This pulse contains indicators of compromise (IOCs) associated with the “First VPN Service,” a provider leveraged by multiple ransomware groups for anonymization, reconnaissance, and intrusion activities. According to an FBI FLASH report (May 21, 2026), this VPN infrastructure has been used by at least 25 ransomware groups to conduct scanning, brute-force attempts, and unauthorized network access. The service includes globally distributed exit nodes and supports protocols designed to mask malicious traffic as legitimate HTTPS activity. The included indicators (domains, IP addresses, and communication channels) represent historically observed infrastructure tied to this activity and should be validated with additional telemetry due to possible reassignment over time.