Langflow) to KEV, and several critical/10.0 CVSS flaws were patched (Cisco Secure Workload). Proof‑of‑concept exploits or
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- d599d39f628367754b08f6ebc83aec2e3086802d5efa8abb96ddc604c5d88bfb
- Enrichment time
- 2026-05-22T19:24:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.