Top Stories

In addition, EUR 3.5 million in cryptocurrency was seized during the action week, bringing the total amount seized during the Operation Endgame to more than EUR 21.2 million.This latest phase of Operation ENDGAME follows on from the largest-ever international action against botnets in May 2024. It targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise.The operation focused on initial access malware – the tools cybercriminals use to infiltrate systems unnoticed before deploying ransomware. By disabling these entry points, investigators have struck at the very start of the cyberattack chain, damaging the entire cybercrime-as-a-service ecosystem.The following malware strains were neutralised during the action:BumblebeeLactrodectusQakbotHijackloaderDanaBotTrickbotWarmcookieThese variants are commonly offered as a service to other cybercriminals and are used to pave the way for large-scale ransomware attacks. In addition, international arrest warrants were issued against 20 key actors believed to be providing or operating initial access services to ransomware operators.Catherine De BolleEuropol Executive Director"This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganise. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source."Operation Endgame is an ongoing, long-term oriented, large-scale operation conducted jointly by several law enforcement agencies around the world against services and infrastructures assisting in or directly providing initial or consolidating access for ransomware.European coordinationEuropol supported the operation from the very beginning, providing coordination, operational and analytical support, cryptocurrency tracing, and facilitating real-time information exchange between the different partners involved.A Command Post was set up at Europol headquarters in The Hague during the action week, with investigators from Canada, Denmark, France, Germany, the Netherlands,  the United Kingdom and the United States working with Europol’s European Cybercrime Centre and its Joint Cybercrime Action Taskforce. The Command Post coordinated law enforcement actions, managed intelligence on seized servers, and oversaw the implementation of the operational action plan.Eurojust has provided essential support to make judicial cooperation effective since the beginning of the investigation in 2024. Coordination by Eurojust ensured that authorities were able to exchange information and align their investigative efforts.Suspects to be added to EU Most Wanted listSeveral key suspects behind the malware operations are now subject to international and public appeals. The German authorities will publish 18 of them on the EU Most Wanted list as of 23 May.The suspects are believed to have provided or operated the tools that enabled criminal groups to access victim networks and launch large-scale ransomware attacks.Looking ahead: IOCTA 2025 to spotlight access brokersAs cybercriminals continue to innovate, law enforcement is adapting its strategy to stay ahead. The upcoming Europol Internet Organised Crime Threat Assessment (IOCTA) 2025, to be published on 11 June, will place a strong focus on initial access brokers, reinforcing the importance of tackling the early stages of cyberattacks.Operation Endgame will now continue with follow up actions announced on the dedicated website of the international law enforcement partners.Participating countriesCanada: Royal Canadian Mounted Police (RCMP)Denmark: Danish Police (Politi)France: National Police (Police Nationale), National Gendarmerie (Gendarmerie Nationale), Public Prosecutor Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit, Paris Judicial Police (Préfecture De Police de Paris)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General's Office Frankfurt am Main – Cyber Crime CenterThe Netherlands: National Police (Politie), Public Prosecution Office (Openbaar Ministerie)The United Kingdom: National Crime AgencyThe United States: Federal Bureau of Investigation, United States Secret Service, The Defense Criminal Investigative Service, United States Department of Justice

The suspects were identified through coordinated investigations based on intelligence from the takedowns of the dark web marketplaces Nemesis, Tor2Door, Bohemia and Kingdom Markets. Many had conducted thousands of sales on illicit marketplaces, using encryption tools and cryptocurrencies to cover their tracks — but law enforcement closed in.This international action follows Operation SpecTor in 2023, which led to 288 arrests. Together, these operations show the increasing ability of law enforcement to penetrate the dark web’s cloak of secrecy.Dark web vendors unmaskedThe 270 arrests took place in the following countries:United States of America: 130Germany: 42United Kingdom: 37France: 29South Korea: 19Austria: 4The Netherlands: 4Brazil: 3Switzerland: 1Spain: 1Investigations are ongoing to trace and apprehend more individuals involved in dark web crime.Millions seized, weapons recoveredIn parallel with the arrests, officers seized:Over EUR 184 million in cash and cryptocurrenciesOver 2 tonnes of drugs, including amphetamines, cocaine, ketamine, opioids and cannabisOver 180 firearms, along with imitation weapons, tasers and knives12 500 counterfeit productsMore than 4 tonnes of illegal tobaccoThese seizures represent a major disruption to the criminal supply chains that feed the dark web economy.Europol's roleEuropol supported the action by compiling and analysing intelligence packages based on data from the three seized marketplaces. These packages were then shared with national authorities in the framework of the Joint Cybercrime Action Taskforce, hosted at Europol’s headquarters, to enable targeted investigations.This operational model, also used in 2023’s Operation SpecTor, demonstrates that the takedown of a criminal platform is not the end of the story — it is the beginning of follow-up investigations aimed at identifying and arresting high-value vendors.Edvardas ŠilerisHead of Europol’s European Cybercrime CentreOperation RapTor shows that the dark web is not beyond the reach of law enforcement. Through close cooperation and intelligence sharing, officers across four continents identified and arrested suspects, sending a clear message to those who think they can hide in the shadows. Europol will continue working with our partners to make the internet safer for everyone.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationThis operation is proof of how criminal gangs operate today: offline and online, internationally and locally, using technology to their full advantage. To counter this, coordinated action is essential. And that is exactly the added value Europol provides. Thank you and congratulations to all the authorities involved. To stay effective in a rapidly changing world, we also need to better support our law enforcement agencies to make them future proof. And that is exactly what we aim to do with ProtectEU, our Internal Security Strategy. We also need to strengthen Europol — with more funding and with an updated mandate.Changing tactics, same threatRecent operations are reshaping the dark web landscape. With traditional marketplaces under increasing pressure, criminal actors are shifting to smaller, single-vendor shops — sites run by individual sellers to avoid marketplace fees and minimise exposure.Illegal drugs remain the top commodity sold on the dark web, but 2023 also saw a surge in prescription drug trafficking and a rise in fraudulent services, including fake hitmen and bogus listings designed to scam buyers. Despite these shifts, the message is clear: no platform is beyond the reach of coordinated, international law enforcement efforts.This global action was made possible thanks to the close cooperation between the following authorities:Austria: Criminal Intelligence Service Austria with various Provincial Criminal Police Departments (Bundeskriminalamt und Landeskriminalämter)Brazil: Civil Police of the State of Pará (Polícia Civil do Estado do Pará) and Civil Police of the State of São Paulo (Polícia Civil do Estado do São Paulo)France: French Customs (Douane), National Gendarmerie (Gendarmerie Nationale)Germany: Federal Criminal Police Office (Bundeskriminalamt); Prosecutor’s Office in Cologne – Central Cybercrime Contact Point (Staatsanwaltschaft Köln, Zentral- und Ansprechstelle Cybercrime); Central Criminal Investigation in Oldenburg (Zentrale Kriminalinspektion Oldenburg); various police departments (Dienststellen der Länderpolizeien); German Customs Investigation (Zollfahndungsämter)The Netherlands: Team High Tech Crime (National Investigations and Special Operations (NIS) and Post Interventie Team (PIT); National Intelligence, Expertise and Operational Support (NIEO)Spain: National Police (Policía Nacional)South Korea: Seoul Central District Prosecutors’ Office – Darknet Investigations UnitSwitzerland: Zurich Cantonal Police (Kantonspolizei Zürich) and Public Prosecutor's Office II of the Canton of Zurich (Staatsanwaltschaft II)United Kingdom: National Crime Agency (NCA); National Police Chiefs’ Council (NPCC)United States: Department of Justice (DOJ) with the JCODE partner agencies (Federal Bureau of Investigation (FBI)m Drug Enforcement Administration (DEA); Food and Drug Administration (FDA)-Office of Criminal Investigations; Homeland Security Investigations (HSI); Internal Revenue Service (IRS)–Criminal Investigation; US Postal Inspection Service (USPIS); Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); Army Criminal Investigation Division (Army-CID); Customs and Border Protection (CBP); Department of Justice (DOJ); Department of the Treasury Financial Crimes Enforcement Network (FinCEN); Department of the Treasury Office of Foreign Assets Control (OFAC); Naval Criminal Investigative Service (NCIS)) 

Operational highlightsThe Italian Carabinieri Command for the Protection of Cultural Heritage (TPC) in coordination with the Italian Customs and Monopolies agency (ADM) seized a painting attributed to renowned artist Jannis Kounellis during a joint border operation. Upon inspection, it was determined to be inauthentic. Had it been genuine, its estimated value would have been around EUR 100 000. In a separate investigation, the Carabinieri TPC seized more than 300 items, including coins, metal and ceramic fragments such as arrowheads and spearheads dating back to the Roman and Punic periods. These artifacts were being offered for sale on e-commerce platforms and were discovered in a private apartment.The Spanish Guardia Civil dismantled a criminal group involved in archaeological looting in the province of Cáceres. Six individuals were arrested, and three others are under investigation. During the operation authorities recovered 2 500 archaeological, primarily Roman coins minted in the Celtiberian city of Tamusia. These artifacts had been looted from protected archaeological sites in the province of Caceres using metal detectors and were being sold illegally through social media platforms.Also in Spain, the Guardia Civil intercepted a passenger attempting to fly from Palma de Mallorca to Germany carrying 55 ancient coins and a ring. A subsequent investigation led to an indictment for crimes against cultural heritage and plundering underwater wrecks and archaeological sites. In total, 64 objects of historical value and 1,576 ancient coins were confiscated.In Greece, the Department of Cultural Heritage and Antiquities of Athens recovered five Byzantine icons. Acting on intelligence and using special investigative techniques, including an undercover officer, three individuals were arrested while attempting to sell the icons for EUR 70 000.Ukrainian customs authorities seized 87 cultural goods that were being illegally transported out of the country to Poland, Moldova and Romania.Cyber patrols uncover additional casesIn addition to on-the-ground actions, dedicated cyber patrols were carried out during the operation to identify potential illicit online sales of cultural property. These virtual investigations led to the opening of new cases, demonstrating how digital platforms are quickly becoming a channel of choice by traffickers to market and sell looted artefacts. A total of 4 298 cultural goods were seized as a result of the cyber patrols.Built on international cooperationOperation Pandora IX was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Europol facilitated the exchange of information and provided analytical and operational support to the national investigations. Furthermore, one cyber patrol week was hosted by Europol.INTERPOL coordinated cross-border actions and offered tools such as its Stolen Works of Art database and on the ground ID-Art mobile application.The WCO’s secure communication tool, CENcomm, was made available to all participants while its Regional Intelligence Liaison Office for Eastern and Central Europe compiled, refined and shared information provided by Customs administrations.Since its launch in 2016, Operation Pandora has become a key global initiative to protect cultural heritage from illicit trafficking.Participating agencies:Europol, INTERPOL, World Customs Organization 

Its origin goes back to the foundation of the European Police Office by the Europol Convention, which set the legal basis for the establishment of a “computerized information system” (Title II, Article 7), into which EU Member States could directly input data in compliance with their national procedures, and into which Europol could directly input data supplied by third parties and analysis data, directly accessible for consultation by national units, liaison officers and duly empowered Europol personnel. Launched and used operationally for the first time in 2005, the EIS was one of the pioneers of information sharing at European level for law enforcement officers, allowing users to easily check whether information on a certain person, car, phone or other object of interest in an investigation was available beyond national or organisational jurisdictions.The EIS user community has increased significantly throughout the years. In addition to the growth in the number of users, the amount of data processed in the system evolved as well, offering a more efficient possibility for every investigator in the EU to have access to the data hosted at Europol. This has led to record figures, with more than 14 million searches performed in 2023, and more than 1.7 million data entities available in 2024.With the adoption of the EU Interoperability Agenda in 2019, the EIS has entered a new era as one of the most important elements of the new architecture. This is due to the fact that the relevant data stored in the EIS will be part of a systematic verification of administrative applications from non-Schengen citizens entering the Schengen area. Expected to enter into operation in Q4 2026, the travel applications submitted through the European Travel Information and Authorisation System (ETIAS) will be automatically cross-checked against EIS data. In the future, similar processes will be applied for visa applicants (via a revised Visa Information System), asylum seekers and irregular migrants.Europol marked the EIS 20-year anniversary during the recent Product Management Forum that took place at Europol’s headquarters on 13-14 May. On this occasion, Europol’s Deputy Executive Director Capabilities, Andrei Linta, said:“All the improvements and the successes of the Europol Information System were possible because of the remarkable commitment of both Europol’s staff and Europol’s partners, from MS and beyond, who made the system faster, better, more accurate and valuable for all its users. Personally, I am grateful to each of you: you should be proud of the Europol Information System as much as we are at Europol”

The 17 individuals arrested are mostly of Chinese and Syrian nationality and are suspected of providing primarily money laundering services to criminals. This encompasses parallel banking services, illegal hawala banking, cash collection, cash courier services and the exchange of cryptocurrencies for cash. The money launderers were operational in at least two branches: one that catered largely to the Arabic-speaking criminal world and the other to criminal networks originating from China.Money laundering services offered to other criminal networksInvestigators consider the dismantled criminal network one of the most significant in this crime area. It provided money laundering and related services to other criminal networks engaged in migrant smuggling and drug trafficking. It is believed that over EUR 21 million were moved by the criminal network. Advertising on social media, they reached a varied and international clientele. Apart from arresting 17 individuals, law enforcement seized criminal assets worth over EUR 4.5 million.The seizures include:EUR 206 000 in cashEUR 421 000 in 77 bank accountsEUR 183 000 in cryptocurrency10 real estate items worth over EUR 2.5 million18 vehicles worth over EUR 207 0004 shotguns and ammunitionPhones and other devicesLuxury consumables, watches, accessories, and jewelleryEuropol’s involvementFollowing up on the successes in taking down the migrant smugglers who relied on this criminal network’s illicit banking services, national investigators and Europol’s experts in financial crime jointly picked up a new trail. Examining the migrant smugglers’ phones, leads to the criminal network laundering illicit proceeds were found, thus kicking off this new investigation.On the action day, Europol financed three Spanish investigators to travel to Belgium and Austria. Additionally, two Europol experts travelled to Austria and Belgium to provide support on the ground, while two more Europol experts were deployed to Spain. 

The German investigation began with a routine immigration check in September 2024. Due to irregularities in a driver's documentation, he was suspected of attempted illegal entry and taken in for questioning. Investigators then found evidence that the driver may have already smuggled and dropped off three non-EU nationals on the same day.Subsequent investigations gave reason to believe the person was part of an internationally operating migrant smuggling network. There are indications that the network might be responsible for facilitating the illegal entry to Germany and other EU Member States of up to 300 non-EU nationals between 2022 and 2024.Investigators found most of the suspected gang members to be residing in Belgium. These individuals seemed to be the link between the suspects based in Germany and Poland, mostly recruiting drivers and overseeing financial aspects of the criminal network.In Poland, the actions had focused on a related organised criminal network also involved in the smuggling of migrants from Middle Eastern countries to the EU. The Polish members of this network, which is also engaged in the production and trafficking of drugs (amphetamines, cocaine and marijuana), has connections to the Polish football hooligan scene.Members of this network would organise the smuggling of up to a dozen people at a time along the Balkan route, sometimes relying on a legally operating Polish transport company to mask their activities. Three action days spread out over several months saw the arrests of eight suspects and seizures of criminal assets.Europol’s roleEuropol and Eurojust supported this multi-stage operation from its planning stage to yesterday’s action day.Europol oversaw the coordination of the national investigations and organised multiple operational meetings. On the action days, Europol facilitated the deployment of investigators between the countries. Additionally, Europol experts were sent into the field to help national authorities cross check operational information in real time against Europol’s databases.Eurojust facilitated cross-border judicial cooperation by enabling information exchange and aligning investigative efforts.Participating countries:Austria: Federal Criminal Intelligence Service (Bundeskriminalamt), Provincial Criminal Intelligence Service of Styria (Landeskriminalamt Steiermark)Belgium: Federal Judicial Police West-Flanders Belgium (Federale Gerechtelijke Politie Provincie West-Vlaanderen)Germany: Freilassing Federal Police Inspectorate (Bundespolizeiinspektion Freilassing); Traunstein Public Prosecutor's Office (Staatsanwaltschaft Traunstein)Poland: Polish prosecutor’s office - Silesian Branch of the Department for Organised Crime and Corruption in Katowice (Prokuratura Krajowa - Śląski Wydział Zamiejscowy Departamentu do Spraw Przestępczości Zorganizowanej i Korupcji w Katowicach); Polish Police – Regional Police Headquarters in Katowice, Department for Combating Crime of Hooligans (Policja, Komenda Wojewódzka Policji w Katowicach, Wydzial Zwalczania Przestepczosci Pseudokibicow); Polish Border Guard – Karpacki Border Guard Regional Unit (Straż Graniczna, Karpacki Oddzial Straży Granicznej w Nowym Sączu)Participating agencies:Europol, Eurojust

