Ukraine police arrest hacker for operating illegal VPN service to access sanctioned Russian sites

Avatar

Ukrainian law enforcement has arrested a local hacker who allegedly operated a large virtual private network (VPN) service allowing users to access Russian websites sanctioned in Ukraine.

The 28-year-old man is accused of setting up a VPN server room in his apartment in the western Ukrainian city of Khmelnytskyi. He also rented servers located in Germany, France, the Netherlands and Russia, “giving the enemy’s special services access to information about all users of the VPN,” Ukrainian cyber police said in a statement on Thursday.

The suspect advertised his service on his own Telegram channels, hacker forums, and an unnamed “world-famous IT platform,” where he positioned himself as a project developer and was targeting “like-minded people.”

His VPN service allowed users to access more than 48 million IP addresses of the Russian segment of the internet — the so-called Runet. According to investigators, the daily volume of the service’s network traffic exceeded 100 gigabytes.

Runet encompasses websites, social media, and other online platforms developed and hosted in Russia. It is believed to be state-regulated, with the Russian government attempting to protect its domestic services from “foreign influence.”

In 2017, Ukraine imposed sanctions on several widely used Russian services, including VKontakte, Yandex, and Mail.Ru. Since the Russian invasion of Ukraine, the local government has extended that list, so websites with “.ru” domains cannot be accessed from within Ukraine without a VPN.

The self-taught hacker from Khmelnytskyi could face up to 15 years in prison for creating a service to violate those restrictions..

Police are currently analyzing information from the suspect’s seized devices to identify his accomplices “and the sources of funding for his business.” It is possible the hacker worked on behalf of Russian special services, police said.

NewsNews BriefsCybercrime
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Casio says ransomware attack exposed info of employees, customers and business partners

Next Post

Iran-linked hackers increasingly spy on governments in Gulf region, researchers say

Related Posts

Microsoft Helps CBI Dismantle Indian Call Centers Behind Japanese Tech Support Scam

India's Central Bureau of Investigation (CBI) has revealed that it has arrested four individuals and dismantled two illegal call centers that were found to be engaging in a sophisticated transnational tech support scam targeting Japanese citizens. The law enforcement agency said it conducted coordinated searches at 19 locations across Delhi, Haryana, and Uttar Pradesh on May 28, 2025, as part of
Avatar
Read More

China-Linked APTs Exploit SAP CVE-2025-31324 to Breach 581 Critical Systems Worldwide

A recently disclosed critical security flaw impacting SAP NetWeaver is being exploited by multiple China-nexus nation-state actors to target critical infrastructure networks. "Actors leveraged CVE-2025-31324, an unauthenticated file upload vulnerability that enables remote code execution (RCE)," EclecticIQ researcher Arda Büyükkaya said in an analysis published today. Targets of the campaign
Avatar
Read More