Inside VPN.SN The Bulletproof Service Powering Russian Ransomware Gangs

Arkham blockchain analysis revealed that both Lockbit and Conti/Trickbot ransom gangs transacted with VPN.SN in early 2025. Lockbit conducted two transactions in January 2025, while Conti/Trickbot engaged in both 2024 and May 2025.

Russian cybercrime networks, including ransomware groups, rely on Russian bulletproof providers such as BEARHOST (Proton66, Prospero), 4VPS.su, and VPN.SN to support and shield their criminal operations. Unfortunately, these providers have not yet been targeted by law enforcement operations or sanctions authorities.

This investigation exposes the links between criminal networks and a key bulletproof provider—VPN.SN—which operates in a murky legal environment and facilitates illicit activity. The findings reveal VPN.SN’s involvement with ransomware operators, including transactions connected to Lockbit and Conti.

To read the complete article see: Inside VPN.SN: The Bulletproof Service Powering Russian Ransomware Gangs