The criminal network lured victims with the promise of high returns on investments through a fraudulent online trading platform. After the victims made initial smaller deposits, they were pressured to invest larger amounts of money, manipulated by fake charts showing fabricated profits. Criminals posing as brokers used psychological tactics to convince the victims to transfer substantial funds, which were never invested but directly pocketed by the group.German authorities initiated the investigation after a married couple reported falling victim to the scam. The inquiry revealed an extensive criminal network, and a first action day on 6 September 2022 led to searches in Belgium and Latvia, where two suspects were arrested, and crucial evidence was seized. This evidence helped identify seven additional members of the network, including the managers of call centres used to deceive victims.A second action day took place on 13 May 2025. A total of eight searches took place simultaneously in Albania, Cyprus and Israel. During the searches, authorities seized evidence to continue the investigation such as electronic devices and documents as well as cash. A suspect in Cyprus was arrested with the intention of either surrendering or extraditing them to Germany.Eurojust facilitated judicial cooperation ensuring smooth coordination across borders.Europol provided operational support throughout the investigation, deploying experts in Albania, Israel, and the United Kingdom. Europol also set up a virtual command post to facilitate real-time coordination and intelligence sharing.The investigation remains ongoing, with further actions expected.The following authorities carried out the operations:Germany: Public Prosecutor's Office at the Itzehoe Regional Court, Department for Combating Cybercrime; District Criminal Investigation Office KielCyprus: Attorney General’s Office; Cyprus Police; Unit for Combating Money Laundering (MOKAS)Albania: Special Prosecution Office against Corruption and Organised CrimeUnited Kingdom: National Crime AgencyIsrael: Israeli Police - National Cybercrime Unit and Coordination and Operational Division in the Intelligence Branch

The now defunct platforms – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – are thought to have facilitated widespread attacks on schools, government services, businesses, and gaming platforms between 2022 and 2025. The platforms offered slick interfaces that required no technical skills. Users simply entered a target IP address, selected the type and duration of attack, and paid the fee — automating attacks that could overwhelm even well-defended websites.Global law enforcement responseThe arrests in Poland were part of a coordinated international action involving law enforcement authorities in 4 countries, with Europol providing analytical and operational support throughout the investigation.Dutch authorities have deployed fake booter sites designed to warn users seeking out DDoS-for-hire services, reinforcing the message that those who use these tools are being watched and could face prosecution. Data from booter websites, seized by Dutch law enforcement in data centres in the Netherlands, was shared with international partners, including Poland, contributing to the arrest of the four administrators.The United States seized 9 domains associated with booter services during the coordinated week of action, continuing its broader campaign against commercialised DDoS platforms.Germany supported the Polish-led investigation by helping identify one of the suspects and sharing critical intelligence on others.What are stresser and booter services?Stresser and booter services offer on-demand cyberattacks, often disguised as tools for legitimate testing but widely used to cause deliberate disruption. These services let users flood a target server or website with enormous volumes of fake traffic, making them inaccessible to real users – a technique known as distributed denial of service.Unlike traditional botnets, which require the control of large numbers of infected devices, stresser/booter services industrialise DDoS attacks through centralised, rented infrastructure. They are often advertised on underground forums and the dark web, and transactions are typically anonymised.This coordinated action is part of Operation PowerOFF, an ongoing international law enforcement effort targeting the infrastructure behind DDoS-for-hire activity.The following authorities took part: Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Centre (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)The Netherlands: National Police (Politie)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)USA: U.S. Department of Justice (US DOJ), Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), Defense Criminal Investigative Service (DCIS)

The exploitation of young perpetrators to carry out criminal acts has emerged as a fast-evolving tactic used by organised crime. This trend was underlined in the European Union Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA), which identified the deliberate use of youngsters as a way to avoid detection and prosecution.Recruitment, manipulation, exploitationViolence-as-a-service refers to the outsourcing of violent acts to criminal service providers — often involving the use of young perpetrators to carry out threats, assaults, or killings for a fee.Investigations show that these acts are often orchestrated remotely, with young people recruited and instructed online. There is a clear demand from the criminal underworld for youngsters willing to carry out violent tasks — and a supply of vulnerable young people being groomed or coerced into doing so.Young people are being deliberately targeted and recruited to commit a wide range of crimes — from drug trafficking and cyber-attacks to online fraud and violent extortion. Recruitment is often highly strategic, exploiting vulnerabilities and glamorising a luxurious, violent lifestyle. Social media platforms and messaging apps are used to reach young people through coded language, memes and gamified tasks. In return for money, status or a sense of belonging, they are drawn into criminal schemes that are both violent and transnational.This is not random – it is calculated. By using young perpetrators, criminal networks seek to reduce their own risk and shield themselves from law enforcement.Cracking down on criminal recruitersRecognising the urgency of the threat, law enforcement agencies are stepping up their response. OTF GRIMM will:Coordinate intelligence sharing and joint investigations across borders;Map the roles, recruitment methods and monetisation strategies used by VaaS networks;Identify and dismantle the criminal service providers enabling violence-on-demand;Cooperate with the tech companies in order to detect and prevent the recruitment on social media.Europol is at the heart of this international effort. Through OTF GRIMM, it provides a platform for data analysis, operational coordination, and joint investigations — ensuring that law enforcement across Europe is aligned in tracking, investigating and disrupting VaaS networks.To support national authorities and raise awareness of this growing threat, Europol has already made public an intelligence notification outlining how criminal networks lure young people into violence and crime. The notification breaks down the recruitment ecosystem — from the use of encrypted messaging apps and social media to lifestyle messaging, manipulation tactics and gamification.Further updates will be shared as investigations developed under OTF GRIMM progress.What can parents do if they’re concerned?Look out for the subtle signs — sudden behaviour changes, expensive new items with no explanation. If your child stops asking for money but seems to have it, that’s not independence — it’s a red flag.Europol has put together an awareness guide with a list of warning signs.This isn’t about catching the kids out — it’s about pulling them back, before organised crime pulls them in.

The lab was located in a mansion in a remote area. Two Dutch nationals, who were identified as chemists, were responsible for the drug production, while one Belgian national facilitated the production process. Investigators believe the lab had been operating for more than a year and that it had the capacity to produce hundreds of kilos of amphetamine and methamphetamine every month.On the action day, two Europol experts supported national authorities in the field, both members of Europol’s Drug Lab Dismantling Team (ELDT). The ELDT is a unique service deployed upon request to assist national specialists and provide on-site technical assistance, chemical detection and operation support. It is equipped with state-of-the-art detection tools and staffed by experts in chemical identification and lab safety.Europol’s fight against synthetic drugsEuropol identifies synthetic drugs as one of the key threats to the EU. Europe is a key player in this market as the industrial-scale production of synthetic drugs takes place in the EU to meet demands in both the domestic and international markets. Synthetic drug production in Europe is driven by innovation in methods and equipment, and the availability of the key chemicals needed. A further spread of production facilities throughout European countries is also highly likely, posing a further threat to the EU. Additionally, legal business structures are often exploited to obtain chemicals and equipment for drug production, which is characterised by continuous innovation. That's why Europol prioritises the fight against this type of serious and organised crime.

The investigation, code-named ‘Nimmersatt’ (‘Insatiable’ in German), extended from the US to Russia, with links to Canada, Hungary, Ireland and the United Kingdom (UK), as well as 11 EU countries. Investigative measures were conducted today and yesterday in Bulgaria, Estonia, Germany, Hungary, Latvia, Lithuania, the Netherlands, Portugal, Romania and Spain.Wrecked cars, fake import papers, cosmetic repairs and tax fraudCriminal organisations exploit the US market for cars damaged in accidents, which are often sold by insurance companies abroad or dismantled for scrap. The criminal group targeted by the EPPO-led investigation bought huge quantities of wrecked cars from US insurance companies at online auctions to then ship them to the EU. By using a network of sham companies and fake invoices to cover the origin of the cars, those vehicles arrived in the EU with their commercial history obscured.The cars arrived at different ports, including Antwerp (Belgium), Bremerhaven (Germany), Klaipėda (Lithuania) and Rotterdam (the Netherlands). In order to evade a substantial part of the customs duties, the perpetrators presented false invoices to the custom authorities, declaring a much lower value than what they paid for the vehicles.The cars were then transported by land to Lithuania, to be repaired in auto repair shops. However, based on the evidence, the repairs were only superficial, in order to make the cars appear as new and to pass the required technical certification procedures. Later, when the cars were sold to final customers in Germany and in other EU countries, they were presented as “never having had an accident” or “being fully and professionally repaired”, even when they had hidden damage – including missing airbags or other serious security issues. Less valuable vehicles were sold to Eastern European markets.In Germany, according to the investigation, the vehicles were sold by car dealers linked to the criminal organisation. It is understood that they fraudulently applied reduced VAT, under the so-called ‘margin taxation scheme’. This provision allows resellers to pay VAT only on their profit margin (the difference between the price paid for the item and the price for which it is sold), when selling second-hand goods bought from private individuals. However, the companies under investigation applied this provision unlawfully, as the cars had been imported commercially, mainly from the US, and in some cases also from Canada. The suspected fraud also allowed the wrecked cars to be sold at a lower market price, thus causing unfair competition.In Lithuania, the members of the organised crime group are believed to have used Lithuanian companies to also launder their profits from VAT fraud and payments in cash from car buyers. The investigation determined that the Lithuanian cell of the organisation used companies in Bulgaria, Estonia, Hungary, Latvia, Lithuania, the Netherlands and Romania to fraudulently conceal the true turnover of the trade in salvage cars. This Lithuanian cell was established in 2020 and headed by a Lithuanian national who was arrested in the course of this action. From Lithuania alone, at least 16 500 cars were sold for an amount of EUR 144 million.Complex international criminal chainThanks to the joint efforts of the EPPO, Europol, Eurojust and national law enforcement authorities, the investigation uncovered an extremely complex criminal scheme with ramifications in 18 countries. The individuals targeted by this operation were the criminal organisation’s leading members from Russia and Lithuania, as well as suspects responsible for the import and transport of the vehicles as well as dozens of car dealers.The damage caused by these criminal activities, which is still under assessment, is estimated to be at least EUR 31 million in unpaid VAT and customs duties. Freezing orders of up to EUR 26.5 million were granted. For the time being, bank accounts were frozen, and 116 cars worth approximately EUR 2.3 million were seized, as well as EUR 0.5 million in cash and luxury items.Europol’s roleEuropol collected and analysed contributions by its partners, with the outcomes shared as analytical reports (such as cross-references in Europol’s databases), travel intelligence reports (to support the monitoring of main suspects) or financial intelligence reports (to identify as wide a possible overview of the financial circuits of the criminal activity to facilitate asset recovery measures). On the action day, Europol established a virtual command post for communications between the investigation teams and the central command centre set up in the EPPO headquarters. One Europol expert with a mobile office was deployed to the central command centre while six Europol digital forensics experts were deployed to the actions in Lithuania and Latvia, supporting on the spot.This investigation took place in the framework of an EMPACT Operational Action to combat organised crime groups involved in VAT fraud and other financial crime in the field of importation and trade of crashed cars from third countries (such as the US) into the EU. This EMPACT Operational Action is led by Lithuania and supported and coordinated by Europol from the very first instance when Lithuania shared information about this new modus operandi. 13 countries took part in a SIENA string that allowed them to share information about national investigations that would then develop into EPPO cases.  The EPPO is the independent public prosecution office of the European Union. It is responsible for investigating, prosecuting and bringing to judgment crimes against the financial interests of the EU. This investigation involved 16 European Delegated Prosecutors and counted on the support of the Dresden tax office in Germany, the Financial Crime Investigation Service (FCIS) in Lithuania, Europol, Eurojust and law enforcement forces from several countries. The cooperation with UK tax authorities was also crucial to the inquiry.List of main partners and national authorities involved in the action:EPPOEuropolEurojustBulgaria: National Investigation Service (Национална Следствена Служба)Estonia: Estonian Tax and Customs Board (ETCB) - Maksu- ja TolliametGermany: Tax Investigation Office Dresden (Steuerfahndung Dresden), in cooperation with other tax offices in Germany; and Central Customs Investigation Service (Zollkriminalamt)Hungary: National Tax and Customs Administration (Nemzeti Adó- és VámhivatalLithuania: Financial Crime Investigation Service (Finansinių nusikaltimų tyrimo tarnyba – FNTT)Latvia: Tax and Customs Police Department of the State Revenue ServiceNetherlands: Fiscal Information and Investigation Service (FIOD)Portugal: Guarda Nacional Republicana (GNR) - Unidade de Acção FiscalRomania: National Anticorruption Directorate (Direcția Națională Anticorupție – DNA)Spain: Guardia Civil

These results were made possible by the continued exploitation of encrypted communication platforms, including Sky ECC and ANOM, which remain powerful tools in the hands of investigators.Unmasking the drug pipelines into EuropeOn 15 April, coordinated raids took place in several European countries and Türkiye, targeting both the leadership and logistical arms of these criminal networks. A total of 232 suspects have been arrested, including High Value Targets who played a pivotal role in drug trafficking and money laundering operations.Investigations spanned multiple jurisdictions, with authorities in Belgium, France, Germany, the Netherlands and Spain joining forces with Europol to disrupt the networks operating across the European continent.Over the course of the investigations, over EUR 300 million worth of assets were seized in Türkiye and Europe, including 681 properties and 127 vehicles.These criminal organisations – each operating independently but collectively wielding immense power – had established themselves as dominant players in the European drug trade.Using both traditional smuggling routes and sophisticated logistics, the groups were linked to the seizure of at least 21 tonnes of drugs in Europe and Türkiye, including 3.3 million MDMA tablets. Investigators also exposed the groups' involvement in money laundering, violent crime and a wider network of organised criminal activity.Cracking the criminal cloud with SKY intelligenceKnown as Operation BULUT (‘cloud’ in Turkish), this data-driven operation was built on intelligence extracted from the SkyECC and ANOM platforms.As part of the operational framework, French authorities shared decrypted SkyECC data with Türkiye to support the development of local investigations into the country’s most prominent organised crime suspects. As part of the ongoing judicial cooperation related to SKY ECC data, the French JUNALCO Public Prosecutor’s Office handles all requests for international mutual legal assistance requests sent by interested countries. ANOM intelligence was provided to the Turkish authorities by the Australian Federal Police, further enriching the intelligence picture.This cooperation facilitated the deployment of Turkish National Police officers to Europol’s headquarters, where they worked side by side with European investigators supported by Europol to analyse the encrypted communications and identify criminal networks operating in Türkiye.The resulting intelligence led to the first wave of arrests in Türkiye, targeting key figures at the top of the drug trafficking hierarchy. As the investigation revealed substantial links to organised crime across the EU, the operation entered a second phase – coordinated by Europol – bringing together law enforcement authorities from several Member States to disrupt the networks’ activities on European soil.From intelligence to action: Europol’s coordinating role Over the past two years, Europol has played a key role in coordinating efforts across Europe to support investigations into these criminal networks. By hosting high-level coordination meetings, Europol brought together all involved countries to develop a joint strategy, while intelligence shared through its channels helped map the networks’ structure and identify links to other cases. Europol also facilitated efforts to define the scope of the investigations between the SKY ECC joint investigation team (France, the Netherlands and Belgium) and Turkish investigators.Using its extensive datasets, Europol cross-checked information on suspects against passenger name records and other systems, enabling the silent surveillance of key targets. These efforts strengthened operational outcomes, leading to new intelligence developments.Europol also played a crucial role in the operational phase by setting up a real-time coordination platform among the designated country coordinators. This system ensured swift and effective decision-making, allowing for continuous adjustments to the strategy as the situation evolved. In addition, Europol deployed staff in the Netherlands to support the Dutch authorities’ enforcement activities.Closing in on criminal networks across the globeThis operation is part of Europol’s wider strategy to support EU Member States in systematically identifying, targeting and dismantling the most resilient criminal networks operating in Europe, wherever they are based. These criminal networks rely on international supply chains and complex structures to traffic drugs and launder illicit profits across multiple jurisdictions.Jean-Philippe LecouffeEuropol’s Executive Deputy Director OperationsYears after their takedown, encrypted platforms like SKY ECC and ANOM are still helping law enforcement turn intelligence into action. This case shows how powerful that data remains in identifying and dismantling high-value criminal networks operating in Europe. From logistics coordinators to the top tier of the criminal infrastructure, no one is beyond reach when countries work together and act on solid intelligence.The following authorities took part in the investigation: France: JUNALCO (National jurisdiction against Organised Crime), National Police (OFAST)The Netherlands: National PoliceBelgium: Federal Judicial Police Central Unit (DJSOC), Federal Judicial Police of East FlandersGermany: Federal Criminal Police (Bundeskriminalamt)Spain: National Police and Guardia CivilTürkiye: National Police; Counter Narcotics Department/Istanbul Narcotics Division (Emniyet Genel Müdürlüğü Narkotik Suçlarla Mücadele Başkanlığı/ İstanbul Narkotik Suçlarla Mücadele Şube Müdürlüğü), Interpol-Europol Department (Emniyet Genel Müdürlüğü İnterpol-Europol Daire Başkanlığı)

Seven suspects have been arrested in connection with the gang, which is believed to have sourced high-powered weapons from illegal markets in the Western Balkans and trafficked them into France for onward distribution.The joint operation – supported by Europol and Eurojust – has taken down the full supply chain behind the trafficking route, from source to destination.Caravan weapons cache sparks major investigationThe case began in September 2023, when law enforcement from Bosnia and Herzegovina informed Slovenian authorities that a vehicle transporting large quantities of weapons and ammunition was heading towards France. As the vehicle was already in Slovenia on its way to Austria, Slovenian authorities informed Austria. Austrian police stopped the Slovenian-registered vehicle towing a caravan near the Slovenian border. Inside, officers discovered a hidden cache of weapons, including:25 AK-type assault rifles126 hand grenades of various types25 kg of AK ammunition1 machine gun1 pistolThe arsenal was concealed in hidden compartments, including the caravan’s spare tyre. The phone records of the Slovenian driver led investigators to French contacts and pointed to a broader network involving Serbian and Bosnian nationals who had prepared the shipment, as well as a Spanish national already under investigation by the Guardia Civil. A French associate was also identified as a co-director of the firearms shipment.The driver, a Slovenian national, was arrested. Austrian authorities then informed Slovenia that the driver and the vehicle owner were from Kranj, Slovenia. This led to further investigations by Slovenian authorities in Kranj. Two other suspects were also arrested.Trafficking route uncoveredThe weapons are believed to have originated in Bosnia and Herzegovina before being smuggled through Slovenia and Austria en route to France. Intelligence gathered throughout 2024 helped to identify key members of the network and their roles.The operational phase of the case began on 18 March 2025. Law enforcement authorities in France, Spain and Bosnia and Herzegovina carried out simultaneous arrests and searches, leading to:4 arrests in France1 arrest in Spain2 arrests in Bosnia and HerzegovinaSearches in Spain and Bosnia and Herzegovina uncovered further evidence of the network’s activities. The main suspect remains at large and is currently being sought by Bosnian authorities.European coordination Europol supported the investigation from the outset, delivering operational analysis to the cases in the countries involved, coordinating international cooperation by organising operational meetings and deploying officers to France and Spain for the action day.Eurojust ensured smooth judicial cooperation by facilitating the use of European Arrest Warrants and European Investigation Orders across the participating jurisdictions.The following authorities took part in the investigation: France: Interregional Specialised Jurisdiction (JIRS) Paris; Central Office for the Fight Against Organised Crime (OCCLO)Slovenia: District State Prosecutor's Office in Kranj; Criminal Police Kranj (General Criminal Police Directorate)Spain: Public Prosecutor’s Office of the National Court (Audiencia Nacional); Guardia Civil (Intelligence Service Headquarters)Bosnia and Herzegovina: The Prosecutor’s Office of Bosnia and Herzegovina; Border Police of Bosnia and Herzegovina; Ministry of Interior Affairs - Republic of Srpska 

At the end of 2022, the French Gendarmerie in Strasbourg initiated an investigation against a criminal network involved in the smuggling of migrants from Serbia into the EU. The criminal network was mainly active across the Serbian-Hungarian and Greek-Turkish borders. However, smuggling operations linked to this network were also detected at intra-Schengen borders, notably at the Austrian-Hungarian and the Hungarian-Croatian borders.The operational actions on 1 April 2025 led to:24 arrests24 house searchesSeizures including 3 vehicles with an estimated value of over EUR 115 000 and communication devices.The alleged organisers of the network, based in another EU country, coordinated the activities together with two French nationals, based in France, in the region of Alsace near Germany. The latter managed the logistics including the recruitment of the drivers in Strasbourg and its suburbs, and in the region of Paris. This network was in charge of only one segment of the transportation. This tactic seeks to limit the threat to the entire network in cases where some members are arrested by law enforcement authorities.Over 40 drivers identifiedThe drivers were provided with rental vehicles, either cars or vans and were sent to the area of Szeged at the border with Serbia. Once in the area, the drivers coordinated with local smugglers when and from where to pick up the migrants in order to further transport them on to Hungary, Austria or Slovenia. At the arrival in the EU, the migrants were handed over to other smuggling networks. Over 40 drivers were identified during the investigation. During the transportation, the drivers loaded as many people as possible into the back of vans without any consideration for their safety in order to increase profits. Drivers would have received up to EUR 12 000 for transporting over 30 migrants at once. The suspected smugglers, who were responsible for the logistics, paid the drivers after the transportation upon receipt of a video to prove that the smuggling had been successful.Europol facilitated the exchange of information and provided operational coordination and analytical support. During the action day, Europol deployed an expert to France to facilitate the real-time exchange of information and cross-check operational information against Europol’s databases, providing leads to investigators in the field.  

The Working Arrangement provides for a structured and enhanced exchange of information (non-personal data) on transnational, serious and organised crime. Following the signing of the Working Arrangement, Egypt’s Ministry of Interior will be able to deploy a liaison officer to join Europol’s liaison officer community at its headquarters in The Hague.  The Working Arrangement does not provide a legal basis for the transfer of personal data. It establishes a general framework for potential cooperation between Egypt and Europol and EU Member States, should there be an urgent and justified need in the fight against organised crime and terrorism.The Working Arrangement includes strong safeguards to ensure respect for fundamental and human rights, as required by the Charter of Fundamental Rights of the European Union and the Europol Regulation.  Europol is the only law enforcement agency to host a unique community of over 300 liaison officers from more than 52 countries and international organisations at its premises in The Hague.Catherine De BolleEuropol Executive DirectorI would like to extend my sincere thanks to the Ministry of the Interior for its pivotal role in establishing this crucial cooperation between Egyptian law enforcement and Europol. Yesterday’s signing of the Working Arrangement marks a significant milestone in our shared commitment to addressing key security challenges. This partnership reflects the trust and collaboration that will continue to grow as we work together to ensure a safer future for both the European Union and Egypt.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationStrengthening Europe’s security means working with international partners. ProtectEU, our internal security strategy, puts a strong emphasis on global action. The new agreement between Europol and Egypt is a decisive step in disrupting migrant smuggling networks and human trafficking. Europe is working with purpose, committed to enhancing its own and our partners’ security.Egypt is a key partner in EU’s Southern Neighbourhood and plays an important and active role in many areas of interest to the EU. In December 2017, Egypt was added to Europol’s priority list for the conclusion of a Working Arrangement. Negotiations began that same year, following an agreement between the EU and Egypt on the priority areas for cooperation between Europol and Egypt.  Europol has remained committed to strengthening operational cooperation through the conclusion of this Working Arrangement. The conclusion of negotiations on the Working Arrangement in September 2024 and its signing this Wednesday reflect the trust and collaboration that have developed between the parties.Europol’s mission is to support EU Member States in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism. To achieve this, Europol must establish cooperative relations with key security partners such as Egypt, as it promotes a multi-agency and cross-sectoral approach, working closely with established actors within the EU security architecture (all 27 EU Member States) and beyond (third countries). 

While the actions in May 2024 targeted high-level actors who facilitated cybercrime, by deploying ransomware, for example, this follow-up operation targets a different level. Law enforcement moved – and continues to move – against the criminals who used the services taken down during Operation Endgame, focusing on the demand side of the criminal ecosystem. Customers of crime-as-a-service providers are now learning the painful lesson that their personal data was not protected by these individuals who involuntarily painted targets on their backs.Follow-up after follow-up…Law enforcement agencies in all the involved countries have closely followed the leads uncovered during Operation Endgame, helping them to link online personas and their usernames to real-life individuals. When called in for questioning, several suspects chose to cooperate with the authorities by facilitating the examination of digital evidence stored on their personal devices. Several suspects resold the services purchased from Smokeloader at a markup, thus adding an additional layer of interest to the investigation.…and a dedicated website for those who want to get in touchSome of the suspects had assumed they were no longer on law enforcement’s radar, only to come to the harsh realisation that they were still being targeted. Operation Endgame does not end today. New actions will be announced on the website operation-endgame.com. Anyone with information is invited to contact the authorities through this website. In addition, suspects involved in these and other botnets, who have not yet been arrested, will be held directly accountable for their actions. Europol and the Joint Cybercrime Action Taskforce (J-CAT), hosted by Europol, continue to support the investigation of Operation Endgame. It has facilitated the information exchange between the authorities involved and provided analytical and forensic support to the investigators. To support the coordination of the operation, Europol organised coordination calls and operational sprints at its headquarters in The Hague.Participating authorities:Canada: Royal Canadian Mounted Police (RCMP)Czech Republic: Police of the Czech Republic (Policie České republiky)Denmark: Danish Police (Dansk Politi)France: National Police (OFAC) (Police Nationale - Office Anti-Cybercriminalité)Germany: Federal Criminal Police Office (Bundeskriminalamt); Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)Netherlands: National Investigations and Special Operations (NIS), Netherlands Police (Politie)United States of America: Federal Bureau of Investigation (FBI); United States Secret Service; United States Department of Defense - Defense Criminal Investigative Service (DCIS)Participating agencies:EurojustOperation Endgame - think about (y)our next move:

Decisive action against key smuggling routeIn recent years, Egyptian nationals have increasingly been reported as both irregular migrants and smugglers operating on various routes into and throughout the EU, including the Mediterranean and the Western Balkan routes. The network targeted by this investigation offered illegal journeys by sailboat from the Turkish coast to Italian and Greek destinations, demanding payments of between EUR 9 000 and EUR 10 000 from each migrant. On the action day on 8 April 2025, seven key members of the criminal network were arrested (two in Italy, one in Germany, one in Albania, one in Türkiye and one in Oman) and another arrest warrant issued for a suspect already in custody in Italy.This investigation started after an incident in May 2022, when Italian authorities intercepted a sailing vessel off the Italian coast. The vessel, operated by Egyptian skippers, had allegedly departed from Türkiye with 87 irregular migrants of Afghan and Syrian nationality. Italian authorities uncovered a series of similar transports in various regions, orchestrated by the same criminal network. The Egyptian criminal network is believed to have had cells in Türkiye, Egypt, Greece and Italy, with individual members responsible for different tasks. These tasks ranged from recruiting skippers, communicating with irregular migrants via social media and instant communication platforms, transferring money and providing temporary accommodation along the route.Europol’s contribution to the operationIn the framework of the Operational Task Force established with Italy and Greece, Europol provided analytical support to the investigating countries and acted as an information hub between all partners. Europol’s experts in the fight against migrant smuggling analysed all information shared via SIENA and cross-checked it against Europol’s databases. In addition, Europol guest officers deployed to Italian hotspots provided further intelligence and reports and coordinated directly with law enforcement authorities on the ground. From its headquarters in The Hague, the Netherlands, Europol hosted several operational meetings organised in the framework of the Operational Task Force as well as with partner countries such as Türkiye. Several partners, including non-EU countries relevant to the investigation, contributed to and supported the investigation leading up to the arrests on 8 April 2025.On the action day, Eurojust supported the judicial cooperation with Germany by transmitting the relevant legal requests for the arrest and searches to the relevant authorities. INTERPOL facilitated the arrests in non-EU countries. A Europol migrant smuggling expert was deployed to Germany while Europol guest officers based in the Italian hotspots were deployed to several locations in Italy. They supported the national authorities by checking the newly discovered information against Europol’s databases, providing forensic expertise and coordinating with their colleagues at headquarters. Participating countries:Italy: National Police - SCO (Polizia di Stato - Servizio Centrale Operativo); Anti-Mafia Prosecution Office of Catania (Direzione Distrettuale Antimafia di Catania)Greece: Hellenic Coast Guard (Λιμενικο Σωμα), Hellenic Police (Ελληνικη Αστυνομια)Germany: State Police Rhineland-Palatinate (Landespolizei Rheinland-Pfalz); General Public Prosecutor’s Office Zweibrücken (Generalstaatsanwaltschaft Zweibrücken)Participating agencies:EurojustINTERPOL

The operation took place on 7 April and resulted in:3 suspects arrested in Italy600 counterfeit euro banknotes seized in denominations of EUR 10, 20, 50, and 100 for a total value of around EUR 50,000Print shop producing counterfeit euro banknotes dismantledIllegal mint (stamping press) dismantledCryptocurrency payments and shipping through postal serviceThe investigation, which began in 2024, revealed that a criminal organisation operating in southern Italy was distributing large quantities of counterfeit EUR 10, 20, 50 and 100 banknotes across the eurozone. Austria, Belgium, France, Germany and Spain received most of the fake currency. The criminal group showed a high level of technical expertise and internal organisation. The leader of the gang sold the counterfeit banknotes via an online messaging platform, with buyers making payments in cryptocurrency. Once the payments were confirmed, the fake banknotes were sent through the regular postal service.Investigators also discovered that the same criminal group had established an illegal 2-euro coin mint in northern Italy. Authorities dismantled the illegal mint during the operation, along with a printshop for counterfeit euro banknotes in southern Italy.Europol’s role in the fight against counterfeitingDuring the investigation, Europol facilitated the exchange of information and financed and coordinated several operational activities. Europol’s analysts also provided analytical support to identify the country where the banknotes were distributed. On the action day, Europol sent three experts to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems. Criminal finances are one of the common elements of the key threats identified in Europol’s EU Serious and Organised Crime Threat Assessment (EU-SOCTA). These threats are progressively destabilising the EU and are nurtured online, as criminal networks gradually exploit digital and online infrastructures, including messaging platforms, as in this operation.  Authorities involved in the investigation:Austria: Federal Police (CIS)Belgium: Federal Police (OCRFM)France: National Police (OCRFM)Germany: Federal Police (BKA)Italy: Carabinieri (CCAFM)Spain: Brigada de Investigación Banco de España (BIBE, Spanish Police)

Although biometric recognition systems are generally robust, provided they are well-secured and implemented correctly, academic research shows that there are ways to trick these systems. Examples include the use of masks, artificial fingerprints or deepfakes to bypass biometric authentication mechanisms. As authentication increasingly relies on biometric identification, it is crucial for law enforcement to understand the associated vulnerabilities. By researching and identifying how criminals might exploit weaknesses, authorities can take more effective and targeted countermeasures. This new Europol report identifies potential ways of exploiting vulnerabilities, thus enabling law enforcement agencies to update their systems and detect such incidents during investigations. Building on expertise to stay ahead of tech-savvy criminals Law enforcement must work closely with experts in the field to gain insight into potential attacks, so that any attempts at exploitation will be detected early on. Encouraging collaboration across relevant disciplines, such as biometrics, forensics and cybersecurity, is essential to staying ahead of this threat. Authorities must also take steps to detect and document any attempted attacks to understand the progress criminals are making in exploiting potential weaknesses in biometric recognition systems. The report shows how law enforcement and academic experts have joined forces to identify and address the challenges posed by these technological developments, with a view to strengthening their community and keeping European citizens safe.Access the Biometric vulnerabilities reportAt a time when technology is rapidly transforming the nature of crime, the Europol Innovation Lab stands at the forefront of innovation, empowering the law enforcement community to stay ahead of emerging threats. The Lab’s 5th anniversary in 2025 marks five years of innovation, collaboration and progress in addressing the complex challenges of evolving technology and criminal methodologies.  

The members of the gang were involved in environmental crime, money laundering and document fraud. They exploited business structures and coordinated a supply chain for illegal plant protection products based in Italy, Portugal and Spain since 2020.The investigation was led by Spain (Guardia Civil). Given the complexity of the criminal network, the police operation was carried out in two phases: the first between June 2024 and January 2025 with the support of French authorities, and the second between June 2024 and January 2025 with the support of Italian authorities.Overall results of the investigation:29 arrests (22 in the first operation, 7 in the second)26 tonnes of illegal pesticides seized14 bank accounts frozenCriminal assets worth EUR 350 000 frozenEuropol’s expertise, key to successEuropol’s experts on environmental crime supported the investigation by providing analytical support and coordinating and facilitating the exchange of information between national authorities.The investigation revealed a new criminal trend based on the use of coordinated structures and illicit supply chains to distribute unauthorised products, either because they have expired, are unregistered or lack the necessary authorisation.The suspects used falsified documents to introduce these illegal products into the market, often disguising them as fertilizers or motor oils to avoid detection. They also camouflaged containers of illegal products and used foreign banks for transactions to make their operations more difficult to trace.The gang was well organised, with each member playing a specific role to ensure the success of their criminal activities. This made the case especially challenging for investigators, as it was difficult to tackle such sophisticated criminal networks hidden behind legitimate businesses.Criminal exploitation of legal businessesMore than 85% of criminal organisations exploit legal businesses to transport illicit goods, expand their influence and, as in this case, launder the proceeds of crime. This problem is widespread across all EU Member States and other global regions.Europol is addressing this threat by bringing together law enforcement, regulatory bodies, the private sector and international allies to provide an integrated approach and reactive measures, targeting high-value targets through operational task forces.Authorities involved in the investigation:France: French Gendarmerie (L'Office central de lutte contre les atteintes à l’environnement et à la santé publique, OCLAESP)Italy: Carabinieri – Health Protection Command (Comando Tutela della Salute)Spain: Spanish Guardia Civil 

This year’s topic: ‘Making Europe Safer’Participants have to be part of law enforcement agencies of EU Member States or of countries that have agreements and working arrangements with Europol. The 2025 Europol photo competition casts a wide net, inviting submissions that showcase the many ways that law enforcement officers are actively ‘Making Europe Safer’. Europe’s security starts abroad, which is why Europol is looking forward to receiving images that provide a glimpse of the daily routine of law enforcement officers going about their work in partner countries as much as in EU Member States.As Europol’s work usually deals with crimes that require an international approach and cooperation between several countries, inside and outside the EU, images showing international law enforcement cooperation are particularly welcome. The photo competition will also show officers on patrol or involved in operational activities to combat organised crime. Entries can give insights into training exercises and manoeuvres, or highlight the vital role of community policing. Additionally, creative submissions that offer abstract and artistic interpretations of the theme ‘Making Europe Safer’ are welcome. This may entail showing unexpected perspectives, innovative photography techniques or imaginative compositions that push the boundaries of conventional photography. However, images created or enhanced by artificial intelligence will not be accepted, as traditional photography methods should remain at the core of this contest.For full details on how to participate, photographers are invited to visit the competition page. The deadline for submissions is Friday 8 August 2025.Law enforcement officers are invited to submit up to five photos. Whether those participating are professional police photographers or passionate amateurs, Europol is excited to see their photography skills in action! Anyone who is eligible and hopes to win a trip to Europol is therefore invited to go out there, capture the best moments of law enforcement in action, and show why this profession deserves respect and gratitude.Entries will be used in Europol publications, including calendars, social media and other communication materials. 

A total of 1.8 million users worldwide logged on to the platform between April 2022 and March 2025. On 11 March 2025, the server, which contained around 72 000 videos at the time, was seized by German and Dutch authorities.The investigation resulted in the identification of almost 1 400 suspects worldwide. So far, 79 of these individuals have been arrested for sharing and distributing child sexual abuse material (CSAM). Some of those arrested not only uploaded and watched videos but also abused children. The investigation is ongoing.Results of Operation StreamThe investigation started in 2022 and resulted in action weeks from 10 to 23 March 2025. So far, it has led to the following outcomes:1,393 suspects identified79 suspects arrestedOver 3,000 electronic devices seized39 children protectedOver 91 000 CSAM videosKidflix was created in 2021 by a cybercriminal who made a huge profit from it, as it quickly became one of the most popular platforms among paedophiles. According to authorities, 91 000 unique videos were uploaded and shared on the platform while it was active, with a total running time of 6 288 hours. On average, around 3.5 new videos were uploaded to the platform every hour, many of which were previously unknown to law enforcement.Unlike other known platforms of this kind, Kidflix not only enabled users to download CSAM but also to stream video files. Users made payments using cryptocurrencies, which were subsequently converted into tokens. By uploading CSAM, verifying video titles and descriptions and assigning categories to videos, offenders could earn tokens, which were then used to view content. Each video was uploaded in multiple versions – low, medium and high quality – allowing criminals to preview the content and pay a fee to unlock higher quality versions.The largest child sexual exploitation operation in Europol’s historyOperation Stream has been the largest operation ever handled by Europol’s experts in fighting child sexual exploitation, and one of the biggest cases supported by the law enforcement agency in recent years.During the investigation, Europol’s analysts from the European Cybercrime Centre (EC3) provided intensive operational support to national authorities by analysing thousands of videos. Europol’s experts also cross-checked all available data and provided evidence to the relevant countries to facilitate the investigation. Given the scale of the case, Europol’s role in coordinating the exchange of information during the investigation and the action days was crucial to its success. Bringing partners together for cross-border cooperation and joint action is one of Europol’s main priorities in order to strengthen the fight against all forms of serious international and organised crime, cybercrime and terrorism.Catherine De BolleEuropol Executive DirectorThe digital dimension has driven a rapid evolution in online child sexual exploitation, offering offenders a borderless platform to contact and groom victims, as well as to create, store, and exchange child sexual abuse material. Some attempt to frame this as merely a technical or cyber issue – but it is not. There are real victims behind these crimes, and those victims are children. As a society, we must act to protect our children.Magnus BrunnerEU Commissioner for Internal Affairs and MigrationThe dismantling of this criminal network demonstrates the added value that EU agencies like Europol provide. This is precisely why the European Commission has presented a strategy for greater security in Europe. Criminals operate across borders, so we must also support investigators in doing the same.What happens online, stays onlineChild sexual exploitation (CSE) is one of the key threats to the EU’s internal security identified in the recently published EU Serious Organised Crime Threat Assessment report (EU-SOCTA). The digital dimension has triggered a rapid evolution of online CSE, providing offenders with a borderless platform to contact and groom victims, as well as to create, store and exchange CSAM. This trend will continue to grow in the coming years. However, the online world is not anonymous. Most of the suspects identified in Operation Stream were matched against records in Europol’s databases, proving that most offenders engaged in child sexual exploitation are repeat offenders and are not unknown to law enforcement authorities.Child sexual exploitation is a major threat and therefore one of the EU’s priorities in the fight against serious and organised crime. Since 2017, Europol has been running the Stop Child Abuse – Trace An Object initiative, encouraging citizens to identify objects to help police save abused children. At the request of EU Member States and other partners, Europol hosts a Victim Identification Taskforce twice a year, an initiative that brings together law enforcement to localise investigations and identify victims. Children in Germany and Australia have benefited from this project, which has provided them with protection.Participating countries:1. Albania: Albanian State Police, Directorate for the Investigation of Cyber Crime in the Criminal Police Department and Directorate of the Special Operational Force (Policia e Shtetit, Drejtoria për Hetimin e Krimeve Kibernetike, Drejtoria e Forcës së Posaçme Operacionale)2. Australia: Australian Federal Police (AFP)3. Austria: Criminal Intelligence Service (Bundeskriminalamt)4. Belgium: Belgian Federal Police (Federale Politie / Police Fédérale)5. Bulgaria: Cybercrime Directorate - General Directorate for Combating Organized Crimes, Ministry of Interior (Дирекция "Киберпрестъпност" - Главна дирекция "Борба с организираната престъпност", Министерство на вътрешните работи)6. Canada: Royal Canadian Mounted police (RCMP) - National Child Exploitation Crime Centre (NCECC), Ontario Provincial Police, Ottawa Police, Saskatchewan Internet Child Exploitation Unit, Northern Alberta Integrated Child Exploitation Unit7. Colombia: Police Cybernetic Center C4 (Policía Nacional de Colombia), National Police of Colombia (Dirección de Investigación Criminal e Interpol), Criminal Investigation and Interpol Directorate (Centro Cibernético Policial C4)8. Croatia: National Cybercrime Department (Služba kibernetičke sigurnosti)9. Cyprus: Cybercrime Unit – Cyprus Police (Υποδιεύθυνση Ηλεκτρονικού Εγκλήματος – Αστυνομία Κύπρου)10. Czech Republic: Bureau of Criminal Police and Investigation Service, Criminal Police and Investigation Service of the Regional Police Directorate of the Capital City of Prague, Criminal Police and Investigation Service of the Regional Police Directorate of Liberec, Ústí nad Labem, Pardubice, South Bohemian, Plzeň and South Moravian11. Denmark: National Cyber Crime Centre (NC3) at Special Crime Unit (SCU/NSK) and Danish National Police (Dansk Politi)12. Estonia: Estonian Police, Estonian Police and Border Guard Board (Politsei- ja Piirivalveamet)13. Finland: National Bureau of Investigation (Keskusrikospoliisi), Western Uusimaa Police Department (Länsi-Uudenmaan poliisilaitos), Eastern Finland Police Department (Itä-Suomen poliisilaitos), Oulu Police Department (Oulun poliisilaitos)14. France: Police department for the protection of children (OFMIN) of the national directorate of judicial police (DNPJ)15. Germany: State Criminal Police of Bavaria (Bayerisches Landeskriminalamt), Bavarian Central Office for the Prosecution of Cybercrime (ZCB), Federal Criminal Police Office (Bundeskriminalamt, BKA)16. Georgia: Central Criminal Police Department of the Ministry of Internal Affairs of Georgia (საქართველოს შინაგან საქმეთა სამინისტროს ცენტრალური კრიმინალური პოლიციის დეპარტამენტი)17. Greece: Cyber Crime Division (Διεύθυνση Δίωξης Ηλεκτρονικού Εγκλήματος) 18. Hungary: National Bureau of Investigation Cybercrime Department Investigative Division (Nemzeti Nyomozó Iroda Kiberbűnözés Elleni Főosztály Nyomozó Osztály)19. Iceland: Reykjavik metropolitan police (Lögreglan á Höfuðborgarsvæðinu)20. Ireland: An Garda Síochána21. Italy: National Police – Postal and Cyber Security Police Service (Polizia di Stato - Servizio Polizia Postale e per la Sicurezza Cibernetica)22. Latvia: Cybercrime Enforcement Department of Central Criminal Police Department of the State Police of Latvia (Valsts policijas Galvenās kriminālpolicijas pārvaldes Kibernoziegumu apkarošanas pārvalde)23. Lithuania: Lithuanian Criminal Police Bureau (Lietuvos kriminalines policijos biuras)24. Luxembourg: Police Luxembourg - Criminal Investigation Department - Sexual offences and juvenile delinquency (Police Luxembourg - Service de Police Judiciaire - Section Protection de la Jeunesse et Infractions à Caractère Sexuel)25. Malta: Malta Police Force (Il-Korp tal- Pulizija ta’ Malta)26. Netherlands: National Police (Politie)  27. New Zealand: New Zealand Police28. Norway: NCIS – Norway (Kripos)29. Poland: Central Cybercrime Bureau (CBZC)30. Portugal: Judicial Police (Polícia Judiciária)31. Romania: Romanian Police (Poliția Română).32. Serbia: Service for combating High-Tech Crime, Directorate for Technology, Ministry of Internal Affairs (Služba za borbu protiv visokotehnološkog kriminala, Uprava za tehniku, Ministarstvo unutrašnjih poslova)33. Slovakia: Police Force of the Slovak Republic (Policajný zbor Slovenskej republiky)34. Spain: Spanish National Police (Policía Nacional)35. Sweden: Swedish Police Authority, National Cybercrime centre CSE/CSA-team and the local CSA/CSE teams of region Stockholm, Mitt, Bergslagen and Syd (Polismyndigheten Nationellt IT-brottscentrum, Internetrelaterade sexuella övergrepp mot brott mot barn (ISÖB) and regionala ISÖB-grupperna i Stockholm, Mitt, Bergslagen och Syd)36. Switzerland: Federal Office of Police fedpol (Bundesamt für Polizei fedpol), Police Basel-Landschaft (Polizei Basel-Landschaft), Aargau Cantonal Police (Kantonspolizei Aargau), Bern Cantonal Police (Kantonspolizei Bern), Geneva Cantonal Police (Police cantonale de Genève), Thurgau Cantonal Police (Kantonspolizei Thurgau), Vaud Cantonal Police (Police cantonale vaudoise), Zurich Cantonal Police (Kantonspolizei Zürich)37. United Kingdom: National Crime Agency (NCA)38. United States: Homeland Security Investigations

MDMA production raises safety and environmental concernsMDMA is primarily produced via the so-called 'high-pressure' method, using large industrial reactors. However, criminal networks are constantly adapting their production methods in response to shortages of equipment or chemicals. For example, changes in the availability of 'high-pressure' reactors have led producers to switch to the ‘cold method’. This alternative MDMA production method has been associated with fires and explosions, increasing the risk of harm to local populations, first responders and the areas surrounding production facilities. MDMA production also generates significant chemical waste. It is estimated that, in the EU, it may have generated between 1 155 and 3 191 tonnes of chemical waste in 2021, typically dumped away from the production sites, causing health hazards, environmental damage and costly clean-ups. The safety and environmental risks associated with MDMA production underline the market’s broader societal impacts.  MDMA trafficked from the EU to Latin America: a reverse cocaine route?Outside the buoyant EU drug market, profitable markets in Oceania and Asia appear to be the main destinations of MDMA shipments from Europe, but there are signs that Latin America is becoming an increasingly important market — a shift requiring close monitoring. Traditionally, drug trafficking routes between Latin America and Europe have been dominated by cocaine exports. However, there have been reports that these routes are also used to traffic MDMA in the opposite direction. In some cases, criminals based in the EU and Latin America engage in barter deals, where MDMA is exchanged for cocaine, with no monetary exchange. Innovation in precursor chemicals remains a challengeThe supply of precursors and essential chemicals plays a key role in MDMA production, typically assured by dedicated criminal networks with links to legitimate business. MDMA producers bypass legal controls on the precursor used to make MDMA (PMK) by using alternative unregulated substances that are mainly sourced from China and converted into PMK in Europe. Since 2013, seizures of these alternative chemicals have surpassed those of PMK in Europe, challenging authorities’ efforts to control MDMA production in the EU. High-strength ecstasy tablets still pose risksFollowing successive years of rising amounts of MDMA in ecstasy tablets (2011–2019), this trend seems to have reversed, with the average MDMA content falling from 170 mg in 2019 to 144 mg per tablet in 2022. Nevertheless, potent tablets are still circulating.Social media platforms and instant messaging apps have become particularly dynamic channels through which MDMA is sold to consumers. Mixtures of MDMA, ketamine and additional substances, sold as 'tucibi' or 'pink cocaine' are also increasingly available.Addressing current threats and boosting preparednessToday's report takes a threat assessment approach, presenting key issues and recommendations for action at EU and Member State level to address the challenges posed by the MDMA market. The key areas for action include: improving the strategic intelligence picture, strengthening responses to reduce supply and enhance security, boosting international cooperation, investing in capacity-building, and strengthening policy, public health and safety responses.Catherine De BolleEuropol Executive Director‘Europe is a key player in the synthetic drugs market and a global supplier of MDMA, both producing and trafficking for domestic and international markets. Legal business structures are often exploited to obtain chemicals and equipment for drug production, which is characterised by continuous innovation. A further spread of production facilities throughout Europe is also highly likely, posing an additional threat to our societies. That's why Europol identifies drug trafficking as one of the key threats for the EU and prioritises the fight against this sort of serious and organised crime.'Alexis GoosdeelEUDA Executive Director'Understanding the evolving MDMA market is essential for developing effective responses. MDMA remains a popular drug in nightlife and music festival settings, so ecstasy tablets that contain high amounts of MDMA, or unexpected ingredients, pose serious risks. Harm reduction measures, like drug-checking services, are crucial to mitigate the dangers. Tailored prevention and treatment services are more critical than ever, as MDMA tablets may contain new psychoactive substances that could have harmful consequences. Today’s report also highlights how illicit MDMA production in Europe depends on access to precursor chemicals. Reducing their availability is essential to disrupt production and enhance public safety. That is why the EU Drugs Agency is supporting the European Commission in monitoring drug precursor diversion and trafficking and implementing precursor regulations.'

Criminals haunted by their chatsThis high-risk criminal network coordinated the drug trade using these sophisticated communication channels, relying on both encryption and multi-platform distribution. The sophistication of their communications was in stark contrast to the simplicity of their modus operandi; it consisted of smuggling cocaine and marijuana across the continent in vehicles equipped with custom-made secret compartments and cloned number plates.Europol’s supportEuropol has provided support for this investigation since November 2023, with experts from several crime fields contributing to its success. The information gathered during the Ghost takedown not only provided evidence of individual drug shipments but, more importantly, helped investigators piece together the network’s organisational structure.On the action day, Europol deployed two experts with mobile offices to Spain and Ireland to provide immediate support in analysing and securing evidence. The investigation and the action day were supported by the @ON Network, funded by the EU (Project ISF4@ON), which facilitated in-person meetings and the deployment of Irish and Spanish officers during the action days.See footage from the action day here: 

Europol supported the French National Police (Police Nationale/OLTIM) and the Spanish National Police (Policía Nacional) in dismantling an organised criminal network smuggling migrants from Spain to France.The investigation was initiated in November 2022 and targeted individuals, based in Marseille, suspected of smuggling migrants between Spain and France. Europol’s analysis of the operational data made it possible to identify additional suspects linked to this criminal organisation and further advance the case.The action day on 16 March 2025 led to:19 arrests17 house searchesSeizures including a semi-rigid boat, 4 vehicles and about EUR 20 000 in cashOver 1 700 migrants smuggled in nearly 500 operationsMigrants were picked up near train stations in Catalonia, Spain and then transported to the French city of Marseille. Each member of the criminal network had a specific task. Some recruited migrants, others arranged transport and some provided temporary accommodation. During car smuggling operations, the criminal network used forerunner vehicles to detect potential law enforcement checkpoints along the route to help them bypass police or customs controls.The smuggling network operated in a structured way to prepare and execute the smuggling activities. The criminal network charged between EUR 150 and EUR 250 per migrant, depending on the departure point and destination. The suspects smuggled migrants from the Maghreb region, but also from the Middle East, mainly from Syria and from Sub-Saharan Africa. Between May 2023 and August 2024, more than 500 smuggling operations were organised with an estimated turnover of between EUR 250 000 and EUR 427 000 from about 1 700 migrants transported to France.Europol facilitated the exchange of information and provided operational coordination and analytical support. During the action day, Europol deployed an expert to France to enable the real-time exchange of information and cross-check operational information against Europol’s databases to provide leads to investigators in the field. 

The fraud scheme centred on fraudulent reimbursements for hearing aids exploiting France’s public health insurance system. In July 2024, the fraudsters set up fictitious hearing aid companies, using usurped diplomas to secure accreditation from health authorities and contracts with the French health insurance fund. Armed with stolen patient details, they issued false invoices, leading to EUR 6.7 million in fraudulent reimbursements. The illicit funds were then channelled through dozens of shell companies across Europe.On 10 March, French authorities arrested eight key suspects involved in the fraudulent scheme, which exploited France’s healthcare system. The French Gendarmerie carried out searches at the suspects’ residences, a doctor’s home and a medical centre. Officers seized EUR 195 000 in criminal assets, including EUR 111 000 from bank accounts, as well as luxury items and electronic devices.Building on intelligence from the French operation, authorities in Germany launched a second phase of the investigation to target the laundering of the fraud’s proceeds.On 17 March, German law enforcement, supported by French investigators from the Gendarmerie and Europol, carried out a large-scale action against a major company suspected of funnelling illicit funds. Law enforcement officers searched eight locations, including the company’s headquarters, an accountancy firm, a warehouse and several residences linked to senior figures in the scheme.The German operation involved over 100 officers and resulted in the seizure of real estate, 73 high-end vehicles and EUR 260 000 in cash.Europol’s supportEuropol provided key analytical and operational support, helping investigators trace the flow of illicit funds and uncover links to other criminal cases. Its intelligence enabled authorities to map out the laundering network behind the fraud.During the action days, Europol deployed specialists on the ground with a mobile office for real-time cross-checks and digital forensic support. It also facilitated coordination between French and German investigators, funding logistical support to ensure the smooth execution of operations.The following authorities took part in this investigation:France: French National Gendarmerie (Gendarmerie Nationale - OCLTI)Germany: Police Headquarters South-East Hesse (Polizeipräsidium Südosthessen)

On 19 March 2025, an operation involving law enforcement and judicial authorities from Belgium and Germany, coordinated by Europol, targeted a migrant smuggling network active across the English Channel. The operation was also supported by Italy and Eurojust. The investigation targeted a criminal network based in Germany and involved in criminal activities facilitating the smuggling of Middle Eastern and East African migrants across the English Channel with low-quality inflatable boats.Officers from the German Federal Police (Bundespolizei) raided several houses and storage spaces under search and arrest warrants issued by the Belgian Court and executed under the supervision of the Public Prosecutor’s Office of Düsseldorf. One arrest following a European Arrest Warrant issued by Belgium was also made in the region of Calabria by the Italian authorities. Ten Belgian investigators were deployed to the German region of North Rhine-Westphalia to support the operational activities on the ground. The action day on 19 March led to:6 arrests (5 in Germany and 1 in Italy) under Belgian judicial order11 locations (8 houses and 3 storage spaces) searched in GermanySeizures include: 90 life vests, jerrycans, 2 firearms and more than 47 electronic devices.The criminal network, active since 2023, transported nautical equipment from storage spaces in Germany to France. Drivers recruited via online platforms for this purpose transported the boats, jackets and other gear in modified vehicles with darkened windows and special compartments for the transportation of the equipment. The criminal network was highly coordinated, arranging several trips per day. The illicit proceeds were laundered via the Hawala underground banking system. Key suspect arrested earlierIn the lead-up to this large-scale operation, one of the main suspects had already been arrested. On 10 March, a 25-year-old Iraqi national residing in Germany was apprehended early in the morning at Charleroi Airport while attempting to board a flight to Greece. He was interrogated by investigators and brought before the investigative judge on 11 March, who ordered his detention on suspicion of human smuggling and involvement in a criminal organisation.Migrant smuggling: An ongoing lethal threatSince 2019, migrant smuggling via small boats has steadily risen, surpassing lorries in 2021 as the primary method of transporting migrants from the EU to the UK. The criminal networks behind these operations remain highly active, increasingly violent and highly adaptable, continuously developing new crossing techniques. The criminal networks are using increasingly dangerous modi operandi and increasing the risk to life by transporting higher numbers of migrants per boat.In 2024, more than 36 000 migrants and 680 boats successfully reached the UK, up from approximately 28 000 migrants and 580 boats during the same period in 2023. The number of lives lost has also risen – 78 deaths at sea were recorded in 2024, compared to 12 in 2023. So far in 2025, 4 000 migrants have successfully reached the UK, 2 000 of whom arrived in the past three weeks.EU-wide cooperation to steer operational actionsIn July 2022, the first Operational Taskforce (OTF) on migrant smuggling via small boats dismantled the largest network facilitating crossings from France to the UK. Europol then launched a second OTF to combat other criminal groups smuggling migrants across the English Channel, a life-threatening crossing method. Coordinated by Europol, this Taskforce includes Belgium, France, Germany, the Netherlands and the UK. It targets the entire smuggling chain – from migrant recruitment to logistical operations and key organisers – focusing on High Value Targets to dismantle criminal networks. Europol experts, fully engaged in the OTF, have helped to uncover links between multiple national investigations.Europol created a dedicated financial instrument to support high-profile investigations and assist participating countries. It oversaw the coordination of investigative activities and organised multiple operational meetings for the Taskforce members. On the action day, Europol facilitated the deployment of 10 investigators from Belgium and one from France to various locations in Germany. Additionally, a Europol expert was sent into the field to help German authorities cross-check operational information in real time against Europol’s databases.Eurojust facilitated cross-border judicial cooperation by enabling information exchange and aligning investigative efforts. Through Eurojust, judicial authorities issued European Investigation Orders and Arrest Warrants, ensuring all legal instruments were in place.Law enforcement authorities involved in the action day:Belgium: Belgian Federal Police (Federale Politie / Police Fédérale)Germany: German Federal Police (Bundespolizei) Italy: National Police (Polizia di Stato) and Financial Guard (Guardia di Finanza)Judicial authorities involved in the action day:Belgium: Investigating judge West Flanders division BrugesGermany: Düsseldorf Public Prosecutor’s Office (ZeOS), General Prosecutor’s Offices of Hamm.  

A changing DNA: how organised crime is mutatingJust as DNA shapes the blueprint of life, the blueprint of organised crime is being rewritten. No longer bound by traditional structures, organised crime has adapted to a world shaped by global instability, digitalisation and emerging technologies.The EU-SOCTA identifies three defining characteristics of today’s serious and organised crime landscape:1. Crime is increasingly destabilisingSerious and organised crime is no longer just a threat to public safety; it impacts the very foundations of the EU’s institutions and society. The destabilising properties and effects of serious and organised crime can be seen on two fronts: Internally, through the laundering or reinvestment of illicit proceeds, corruption, violence and the criminal exploitation of young perpetrators;Externally, with criminal networks increasingly operating as proxies in the service of hybrid threat actors, a cooperation which is mutually reinforcing.2. Crime is nurtured online Digital infrastructures drive criminal operations – enabling illicit activities to scale up and adapt at unprecedented speed.Nearly all forms of serious and organised crime have a digital footprint, whether as a tool, target or facilitator. From cyber fraud and ransomware to drug trafficking and money laundering, the internet has become the primary theatre for organised crime. Criminal networks increasingly exploit digital infrastructure to conceal their activities from law enforcement, while data emerges as the new currency of power – stolen, traded and exploited by criminal actors.3. Crime is accelerated by AI and emerging technologiesAI is fundamentally reshaping the organised crime landscape. Criminals rapidly exploit new technologies, using them both as a catalyst for crime and a driver of efficiency. The same qualities that make AI revolutionary – accessibility, adaptability and sophistication – also make it a powerful tool for criminal networks. These technologies automate and expand criminal operations, making them more scalable and harder to detect.The fastest-growing threats This evolving criminal DNA is embedded in the most pressing security threats identified in the EU-SOCTA 2025. The report highlights seven key areas where criminal networks are becoming more sophisticated and dangerous:Cyber-attacks, mostly ransomware but increasingly attacks targeting critical infrastructure, governments, businesses and individuals – often with state-aligned objectives.Online fraud schemes, increasingly driven by AI-powered social engineering and access to vast amounts of data including stolen personal information.Online child sexual exploitation, with generative AI producing child sexual abuse material and facilitating online grooming.Migrant smuggling, with networks charging extortionate fees and showing complete disregard for human dignity, exploiting geopolitical crises.Drug trafficking, a diversifying market with changing routes, modus operandi and the potential further spread of violence and recruitment of young people across the EU.Firearms trafficking, which is expanding due to technological advancements, online marketplaces and weapons availability in Europe.Waste crime, an often overlooked but lucrative sector where criminals exploit legitimate businesses, severely impacting the environment. While some threats play out in the physical world, elements of every criminal process are increasingly moving online – from recruitment and communication to payment systems and AI-driven automation. Breaking the criminal code The key criminal threats identified in the EU-SOCTA 2025 share common reinforcing elements that sustain and amplify them in different ways. To tackle these threats effectively, law enforcement must take these cross-cutting elements into account when designing strategies to tackle serious and organised crime.The DNA of serious and organised crime is strongly embedded in the way criminal networks operate, as they find opportunities to act as proxies for hybrid threat actors in the online realm and use AI and technology for criminal purposes. In addition, criminal networks operate across borders or even from within prison, adapting their tactics to benefit their operations.Criminal finances and money laundering methods continue to evolve, with illicit proceeds increasingly channelled into a parallel financial system designed to protect and grow criminal wealth. Digital platforms and emerging technologies such as blockchain facilitate this system, making it more resilient to disruption.Corruption remains one of the most insidious enablers of organised crime, facilitating illicit activities across all sectors. It has adapted to the digital age, with criminals increasingly targeting individuals who have access to critical digital systems and using digital recruitment tactics to extend their reach.Organised crime-related violence is intensifying in several Member States and spilling over into wider society. This violence moves with and is shaped by criminal markets prone to competition and conflict. It is further fuelled by encrypted communication tools and online platforms that facilitate borderless recruitment, extortion and coordination.The criminal exploitation of young perpetrators not only tears at the social fabric but also serves as a protective layer for criminal leadership, shielding those at the top from identification or prosecution.These reinforcing tactics allow criminal networks to expand, maximise profits and strengthen their resilience, creating a self-perpetuating cycle. Breaking this cycle requires law enforcement to integrate strategies that target both the key criminal markets and the underlying mechanisms that sustain them.Catherine De BolleEuropol Executive DirectorThe very DNA of organised crime is changing. Criminal networks have evolved into global, technology-driven criminal enterprises, exploiting digital platforms, illicit financial flows and geopolitical instability to expand their influence. They are more adaptable, and more dangerous than ever before. Breaking this new criminal code means dismantling the systems that allow these networks to thrive – targeting their finances, disrupting their supply chains and staying ahead of their use of technology. Europol is at the heart of Europe’s fight against organised crime, but staying ahead of this evolving threat means reinforcing our capabilities – expanding our intelligence, operational reach and partnerships to protect the EU’s security for the years to come.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationOur security landscape is evolving dramatically. The SOCTA report clearly shows how serious and organised crime - and the threat it poses to our security - is also changing. We need to make every effort to protect the European Union. Our internal security strategy will address these challenges.Tomasz SiemoniakPolish Minister of the Interior and AdministrationPoland, as an EU country bordering an active war, is fully mobilised to identify and neutralise emerging threats. Our focus spans drug and human smuggling—especially its digital dimension—human trafficking, criminal infiltration of legal structures, hybrid threats, and the illicit arms trade. Security is the core of our presidency as we shape the next EMPACT cycle, laying the foundation for international police cooperation. Guided by SOCTA, we are committed to strengthening EMPACT and Europol to ensure EU support meets Member States’ real needs in an evolving geopolitical landscape.The EU-SOCTA 2025 is more than just an intelligence assessment – it serves as the foundation for Europe's strategic approach to tackling serious and organised crime. Based on its findings, the Council of the European Union sets priorities for law enforcement action, guiding the development of operational plans of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) for the next four years.

A large-scale drug trafficking investigation, supported by Europol, led to the dismantling of an Ecuadorian criminal cell involved in supplying wholesale cocaine to the EU via major ports. The international operation, led by the Ecuadorian National Police (Policía Nacional del Ecuador), also involved the German Criminal Police (LKA Baden-Württemberg), German Customs (ZFA Stuttgart) and the Spanish Guardia Civil.The criminal structure targeted in Ecuador is part of an intercontinental criminal network involved in multi-tonne cocaine trafficking via sea containers from South America to Europe. This cell arranged the transport from Ecuador to Europe, managed money flows through different companies and frontmen, and maintained contact with the suppliers. The criminal cells operating in Germany and Spain – equipped with commercial and transport companies and drivers – handled the logistical part of the operation in Europe and the further distribution of the drugs within the EU.The action day on 13 March in Ecuador led to:36 arrests in Guayaquil50 house searchesSeizures including vehicles, documents and electronic equipment. This criminal network was importing large quantities of cocaine from Ecuador to ports in Belgium, Germany, the Netherlands and Spain. Drugs packages hidden in charcoal Since the start of the investigation in 2024, national authorities have seized 73 tonnes of cocaine Ecuador and the EU, and arrested 14 individuals in Germany and Spain for their alleged involvement in the criminal enterprise.Europol’s Executive Director Catherine De Bolle said: “Criminal networks operate seamlessly across oceans, and our response must be equally interconnected. Strengthening cooperation with Latin American countries is essential – tackling organised crime requires a global effort. Every country along the supply chain plays a crucial role in dismantling violent criminal networks at every level, from production to distribution. Only through coordinated international action can we disrupt their operations, weaken their influence and ensure the safety of our citizens."Europol’s efforts to disrupt the entire cocaine supply chainSince mid-2023, Europol has facilitated the exchange of information and provided continuous analytical support to the international investigation, part of which was driven by the work of a Europol taskforce. Europol contributed to the overall case coordination between various agencies and, on the action day, deployed two experts to Ecuador to provide analytical and specialised support.This operation reflects Europol’s strategy to systematically disrupt criminal networks by targeting all levels of the supply chain globally, as well as connected networks, including financial flows and laundering of criminal assets. The operation illustrates the increased cooperation with non-EU countries, which are key pillars in the fight against serious and organised crime. It follows a week of significant progress in partnerships with Latin America, including the finalisation of an EU-Ecuador agreement to enhance collaboration and exchange operational information, as well as a new milestone in Europol’s cooperation with Brazil, enabling the exchange of personal data. The week concluded with Europol hosting ministerial delegations from the Latin American Committee for Internal Security (CLASI), reinforcing its commitment to deeper regional engagement.At the same time, this operation builds on ongoing efforts by EU Member States and Europol to tackle the most threatening criminal networks within the EU, particularly those embedded in major ports. By uniting Member States in a coordinated response, the aim is to dismantle logistical networks linked to command-and-control centres that undermine the EU’s internal security. To further this effort, Europol has partnered with the ports of Rotterdam, Antwerp and Hamburg/Bremerhaven to publish a joint analysis report outlining the risks and challenges posed by criminal networks in EU ports.

Europol’s EU Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA 2025) is a unique, intelligence-driven report offering forward-looking insights into how organised crime is changing – and its impact on our societies.As the cornerstone of EU crime priority setting, this assessment will guide law enforcement strategies and EU policies in tackling Europe’s most pressing criminal threats.Stay tuned for key findings that will shape the future of security in the EU. Join us for a press conference announcing the publication of this flagship report, where we will unveil key findings and discuss their impact on security in Europe.Date and time: Tuesday 18 March 2025, 13:00 CETSpeakers:Europol’s Executive Director Catherine De BolleCommissioner for Internal Affairs and Migration Magnus BrunnerPolish Undersecretary of State Maciej DuszczykCommander-in-Chief of the Polish Police Marek BorónPlace: Europol’s headquarters in The Hague, the Netherlands.Online: This press conference will also be live-streamed on the homepage of Europol’s website. Registration is not necessary to follow the livestream.RSVP: Journalists interested in attending this press conference in person at Europol’s headquarters are requested to RSVP to press@europol.europa.eu by Monday 17 March at 16:30 CET. Please send your full name + date of birth for registration. Valid ID credentials are required for admittance.Ground rules: On-the-record press conference. The conference room will be available for media to set up from 12:30 CET and everything must be pre-set by 12:55 CET. The media communications and the report will be published on Europol’s website on the day at 13:00 CET.For all media inquiries: press@europol.europa.eu

On 7 March 2025, Europol welcomed ministerial delegations from the Latin American Committee for Internal Security (CLASI) to its headquarters in The Hague. The visit marked the final day of the delegates’ official tour, following two days of high-level meetings in Brussels on the margins of the Justice and Home Affairs (JHA) Council on 5 March. Facilitated through the EU-funded EL PACCTO 2.0 project, the visit was aimed at strengthening cooperation between Latin American law enforcement authorities and Europol, enhancing strategic dialogue on tackling security threats such as organised crime and terrorism.Strengthening EU-Latin American cooperationEstablished in March 2022, CLASI plays a key role in coordinating efforts to combat serious and organised cross-border crime in Latin America. CLASI is supported by the EU-funded EL PACCTO 2.0 project, which aims to enhance security and justice in Latin America by supporting efforts to combat transnational organised crime. EL PACCTO 2.0 addresses the entire criminal chain through three key components: police, justice and the penitentiary system.Europol’s engagement with CLASI aligns with its commitment to supporting international cooperation against transnational crime. Several CLASI member countries, including Colombia, Chile, Ecuador and Mexico, already have agreements with Europol, and CLASI provides a framework for further strategic commitment. Just this week, the EU and Brazil signed an international agreement to fight organised crime and terrorism, which enables the exchange of operational information between Europol and Brazil. The initiative is endorsed by the EU Council, the European External Action Service and the European Commission. This visit focused on aligning Latin American security efforts with EMPACT to improve coordination in addressing common security challenges.Europol’s Executive Director, Catherine De Bolle, underscored the importance of this collaboration: Today, it is of great importance that the EU fosters an even higher level of cooperation with the countries of Latin America. Organised crime is truly global – we see it in every aspect of our work. Europol is fully dedicated to deepening our collaboration with our Latin American partners, ensuring that intelligence sharing, strategic coordination and joint operations continue to evolve in response to the growing common challenges that we currently face.Addressing common security challenges Discussions highlighted key security concerns, including the resilience of ports and other entry points, which are critical in the fight against serious and organised crime. Both Europe and Latin America face common threats such as drug trafficking, trafficking of weapons and explosives, cybercrime, organised property crime and financial and environmental crime. Criminal networks continue to exploit the digital age, legislative loopholes and border vulnerabilities, underscoring the need for a unified approach. As this visit marks the second CLASI delegation to Europol since 2022, it is a testament to the growing partnership between the European Union and Latin America on security matters. Europol remains committed to strengthening coordination, joint efforts and responses to emerging security threats, recognising that cross-border crime cannot be tackled in isolation.

The agreement was signed today by Commissioner for Home Affairs and Migration, Magnus Brunner, and the Minister of Justice and Public Security of Brazil, Ricardo Lewandowski, in the presence of Europol’s Executive Director, Catherine De Bolle.Brazil has been a key partner for Europol since 2017, with a strong record of operational cooperation across various crime areas, including drug trafficking, cybercrime and human trafficking. This agreement will further strengthen law enforcement collaboration, helping to disrupt criminal networks and combat transnational crime more effectively.Brazil is the first country in Latin America to sign such an agreement with the EU. The agreement is now subject to the European Parliament’s consent before its final implementation. Europol stands ready to support its full execution, further deepening operational engagement with Brazil in the fight against serious organised crime.Commissioner for Internal Affairs and Migration, Magnus Brunner, said: ‘International cooperation is a cornerstone of our work to strengthen the internal security of the EU and our partners. This agreement will provide us with the opportunity to enhance information exchange with a key partner, Brazil, and in turn increase Europol's support to Member States' cross-border criminal investigations.’Europol’s Executive Director, Catherine De Bolle, added: ‘This agreement marks a new chapter in our trusted partnership with Brazil. By strengthening our operational cooperation, we are enhancing our ability to tackle the most pressing security threats together. Europol remains committed to working hand in hand with the Brazilian authorities to combat serious and organised crime.’Cooperation with non-EU countries is a crucial component of Europol’s strategy to fight serious and organised crime. By strengthening operational ties with trusted international partners, Europol enhances the ability of EU law enforcement authorities to tackle transnational threats. Agreements like the one signed with Brazil reinforce Europol’s global network, allowing for a more coordinated approach to combating criminal networks that operate across borders.Recent operational examples involving Brazil include:Cocaine cartel collapses after final arrests in Spain (June 2024)One of Europe’s most wanted drug traffickers behind bars and 16 arrested in Brazil (October 2023)Balkan cartel sinks as Spain seizes 2.7 tonnes of cocaine on board large vessel (September 2023)15 arrested in Brazil over 17 tonnes of cocaine worth billions (March 2023)

In a coordinated effort to combat human trafficking, Europol hosted an international operational action between 25 and 28 February 2025, bringing together analytical, OSINT and investigative experts from 12 countries, including Ukraine*. The action took place at Europol’s headquarters in The Hague, coinciding with the third anniversary of the start of the Russian war of aggression against Ukraine.The operational action had an intelligence-driven approach and was aimed at detecting and disrupting human trafficking networks active online. With a focus on the sexual exploitation of Ukrainian nationals, experts monitored online platforms, identified potential cases and cross-checked intelligence against national databases.The main objectives of the operation included:Mapping and prioritising high-impact criminal networksDetecting new victims and associatesSome of the results include:690 entities checked (including platforms, persons, usernames, locations and phone numbers)21 potential suspected human traffickers identified41 potential victims of human trafficking identifiedEuropol’s support in targeting human traffickers operating onlineEuropol played a key role in facilitating the operation, providing logistical, financial and analytical support. The agency enabled real-time data crosschecks, allowing participating countries to enhance their investigations with the latest operational intelligence. Europol’s operational coordination also ensured continued international cooperation beyond the duration of the activity.As criminal networks increasingly exploit online platforms for recruitment, facilitation, advertisement, payment and victim control, traditional investigative methods are being reinforced with cutting-edge digital tools. This operation provided a unique opportunity to test and evaluate new investigative technologies, ensuring law enforcement agencies stay ahead of emerging threats.This four-day-long operational action focused on the digital aspect of human trafficking highlights Europol’s continued efforts to combat human trafficking. As an innovative operational model, it may serve as a blueprint for future cross-border investigations into other forms of serious and organised crime.Participating countries: BelgiumCzechiaDenmarkFinlandIrelandLatviaNetherlandsNorwayPolandSpainSwedenUkraine

Europol’s Operational Task Force, which is dedicated to targeting criminal networks in the Balkans, had identified the network’s leader as a high-value target. After a major crackdown in May 2023, which led to the arrest of 37 members, a branch of the criminal network remained active. It was led by a national of Bosnia and Herzegovina, who was incarcerated at the time. The ringleader orchestrated the network’s criminal activities from his prison cell, regularly issuing orders and instructions on matters related to the trafficking of drugs and firearms.Ringleader in hiding found after killing a witnessUpon his release, the high-value target went underground and continued to run the criminal network from a safe house in Slovenia. In late November 2024, the undercover ringleader allegedly organised and coordinated the professional assassination of a witness in the case. Marked as a suspect, Slovenian law enforcement authorities began zeroing in on his location.The high-value target was taken into custody during the operation’s first action day in December 2024. In the following days, Slovenian police arrested several of his criminal associates responsible for the organisation and preparation of the witness’s murder, as well as the trafficking of drugs, firearms and explosives into EU Member States. The criminal network was hierarchically organised, with each member fulfilling roles such as logistician, counter-surveillance specialist, assassin, as well as weapons, explosives and drug trafficker. Investigations are ongoing.Summary of the operation3 Action Days (5/6 December 2024 And 10/11 February 2025 Around Ljubljana (Slovenia); 4/5 February 2025 In Sarajevo (Bosnia And Herzegovina))10 Suspects Arrested (4 Slovenians, 5 Bosnians And 1 Albanian), With 7 Remaining In CustodyAn Automatic Rifle, Several Handguns (Some With Removed Serial Numbers), Silencers, And Over 200 Rounds Of Ammunition SeizedSeveral Remote Controls And Electric Detonators For Explosive Charges Seized10 Kg Of Heroin, 3.5 Kg Of Cocaine, 18 Kg Of Morphine And Other Drugs SeizedA Large Number Of Electronic Devices, Mobile Phones, SIM Cards As Well As Forged And Counterfeit Documents Seized Several electric detonators for explosive charges seized Europol’s supportEuropol organised an operational meeting, analysed the information shared by the involved countries and supported the development of intelligence. In addition to coordinating the operation during the three action days, Europol experts were deployed on the spot to facilitate immediate cross-checking of new evidence against Europol’s databases.Participating authoritiesBosnia And Herzegovina: Ministry Of Internal Affairs Of Canton Sarajevo – Criminal Police Department (Ministarstvo Unutrašnjih Poslova - Sektor Kriminalističke Policije)Slovenia: National Bureau Of Investigation (Nacionalni Preiskovalni Urad); Specialised State Prosecutor’s Office (Specializirano Državno Tožilstvo)Sweden: National Operations Department, Swedish Police Authority (Nationella Operativa Avdelningen, Polismyndigheten)

Most of the arrests were carried out simultaneously on 26 February 2025 during a global operation (Operation Cumberland) led by Danish law enforcement. More arrests are expected in the coming weeks, as the operation is still ongoing. Results of the operation, so far:273 suspects identified25 suspects arrested33 house searches173 electronic devices seized The main suspect, a Danish national who was arrested in November 2024, ran an online platform where he distributed the AI-generated material he produced. Following a symbolic online payment, users from around the world were able to obtain a password to access the platform and watch children being abused.During the course of the investigation, Europol and the Joint Cybercrime Action Taskforce (J-CAT), hosted by Europol, provided operational coordination to the law enforcement agencies involved in the case. Experts from Europol’s European Cybercrime Centre also facilitated information exchanges and provided intelligence and operational analysis to national investigators.Operation Cumberland has been one of the first cases involving AI-generated child sexual abuse material (CSAM), making it exceptionally challenging for investigators, especially due to the lack of national legislation addressing these crimes. In this regard, EU Member States are currently discussing a common regulation proposed by the European Commission to tackle this new situation and protect children from being sexually abused and exploited.Catherine De BolleEuropol's Executive DirectorThese artificially generated images are so easily created that they can be produced by individuals with criminal intent, even without substantial technical knowledge. This contributes to the growing prevalence of child sexual abuse material, and as the volume increases, it becomes progressively more challenging for investigators to identify offenders or victims. Law enforcement will need to develop new investigative methods and tools to address these emerging challenges.AI-generated CSAM: a serious crimeOnline child sexual exploitation remains one of the most threatening manifestations of cybercrime in the European Union and continues to be one of the top priorities for law enforcement agencies, which are dealing with an ever-growing volume of illegal content. Self-generated child sexual material constitutes a significant share of the CSAM that is detected. AI models able to generate or alter images are being abused by offenders to produce CSAM and for sexual extorsion. Such models are widely available and have developed quickly, with output that now increasingly resembles genuine material, making it harder to identify as artificially generated. This poses significant challenges to authorities in identifying the real victims. Even in cases when the content is fully artificial and there is no real victim depicted, such as Operation Cumberland, AI-generated CSAM still contributes to the objectification and sexualisation of children. Europol’s fight against child sexual exploitationThe fight against child sexual exploitation is a priority for Europol. Since 2017, the Agency has led the Stop Child Abuse – Trace An Object initiative, which enables citizens to provide information by recognising objects to help solve a child sexual abuse case. To date, the general public has shared almost 28 000 tips, 30 children have been removed from harm and 6 offenders have been identified and prosecuted.  At the request of EU Member States and other partners, Europol also hosts a Victim Identification Taskforce, a further initiative that allows law enforcement to work together to localise investigations and identify victims. Children in Germany and Australia have already been made safe as a result of this initiative. Next step: preventing future crimes Operation Cumberland not only focuses on stopping perpetrators, but also takes proactive steps to prevent further incidents. Europol and its partners will launch an online campaign in the coming days highlighting the consequences of using AI for illegal purposes and targeting potential offenders where they are most active: online. The campaign will use online messages to reach buyers of illegal content, as well as other methods such as knock-and-talks, social media messages and warning letters. Operation Cumberland demonstrates an ongoing coordinated effort by law enforcement to tackle this threat comprehensively, from arresting criminals to preventing future crimes through education, deterrence and providing support to those who want to seek support or help. Authorities involved in Operation Cumberland:Australia: Australian Federal Police (AFP)Austria: CIS Austria (Bundeskriminalamt), CID Vienna and CID Burgenland (Landeskriminalamt Wien und Landeskriminalamt Burgenland)Belgium: Federal Judicial Police (Federale Gerechtelijke Politie), Serious & Organised Crime Directorate – DJSOC (Directie voor de strijd tegen zware en georganiseerde criminaliteit – DJSOCBosnia & Herzegovina: Ministry of Interior of the Republic of Srpska (Ministarstvo unutrašnjih poslova Republike Srpske)Czech Republic: Police of the Czech Republic (Policie České republiky.)Denmark: Danish Police (Politiet)Finland: Finland National Bureau of Investigation (Keskusrikospoliisi)France: OFMIN (Office Mineurs)Germany: Federal Criminal Police Office (Bundeskriminalamt), State Criminal Police Offices in Bavaria, Hessen, Brandenburg, North Rhine-Westphalia and Rhineland-Palatinate (Bayerisches Landeskriminalamt, Hessisches Landeskriminalamt, Landeskriminalamt Nordrhein-Westfalen, Landeskriminalamt Rheinland-Pfalz), Bavarian Central Office for the Prosecution of Cybercrime (Zentralstelle Cybercrime Bayern – ZCB)Hungary: National Bureau of Investigation Cybercrime Department Investigative Division (Nemzeti Nyomozó Iroda Kiberbűnözés Elleni Főosztály Nyomozó Osztály)Iceland: National Commissioner of Police and Reykjavik Metropolitan PoliceThe Netherlands: National Police (Politie)  New Zealand: New Zealand PoliceNorway: NCIS Norway (Kripos)Poland: Polish Police Force (Policja Polska)Spain: National Police (Policía Nacional)Sweden: Swedish Police Authority (Polisen)Switzerland: Federal Office of Police fedpol (Bundesamt für Polizei fedpol), Police Basel-Landschaft (Polizei Basel-Landschaft), Lucerne Police (Luzerner Polizei,), City Police Zurich (Stadtpolizei Zürich),United Kingdom: Online Child Covert Intelligence Team (OCCIT), Metropolitan Police, Kent Police, West Mercia Police, Northamptonshire Police, Essex Police, Police Scotland, Hertfordshire Constabulary and Lincolnshire Police

With serious and organised crime posing an increasing threat to communities across Europe, discussions focused on the Agency’s operational impact, strategic direction and future role in tackling criminal networks.The meeting comes ahead of the EU Serious and Organised Crime Threat Assessment (EU SOCTA) 2025, scheduled for publication on 18 March. This report will outline the most pressing security threats facing the EU and shape law enforcement priorities for years to come.Strengthening Europol’s operational and strategic directionAddressing the JPSG, Europol’s Executive Director Catherine De Bolle provided updates on key developments, including the Multiannual Programming Document 2026-2028, which sets out Europol’s long-term objectives in the fight against organised crime, terrorism and emerging security threats.Ms De Bolle highlighted Europol’s strengthened partnerships with law enforcement agencies worldwide, its enhanced technological capabilities and its ongoing efforts to dismantle criminal networks. She also reaffirmed the Agency’s commitment to supporting the enforcement of EU sanctions and tackling the criminal infiltration of legal businesses.Operational impact: fighting crime across the EUAt the operational level, Europol is delivering results. Criminal networks remain the driving force behind many of the EU’s most serious threats. Intelligence gathered by the Agency shows that 86% of them exploit legal business structures to launder illicit profits. Europol is working closely with the private sector and national law enforcement to dismantle these networks and close financial loopholes.Migrant smuggling remains a key focus, with a new expert network called DigiNex launched to tackle the increasing use of digital tools by smugglers. Counter-terrorism efforts also continue, with Europol leading the fight against terrorist content online.A recent Referral Action Day targeted hate speech and incitement to violence, removing harmful content before it could spread further.Looking ahead: Europol’s future mandateAs the EU prepares for the next phase of its internal security strategy, discussions have turned to the future of Europol’s mandate. The Agency’s operational demands have surged, and there is growing recognition that it must be equipped with the tools and resources to match. Strengthening Europol’s capabilities in financial crime, cybercrime and migrant smuggling will be crucial in the years ahead.Concluding the JPSG meeting, Catherine de Bolle said: “The future of Europol lies in equipping the Agency with the necessary tools and resources to tackle the growing complexities of financial crime, cybercrime and migrant smuggling—critical areas for maintaining Europe’s safety.”A recording of the JPSG meeting is available for viewing.

The cold case revolves around a brutal murder that occurred in Dümmerlohausen, Germany, on 8 August 1996. The victim, a male national from the former Yugoslavia residing in Hamburg at the time, was involved in criminal circles and known to law enforcement for his involvement in burglaries in northern Germany. Local hunters had found him shot dead next to a stolen red vehicle.New evidence, new leads and a renewed appeal to the publicFollowing an intense media offensive and a call for information from the public in summer 2024, German investigators received new evidence, allowing them to follow new leads. Europol facilitated the contact between the German authorities and Dutch, Serbian and Swedish law enforcement, which ultimately led to the identification of three persons with possible ties to the case. On 20 February 2025, German and Swedish police, supported by special forces, searched three persons’ residences, collecting evidence destined to be analysed in Germany. Europol provided remote operational support during the searches, allowing for real-time cross checks of information. At this point in time, no further information about the three suspects can be disclosed. For more insight into the case, the Oldenburg Police Department hosts a dedicated webpage including a short film. Authorities are urging anyone with information, no matter how insignificant it may seem, to come forward.Investigators in this murder case also accept any information via phone or via email, the contact details can be found on the dedicated webpage. In addition, witnesses can contact the police anonymously via a tip portal, which also allows the upload of files and images.

The investigation started in 2020. Since then, law enforcement authorities have seized over 12 000 counterfeit documents, secured EUR 250 000 and arrested 42 suspects in total, all members of the same organised criminal group. The most recent action days against the gang took place on 3 and 4 December 2024 in Poland and resulted in:7 suspects arrested4 locations searchedSeizure of electronic devicesSeizure of documents and bank credit cardsForged documents advertised on social media platformsThe suspects used websites and social media platforms to advertise the sale of forged documents under the pretence of legal assistance. Individuals were charged EUR 1 500 per document. Individuals seeking these documents were redirected to a customer service centre, where they received initial information about the process, costs, and details to pay deposits. Once the forged documents were ready, the buyers received photographs of the documents via online messaging platforms and were instructed to pay the remaining balance. The documents were then delivered via postal operators or personally by members of the organised criminal group. Investigation coordinated by EuropolThroughout the four-year long investigation, Europol’s specialists coordinated and facilitated the exchange of information with Polish authorities. They also provided their expertise on the ground during the action days in Poland.The most dangerous organised crime groups carry out complex money laundering schemes to conceal their illegal profits. To tackle these top criminals successfully, Europol is putting more focus on investigating High Value Targets, financial investigations and asset recovery, as done in this case.Poland, at the helm of the Council of the EUPoland is holding the Presidency of the Council of the EU in the first half of 2025, from 1 January to 30 June. During this period, the Polish Presidency has outlined seven key priorities in the field of internal security, all of which align closely with Europol’s mission to make Europe safer:New EU Internal Security StrategyCountering migrant smugglingCountering drugs smugglingCombating trafficking in human beingsMonitoring weapons and ammunition smuggling from Ukraine – preventive measuresExternal conflicts and their implications for the EU’s internal securityEnhancing cooperation with law enforcement agenciesThrough its expertise, operational capabilities, and strategic insights, Europol is working hand in hand with the Polish Presidency, EU Member States, EU institutions and agencies, partner countries and other relevant stakeholders to turn these priorities into actionable outcomes.See footage from the recent action days in the video below:This press release was updated following publication with accurate figures.

Developed by the Strategic Group on Technology and Ethics under the European Clearing Board, with support from Europol’s Innovation Lab, the report sets out a seven-step ethical assessment method to help law enforcement navigate the challenges of digital transformation. It aims to ensure that the adoption and use of new technologies align with core values such as transparency, fairness, privacy and accountability. One of the lead authors, from the Norwegian Police University College, presented the report at the Fundamental Rights Conference 2025 hosted at Europol’s headquarters on 20-21 February 2025.A structured approach to ethical decision-making The report introduces a value-based framework designed to assist law enforcement agencies in evaluating the ethical implications of emerging technologies. This includes identifying moral concerns, assessing risks and benefits, and ensuring that technology use remains lawful and proportionate. To illustrate the method in practice, the report examines various law enforcement technologies, including:Video analytics technology – assessing privacy implications while enhancing public safety.AI risk assessment for gender-based violence cases – balancing the need for predictive tools with fairness and transparency.Open-source data scraping – evaluating the ethical and legal concerns of automated online investigations.Chatbots to prevent online child sexual abuse – considering the balance between proactive intervention and privacy rights.Automated analysis of large and complex datasets – addressing the risks of function creep and ensuring responsible data use.The case studies are not intended to provide a definitive judgement on the ‘right’ or ‘wrong’ use of a technology, but to empower law enforcement agencies to apply the method in diverse contexts.A dynamic and evolving resourceThe report is intended to be a ‘living document’, regularly updated with new use cases and ethical considerations as law enforcement agencies across Europe continue to adapt to technological advancements.By promoting a structured ethical framework, Europol aims to increase public confidence in law enforcement’s use of technology, ensuring that innovation in policing remains aligned with societal values and legal safeguards.

Europol today issues an Intelligence Notification calling attention on the rise of violent online communities dedicated to the serious harm of children. This strategic document focuses on online grooming cult groups dedicated to normalising violence and corrupting minors, advocating for the collapse of modern society through acts of terror, chaos and violence, and spreading ideologies that inspire mass shootings, bombings and other acts of crime. These communities recruit offenders and victims on a global scale and function as cults formed around charismatic leaders who use manipulation and deception to lure and control their victims. The communities’ hierarchy is based on the amount of content shared, with the most prolific contributors earning higher rankings. Community members share extremely violent content, ranging from gore and animal cruelty to child sexual exploitation material and depictions of murder.Europol’s Executive Director Catherine De Bolle said: Today, digital platforms enable communications globally; violent extremist online communities also leverage this opportunity. Violent perpetrators spread harmful ideologies, often targeting our youth. These networks radicalise minds in the shadows, inciting them to bring violence into the real world. Awareness is our first line of defence. Families, educators and communities must stay vigilant and equip young people with critical thinking skills to resist online manipulation. International cooperation is also imperative – by sharing intelligence and holding perpetrators accountable, we can combat these dangerous communities and safeguard future generations from the grip of extreme violence and crime.Vulnerable minors targeted through gaming platforms and self-help communitiesThe perpetrators leverage online gaming platforms, streaming services and social media platforms to identify and lure their victims. The members of these groups target vulnerable young people, particularly minors between 8 and 17 years old – especially who are LGBTQ+, racial minorities and those struggling with mental health issues. In some cases, perpetrators infiltrate online self-help or support communities dedicated to individuals impacted by these issues.These violent criminal actors employ different tactics to lure and manipulate their victims into producing explicit sexual content, perpetrating self-harm, harming others and even carrying out murders. In the beginning, perpetrators often use ‘love bombing’ techniques – extreme expressions of care, kindness and understanding to gain the trust of the minors – while collecting personal information about their victims. The criminal actors use this information in the exploitation phase of the grooming, when they force the vulnerable minors into producing sexual content and committing acts of violence. The perpetrators then blackmail the victims to do even more harmful acts by threatening to share the victims’ explicit content with their families, friends or online communities.Once caught in the net of the predators, minors become even more vulnerable – the detection of these criminal activities is crucial.Beware of these behaviours in your children:Secrecy about online activitiesWithdrawal and isolationEmotional distressInterest in harmful contentChanges in language or symbols usedConcealing physical signs of harm Do not ignore these signs in your children’s online behaviour:Unusual activity on platformsInteraction with unknown contactsEncrypted communicationsExposure to disturbing content 

The action day took place on 21 January 2025 in Spain (Madrid, Málaga, Marbella, Torremolinos, Coín and Ayamonte) and Portugal (Lisbon). All in all, the operation led to:14 arrests9 house searchesSeizure of over EUR 1 million in cash and cryptocurrencies.Suspects mainly operated in Spain, used the Hawala method to move the cash sourced mainly from drugs trafficking, and launder the funds collected relying on their own company networks. Investigators believe the gang were carrying out daily cash transactions, occasionally reaching up to EUR 300 000 per day.Putting the focus on financial investigationsThroughout the investigation, Europol experts provided analytical support to national authorities. A specialist was also deployed during the action day to work hand-on-hand with investigators on the spot and assist them in the extraction of data and further analysis.The most dangerous organised crime groups carry out complex money laundering schemes to conceal their illegal profits, as in this case. To tackle these top criminals successfully, Europol is putting more focus on investigating high-value targets, financial investigations and asset recovery.At the same time, Europol aims at increasing its operational impact by dismantling poly-criminal organised groups. To this end, Europol is enhancing its analytical capabilities and developing a complete operational support model to identify, organise, coordinate and deploy multi-disciplinary teams to work with Member States and support priority investigations.Authorities involved in the investigation:Portugal: Judiciary Police (Polícia Judiciária)Spain: National Police (Policía Nacional)Funding through EU financial mechanismsOfficers from the Spanish National Police, supported by Europol, carried out these joint operations in partnership with Portugal and in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem.To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combating criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.

The investigation has so far identified 85 individuals linked to the Russian war of aggression against Ukraine. The National Police of Ukraine has opened a special criminal case, which contains information about the recruitment, training, financing, and the use of the alleged mercenaries in combat actions against Ukraine. This information has been shared with authorities in Moldova, where new preliminary investigations have been initiated.The action days on 12 and 13 February 2025 led to:Over 50 locations searched in Moldova;3 arrests in Moldova;Seizures, including documents, electronic equipment, video material and picture evidence.The seizures made during the raids include a large number of documents, pictures and video material, which attest to the recruitment and conditions of service within the Wagner Group private military company and illustrate the involvement of the suspects in military actions in the territory of Ukraine. The individuals, all Moldavan nationals, allegedly participated in the occupation of the city of Bakhmut, the battle for Donetsk Airport, the creation of the Debaltsevo cauldron within the Wagner paramilitary group, the Somali battalion and other armed formations of the self-proclaimed Donetsk Republic and Russia. Investigative information shows that the investigated individuals have been awarded medals and decorations by the military leadership of the Russian forces in the occupied territories.Europol supported the investigation by facilitating information exchange, coordinating operational activities and providing specialised analytical support focussed on the potential involvement of these individuals into war crimes committed in Ukraine. On the action days, Europol established a virtual command point to streamline communication between involved authorities and enhance field operations by cross-checking real-time operational data against its databases.See more about the operation in this video by the the National Police of Ukraine:

Abusing an infrastructure of legal businesses, the criminal network is believed to have managed the illegal trafficking and disposal of the waste from the countries of origin, mainly Italy, to the destination in Croatia. To that end, the criminal network relied on legal companies in Italy, as well as transport companies and other legitimate businesses in Italy and Croatia. Laboratory analysis shows that the illegally disposed garbage, which the criminals falsely declared as recyclable plastic waste, is legally considered dangerous waste. Croatian authorities believe that the criminal network also illegally buried and dumped medical waste from Croatian companies.Falsified documentation as key to profitCriminal networks engaged in waste trafficking take advantage of the high treatment costs, particularly for hazardous waste. In this case, the modus operandi was to win tender procedures for the treatment of waste in Italy by offering lower prices compared with other providers on the legal market. Upon winning a contract, the Croatian-led criminal network would transport the waste – without any previous mandatory treatment – to Croatia. To circumvent the necessary consent of the destination country, the criminals would falsify documentation to declare the waste as merely destined for recycling, thus veiling its true nature. By disposing of medical or hazardous waste in Croatia without having treated in any way, the criminal network saves the costs associated with this procedure and pockets the difference.Huge profits, low risk, and irreparable damageWaste trafficking is an illegal activity that allows criminal networks to obtain huge profits while exposing themselves to comparatively low risk. Illegal disposal of waste often causes irreparable damage to the environment, polluting soil, water, and air. These crimes usually go hand in hand with the falsification of documents, or financial crimes such as money laundering or corruption. During the action day, officers on the scene seized electronic devices, mobile phones and documents, which will be subject to further investigation.Europol supported the investigations conducted by national law enforcement and environmental protection agencies. Europol’s experts on environmental crime coordinated the operation by holding coordination and operational meetings as well as providing analytical support. On the action day, Europol’s experts provided the authorities with real-time support.Participating countries:Croatia: Criminal Police Directorate (Služba općeg kriminaliteta)Italy: Carabinieri - Environmental Protection and Energy Security Command (Comando Tutela Ambientale e Sicurezza Energetica)Slovenia: Slovenian Criminal Police (Kriminalistična policija)

The operation, which took place in the early hours of 27 January 2025, was carried out by law enforcement authorities in France, Spain and Israel, with support from Europol and judicial authorities.International fraud schemeThe investigation began after a French citizen was deceived between April and May 2022, believing he was making substantial investments in renewable energy contracts. The suspects maintained regular contact with the victim, persuading him to transfer large sums of money to company bank accounts both inside and outside the EU.To reinforce the illusion of a legitimate investment, the fraudsters returned small amounts of money, falsely presenting them as interest payments – a common tactic used to build trust before stealing larger sums.When the victim realised they had been scammed, they reported the fraud to the French Gendarmerie, triggering a major international investigation.Global police cooperationLed by the French Gendarmerie, under the guidance of the Annecy Judicial Court, the investigation uncovered a sophisticated criminal infrastructure. Investigators traced both the technical and financial networks used by the fraudsters, identifying additional victims who had suffered significant financial losses.Europol facilitated analysis and operational meetings between investigators from different countries, ensuring a coordinated international response. This work led to simultaneous police actions across France, Spain and Israel.On the day of the operation:France: Europol deployed a case analyst to the coordination centre to assist with real-time intelligence checks.Israel: Two French Gendarmerie officers, a French investigative judge and a Europol officer took part in searches and coordination efforts on the groundSpain: The National Police carried out enforcement actions against the suspects.During the action day, EUR 133 800 worth of cash in various currencies was seized in Israel along with expensive watches. To date, French investigators have recovered approximately EUR 450 000. Investigations remain ongoing to identify further suspects and trace additional financial losses.To learn more about how law enforcement is tackling this crime area, listen to episode ‘S1/E7: Targeting scam call centres’ of The Europol Podcast.

This follows a series of high-impact arrests targeting Phobos ransomware:An administrator of Phobos was arrested in South Korea in June 2024 and extradited to the United States in November of the same year. He is now facing prosecution for orchestrating ransomware attacks that encrypted critical infrastructure, business systems, and personal data for ransom.A key Phobos affiliate was arrested in Italy in 2023 on a French arrest warrant, further weakening the network behind this ransomware strain.As a result of this operation, law enforcement was also able to warn more than 400 companies worldwide of ongoing or imminent ransomware attacks.This complex international operation, supported by Europol and Eurojust, involved law enforcement agencies from 14 countries. While some countries focused on the investigation into Phobos, others targeted 8Base, with several participating in both.Europol played a critical role in bringing together intelligence from these separate investigations, enabling authorities to take down key actors from both ransomware networks in a coordinated effort.Phobos: A discreet but highly effective ransomwareFirst detected in December 2018, Phobos ransomware has been a long-standing cybercrime tool, frequently used in large-scale attacks against businesses and organisations worldwide. Unlike high-profile ransomware groups that target major corporations, Phobos relies on high-volume attacks against small to medium-sized businesses, which often lack the cybersecurity defences to protect themselves.Its Ransomware-as-a-Service (RaaS) model has made it particularly accessible to a range of criminal actors, from individual affiliates to structured criminal groups such as 8Base. The adaptability of this framework has allowed attackers to customise their ransomware campaigns with minimal technical expertise, further fuelling its widespread use.Taking advantage of Phobos’s infrastructure, 8Base developed its own variant of the ransomware, using its encryption and delivery mechanisms to tailor attacks for maximum impact. This group has been particularly aggressive in its double extortion tactics, not only encrypting victims' data but also threatening to publish stolen information unless a ransom was paid.Europol’s coordinating roleWith law enforcement efforts spanning multiple continents, Europol played a central role in connecting investigators and coordinating enforcement actions. Supporting the investigation since February 2019, Europol’s European Cybercrime Centre (EC3) has:Brought together intelligence from parallel investigations, ensuring that law enforcement authorities targeting Phobos and 8Base could pool their findings and coordinate arrests efficiently.Organised 37 operational meetings and technical sprints to develop key investigative leads.Provided analytical, crypto-tracing and forensic expertise to support the case.Facilitated intelligence exchange within the Joint Cybercrime Action Taskforce (J-CAT), hosted at its headquarters.Exchanged nearly 600 operational messages via Europol’s secure SIENA network, making this one of EC3’s high-priority cases.Eurojust organised two dedicated coordination meetings to assist with the cross-border judicial cooperation and provided support with outstanding requests of all authorities involved.  The following authorities took part in the investigation:Belgium: Federal Police (Federale Politie / Police Fédérale)Czechia: Police of the Czech Republic (Policie České republiky)France: Paris Cybercrime Unit (Brigade de lutte contre la cybercriminalité de Paris - BL2C), Court of Paris - National Jurisdiction Against Organised Crime (Juridiction Nationale de Lutte contre la Criminalité Organisée – JUNALCO)Germany: Bavarian State Criminal Police Office (Bayerisches Landeskriminalamt – LKA Bayern), Bavarian Central Office for the Prosecution of Cybercrime (Generalstaatsanwaltschaft Bamberg – Zentralstelle Cybecrime Bayern)Japan: National Police Agency (警察庁)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)Romania: Romanian Police (Poliția Română)Singapore: Singapore Police Force CyberCrime CommandSpain: Guardia CivilSweden: Swedish Police Authority (Polisen)Switzerland: Office of the Attorney General of Switzerland (OAG), Federal Police (fedpol)Thailand: Cyber Crime Investigation Bureau (CCIB)United Kingdom: National Crime Agency (NCA)United States: US Department of Justice (US DOJ), Federal Bureau of Investigation (FBI – Baltimore Field Office), US Department of Defense Cyber Crime Center (DC3)

Featuring keynote speeches from Europol experts and live demonstrations of the latest technology by companies, this event brought Europol staff and national law enforcement practitioners up to speed with the latest technological advancements in the security market. As a response to the needs expressed by the law enforcement community, and matching criteria such as the innovative nature and relevancy to the users’ strong interest in compliance technology, Europol invited technology providers to our headquarters to demonstrate their latest developments. A selection panel composed of Europol experts from across the organisation and the Innovation Lab opted for 32 technology providers to showcase their technical solutions, tools, methodologies and processes related to six themes, as follows:Robots, drones and other unmanned systemsDeepfake detectionAdvanced biometrics for forensic analysisAI Tools for target detection, identification, and trackingOSINT analysis of private channelsCryptocurrencies, financial intelligence and cybersecurityOn the second day of the event, the Top Contributor Award for the Europol Tool Repository (ETR) was presented to the Norwegian Police. This award recognises the EU Member State or Europol partner country that has made the most significant contributions to the ETR, enhancing it with innovative tools that support law enforcement across Europe. The ETR features 40 investigation-support tools, with over 8 000 downloads. Developed by law enforcement for law enforcement, these tools demonstrate the power of collaboration and shared expertise in addressing the evolving challenges of modern crime. Europol works under the premise that traditional law enforcement approaches must be complemented by partnering with non-law enforcement partners, in order to grasp the added value emerging technologies can bring to investigations. Enhancing collaboration with private sector partners offers numerous advantages, such as improving efficiency and adopting the best solutions for law enforcement compliance needs in the fields of personal data, fundamental rights, and transparency, in the fight against criminality.Europol does not endorse any of the mentioned companies, neither any of their products/services.

On 7 February 2025, Europol hosted a Quantum Safe Financial Forum (QSFF) event, during which the QSFF has issued a call to action for financial institutions and policymakers, urging them to prioritise the transition to quantum-safe cryptography. With the rapid advancement of quantum computing, the financial sector faces an imminent threat to its cryptographic security. This transition presents both a challenge and an opportunity to enhance cryptographic management practices across the industry. During the event, representatives from leading organisations discussed the need to urgently address the transition and the challenges industry peers, vendors, policymakers, and society are facing.A coordinated approach to the transitionA sufficiently advanced quantum computer has the potential to break widely used public-key cryptographic algorithms, endangering the confidentiality of financial transactions, authentication processes, and digital contracts. While estimates suggest that quantum computers capable of such threats could emerge within the next 10 to 15 years, the time required to transition away from vulnerable cryptographic methods is significant. A successful transition to post-quantum cryptography requires collaboration among financial institutions, technology providers, policymakers, and regulators.The forum recommends the following key actions:Financial institutions and policymakers should prioritise the transition to quantum-safe cryptography and actively support its implementation.Coordination among different stakeholders will be key, ensuring alignment on their planning, roadmaps and the concrete implementation of the transition to PQC, establishing common goals and a shared view of the requirements to achieve them.There is no need for additional legislation to be made, a voluntary framework established between regulators and the private sector would be sufficient, setting guidelines for quantum-safe cryptography and promoting standardisation across institutions.This transition presents an opportunity to enhance cryptography management practices. A forward-looking framework to cryptography management is needed.Promote collaboration, knowledge sharing and fostering a cohesive approach across jurisdictions at global scale. This means encouraging the industry, including private and public sector actors, to partner up in the context of quantum-safe experiments, projects, Points of Contact and other initiatives.The threat of ‘Store now, decrypt later’ and the regulatory response to itThe QSFF warns of the increasing risk posed by ‘Store now, decrypt later’ (SNDL) attacks, where malicious actors collect encrypted data today with the intention of decrypting it in the future using quantum computing. Sensitive financial information, including long-term investment strategies and confidential agreements, could be compromised if urgent security measures are not taken.These challenges have been identified by Europol and presented in the First Report on Encryption, published by the EU Innovation Hub, and The Second Quantum Revolution report, published by Europol’s Innovation Lab. Although these reports focus on the law enforcement perspective, there are synergies that can also be applied to the financial industry.Governments and regulatory bodies worldwide have begun addressing the quantum threat, with the introduction of major regulatory acts in Europe, the United Kingdom, the United States and Singapore. Despite these efforts, a 2023 survey of 200 financial sector leaders found that 86% of organisations feel unprepared for post-quantum cybersecurity. Additionally, 84% anticipate the need to adopt quantum-safe solutions within the next two to five years.The QSFF urges financial institutions, vendors, and policymakers to take immediate steps towards a quantum-safe financial ecosystem. The QSFF emphasises that action should be taken promptly to protect the industry from significant risks, financial losses, and reputational damage.

The meeting provided an opportunity for representatives from both regions to exchange expertise and knowledge on cross-border security challenges. Participants also shared insights on emerging crime trends, working towards a more effective response to transnational crime. GCCPOL and Europol have been working together since signing a Letter of Intent on 14 July 2017 to enhance collaboration against organised crime and terrorism. This meeting marked another step in that partnership, reinforcing joint efforts to disrupt transnational criminal networks and protect communities from criminal activity.To this end, GCCPOL and Europol reaffirmed their intention under the Letter of Intent to enhance cooperation by:1. Exploring opportunities to exchange best practices and experience in the various areas of combating crime.2. Supporting the capacity building for cooperation and information exchange among the law enforcement authorities of the GCC countries and EU Member States.3. Fostering a strengthened cooperation among the GCC countries and EU Member States in the area of internal security.By improving cross-border collaboration, GCCPOL and Europol aim to tackle criminal threats more effectively across both regions. 

Law enforcement authorities target members of prolific online communities dedicated to the sexual abuse of children and manipulation of vulnerable minors into committing violent crimes. This coercion into committing violent crime spans multiple areas, including acts of cruelty against people and animals, murder and self-harm. These extremist communities are part of a larger online network, so called “The Com”. Through this network, extremists around the world collude to groom and abuse children. These groups operate virtually in easily accessible online spaces such as social media platforms, mobile applications and online gaming platforms. International cooperation via Europol has intensified in the past year, leading to the identification of dangerous individuals and the safeguarding of victims, mostly vulnerable minors.Two suspected leaders of online group “CVLT” arrested in the USOn 30 January, the United States Homeland Security Investigations arrested two individuals for participating in a neo-Nazi child exploitation ring that groomed and then coerced minors into produce child sexual abuse material and images of self-harm. The group allegedly abused at least 16 minors around the world. According to the investigation, the two men were members of “CVLT” (pronounced “cult”), an online group that promoted neo-Nazism, nihilism, and paedophilia as its core principles.The investigations into these individuals (a 23- and 41-year-old males from the US), were supported by Europol, and involved the French National Police (Police Nationale), the United Kingdom’s National Crime Agency and the New Zealand Department of Internal Affairs. These arrests follow previous arrests of two other prolific members of this community, both males in their twenties. One of the previously arrested suspects has been in French custody since 2022 for several child exploitation and related offenses. The second is currently in the US, serving a 50-year sentence for child sex abuse crimes committed in 2020 and 2021.Three of these four arrested offenders are considered to have acted as leaders and administrator of the violent online abuse community, hosting and running CVLT online servers and controlling membership for the group.Victims trapped in an abuse cycleMembers of this violent CVLT community groomed children into producing child sexual abuse material through various means of degradation, including exposing the victims to extremist and violent content. CVLT specifically targeted vulnerable victims, including minors suffering from mental health issues or a history of sexual abuse. Victims were encouraged to engage in increasingly dehumanising acts, including cutting and eating their own hair, drinking their urine, punching themselves, calling themselves racial insults, and using razor blades to carve CVLT members’ names into their skin.CVLT members’ coercion escalated to pressuring victims to kill themselves via video livestream. They blackmailed the victims to submit and remain silent, threatening to distribute already-obtained compromising photos and videos to their family and friends. CVLT would sometimes go through with their threats against victims who tried to escape their grip. CVLT is part of a larger network of extremist and child abusers active within similar online communities, referred to as “The Com”.Extremely violent online communities manipulate children and young peopleViolent online groups are targeting and manipulating vulnerable children and young people across widely accessible online platforms. There are multiple groups, associations and evolving subgroups that make up the online network known as The Com – short for community. The Com is a virtual community of groups and individuals who conduct illicit activities that glorify serious violence, cruelty, and gore.Elements of The Com network are known to have extreme ideological views and victimise children, coercing them to commit violent acts. Predators groom their victims through different methods – one approach is establishing friendships based on trust or romantic relationships. Another technique involves the use of power or coercive tactics with one goal – taking control over the victims, while getting them to engage in serious violence, self-harm, or other gruesome. It’s a vicious cycle - the predators in this network influence children or young people into conducting acts that increasingly shame, incriminate, or isolate them, this in turn makes them more vulnerable to further exploitation.Europol’s role in bringing investigations around the world closer togetherEuropol facilitates the exchange of information and provides analytical support to investigations into members of online communities targeted at child abuse and serious harm to vulnerable youth. At the end of January 2025, Europol hosted a three-day-long operational meeting related to The Com network of online child abusers. On the first day of the meeting, Europol connected 100 intelligence and police officers around the globe to exchange knowledge on the topic. During the meeting, 50 participants discussed cases to identify members active in these communities, and identify and safeguard their victims.  

The investigation uncovered a highly structured organisation using sophisticated methods to transport and conceal drugs. The traffickers operated from a logistical base in southern Spain, where they stored and prepared drug shipments before smuggling them into France. Their modus operandi relied on convoys with lead and carrier vehicles equipped with hidden compartments to smuggle the drugs and evade detection. To further secure their operations, the network used counter-surveillance tactics and frequently changed routes and vehicles.On 27 January, a coordinated law enforcement operation led to the interception of one such drug convoy upon its arrival at a property in the Morbihan region of France. The French Gendarmerie arrested the three drivers as well as the syndicate’s regional leader, who was there to oversee the delivery. Simultaneously, house searches were conducted in France and Spain, resulting in the arrest of the two suspects who led the network and the collection of significant evidence against the group.Operational resultsThe operation, carried out in close cooperation with Spanish authorities, resulted in the arrest of 24 individuals and the seizure of 151 kg of drugs - including cocaine, synthetic drugs, cannabis resin, and herbal cannabis, with an estimated street value of EUR 2.5 million.Europol supported the investigation by providing analytical expertise to map out the syndicate’s structure, identify key players, and track smuggling routes. Europol also coordinated intelligence sharing and funded the deployment of French officers to Spain to facilitate cross-border cooperation. On the action day, Europol deployed experts to France and Spain to ensure the exchange of real-time information between the involved law enforcement authorities.Eurojust supported the judicial authorities during their investigation and prepared the European Arrest Warrants and European Investigation Orders executed during the operation.Participating authorities:France: National Gendarmerie (Gendarmerie Nationale – Section de Recherches Rennes)Spain: National Police (Policía Nacional – UDYCO Málaga)

Europol continues to strengthen the fight against crime through international cooperation, reaching a new milestone in its Secure Information Exchange Network Application (SIENA). Over the past year, Europol has expanded its network of SIENA connections from 3 000 to 3 500, adding, on average, two new partners every day.This development reflects Europol's commitment to fostering collaboration between law enforcement authorities across borders through providing them with the tools to tackle increasingly complex criminal threats. SIENA enables the secure, efficient, and timely exchange of information between Europol and its partners, including national, regional and local law enforcement authorities, as well as customs, border guards, and other specialised police forces.Every new connection strengthens national law enforcement authorities’ capabilities to make the European Union more secure. SIENA provides law enforcement authorities the ability to share operational intelligence, which is crucial to efficiently tackle complex criminal threats spread across borders. As Europol's network grows, the power of collaboration, in line with Europol’s strategy, is an even stronger force in delivering security for the EU and beyond. SIENA received recently a “legislative home”. The Information Exchange Directive 2023/977, which took effect a month ago, is revolutionising international policing by making SIENA the “default channel” of cooperation for European law enforcement authorities.  Europol's Deputy Executive Director Andrei Linta said: International cooperation is the driving force behind criminal investigations targeting serious cross-border crime. Increasing the connections in our SIENA network means expanding the network of partners in the fight against global criminality. This achievement is a testament to the commitment of law enforcement authorities across Europe, and beyond, to work together in safeguarding our communities.

The report highlights several pressing challenges faced by law enforcement, including the overwhelming volume of digital data, the risk of data loss, and the persistent barriers to accessing critical information due to legal and technical constraints. The increasing use of anonymisation services has further complicated efforts to track criminal activities online.To help mitigate these challenges, the report explores the impact of new EU legislative tools, such as the e-Evidence Package, the Digital Services Act, and the EU AI Act. These instruments aim to facilitate data access, improve cross-border cooperation, and enhance investigative capabilities. However, their effectiveness will largely depend on how they are implemented and integrated into existing operational strategies.The report also underscores the value of the strategic cooperation between Europol and Eurojust, highlighting initiatives such as the SIRIUS Project, which has strengthened collaboration in cybercrime investigations. These efforts continue to play a crucial role in helping law enforcement agencies navigate an increasingly complex digital landscape.While challenges remain, the report emphasises the potential of these new legislative measures to strengthen the fight against cybercrime. Equipping law enforcement with the right tools and ensuring their effective use in investigations will be key to staying ahead of evolving cyber threats.   

The Europol Financial Intelligence Public Private Partnership (EFIPPP) provides a collaborative mechanism between more than 90 private stakeholders, Financial Intelligence Units (FIUs) and law enforcement agencies to address structured threat information across the community. The EFIPPP secretariat is located within the European Financial and Economic Crime Centre (EFECC) at Europol.The drafting of the Practical Guide was based on existing operational cooperative mechanisms in Denmark, Ireland, Latvia, Sweden, the Netherlands and the UK. Taking a practical approach, the Practical Guide highlights that successful collaboration relies on trust between public and private stakeholders. Providing an outline of the building blocks required for successful collaboration, it recommends starting small with realistic expectations, and providing leadership by example.Catherine de BolleEuropol Executive DirectorToday financial and economic crime represents one of the most pervasive dangers to our society, threatening its very fabric. Collaboration between competent authorities and the private sector in the financial arena is crucial to improving the fight against organised crime and terrorism. Together we can tackle the complex schemes set up by criminals and terrorist groups to hide their assets across the globe.Wim MijsCEO of the European Banking FederationThe EBF is a proud partner of the leading cross-border community fostered by EFIPPP in the fight against financial crime. The insights shared in today's Practical Guide highlight the power of trust and collaboration when working with European authorities. This guide offers valuable insights for building impactful operational public-private partnerships and driving meaningful action against financial crime.As well as offering hands-on guidance to investigative authorities and financial institutions in shaping their cooperation, the Practical Guide provides inspiration for policymakers in areas where there is not yet an enabling legal environment. With this guide, the EFIPPP delivers on the call made by the European Commission in its EU roadmap to fight drug trafficking and organised crime.  

The two platforms, Cracked and Nulled, had more than 10 million users in total. Both of these underground economy forums offered a quick entry point into the cybercrime scene. These sites worked as one-stop shops and were used not only for discussions on cybercrime but also as marketplaces for illegal goods and cybercrime-as-a-service, such as stolen data, malware or hacking tools. Investigators estimate that suspects earned EUR 1 million in criminal profits.The operation took place from 28 to 30 January and led to:2 suspects arrested7 properties searched17 servers and over 50 electronic devices seizedAround EUR 300 000 of cash and cryptocurrencies seizedThroughout the course of the action day, 12 domains within the platforms Cracked and Nulled were seized. Other associated services were also taken down; including a financial processor named Sellix which was used by Cracked, and a hosting service called StarkRDP, which was promoted on both of the platforms and run by the same suspects.Europol’s expertise provided on the groundThroughout the investigation, Europol provided operational, analytic and forensic support to authorities involved in the case. On the action day, a specialist and an analyst were deployed on the spot to work hand-in-hand with German investigators. Europol’s experts from the European Cybercrime Centre (EC3) facilitated the exchange of information in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at the Europol headquarters in The Hague, the Netherlands. One of Europol’s priorities is to act as the broker of law enforcement knowledge, providing a hub through which Member States can connect and benefit from one another’s and Europol’s expertise.Fighting cybercrime-as-a-serviceCybercrime-as-a-service is a growing trend on platforms like Cracked.io and Nulled.to. Cybercriminals offer tools and infrastructure as a service, enabling even less technically-skilled individuals to carry out attacks. This trend makes cybercrime increasingly accessible to a wider group of people, as these platforms often share security vulnerabilities and even provide tutorials on creating malware and engaging in other criminal activities. These two forums also offered AI-based tools and scripts to automatically scan for security vulnerabilities and optimise attacks. Advanced phishing techniques are frequently developed and shared on these platforms, sometimes employing AI to create more personalised and convincing messages. As cybercrime becomes more aggressive and confrontational, Europol aims to strengthen the fight against this sort of crime by bringing relevant partners together for cross-border cooperation and joint action.Participating countries:Australia: Australian Federal PoliceFrance: Anti-Cybercrime Office (Office Anti-cybercriminalité)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)Greece: Hellenic Police (Ελληνική Αστυνομία)Italy: State Police (Polizia di Stato)Romania: General Inspectorate of Romanian Police (Inspectoratul General al Poliției Romane)Spain: Guardia Civil; Spanish National Police (Policía Nacional)United States of America: Department of Justice, Federal Bureau of Investigation

Operation SHIELD’s 2024 edition was led by a steering group composed of French, Greek, Italian and Spanish law enforcement authorities. Europol supported this wide-reaching operation with several operational meetings and the deployment of experts with mobile offices offering analytical and forensic support.Preliminary results of Operation SHIELD V418 individuals arrested, charged, or under prosecution 52 organised crime groups investigated4 underground labs dismantledTotal seizures worth above EUR 11.1 million, including: 426 016 illegal packages of illegal pharmaceuticals4 111 kilograms of powder and raw material108 litres of active ingredient174 968 vials and ampoules over 4 683 426 tablets and pills 4 083 anti-doping “in and out competition” controls carried outPharmaceutical crime is a growing threat in the EUPharmaceutical crime has a direct impact on public health and safety, as it affects individuals, communities and national healthcare systems. It generates enormous financial losses for legitimate companies, undermines brand credibility but also endangers investments in research. To emphasise this growing threat, Europol has launched a dedicated report on intellectual property crime (IPC) targeting the production and marketing of pharmaceutical products.Selling sub-standard, falsely labelled, or falsified pharmaceutical products, as well as products diverted from the legal supply chain, organised crime networks are behind a wide range of illicit medicines and doping substances. Purchasing fake medicines pays criminals, risks the consumers’ health, and undermines the economyFake medicines traded in the EU are on the rise, which comes with a huge cost for the individual and society. Europol, the European Union Intellectual Property Office (EUIPO), and the European Medicines Agency (EMA) have come together to raise awareness about the issue of fake medicines and how they work to protect consumers against this threat.Social media and online marketplaces, both on the surface and on the dark web, continue to be central to the trade of counterfeit pharmaceuticals. These platforms provide various degrees of anonymity and target wide audiences, making it challenging to identify the criminal actors involved.Purchasing fake medicines pays criminals, risks consumers’ health, and undermines the economy. Consumers are warned to be mindful to not fund organised crime or harm themselves by buying fake medicines.

On 17 December, law enforcement conducted raids at 14 properties across Barcelona (4), Madrid (9), and Toledo (1) in Spain, and one property in Zagreb in Croatia. These operations resulted in 30 arrests, among which were the leaders of the criminal network. In addition, EUR 180 000 in cash was also seized, alongside weapons, 70 passports, equipment to falsify passports and visas, narcotic substances, 10 high-end vehicles and 33 mobile phones. A total of 33 victims – Chinese and Vietnamese nationals – were also safeguarded.This investigation builds on the dismantling of Europe’s largest Chinese prostitution ring in February 2023. Digital evidence seized during that operation has since then been meticulously analysed, including at a forensic sprint held at Europol’s headquarters in March 2023. During this sprint, experts from nine countries extracted tens of terabytes of data from hundreds of confiscated mobile phones.The new intelligence provided unprecedented insights into the methods used by Chinese criminal networks in Europe, revealing a sophisticated division of labour and reliance on crime-as-a-service actors.Two cells, one exploitation chainThe criminal organisation, composed primarily of Chinese nationals, profited significantly from the sexual exploitation of vulnerable women. To maximise profits, the group engaged in additional criminal activities, including document fraud, money laundering, and the facilitation of illegal immigration.Victims were lured into prostitution in Europe under the promise of earning high income within a short timeframe. However, upon arrival, they were subjected to severe debt bondage and trapped in a cycle of exploitation they were unable to escape due to their vulnerabilities and dependence on the traffickers.The organisation operated in two interconnected cells:Recruitment and smuggling cell: Victims were recruited in China through "travel agencies" where they disguised the exploitation by presenting prostitution opportunities as legitimate employment abroad. Using the Western Balkan corridor, the smuggling cell coordinated with local facilitators and drivers to illegally transport victims into the EU. Safe houses were maintained along the route, with logistics managed through instant messaging apps. Exploitation cell: Once in Europe, victims were initially exploited in entry-point countries. Later, they were transferred to Spain and other Member States, where they were forced to work in brothels or short-stay facilities. Victims were rotated between cities and across borders to evade detection and meet the growing demand for sexual services. The organisation maintained strict control over every aspect of the victims’ lives, taking 50% of their earnings even after their debts were repaid.A highly organised and resilient networkThe smuggling operations were meticulously coordinated through instant messaging apps, with facilitators managing safe houses along the route and providing instructions on victim transport. Upon arrival, victims were initially exploited in entry-point countries before being transferred to Spain and other EU Member States, where their exploitation continued under the strict control of the criminal group.Victims trafficked by the group were identified in exploitation networks across multiple EU countries, underscoring the scale and resilience of this criminal network.International cooperation leads to successThe operation was led by the Spanish National Police (Policía Nacional) in close cooperation with the Croatian National Police (Policija) and Europol.The Agency supported national authorities by enabling the exchange of critical intelligence and providing expert analytical support. On the action day, Europol deployed two experts to Madrid and Barcelona, where they worked alongside investigators, cross-checking real-time operational data, assisting with operations on the ground, and conducting forensic extractions of mobile phones used by the suspects.This investigation is part of a wider operational taskforce at Europol, dedicated to combating Chinese human trafficking networks. Involving 11 countries, the taskforce is focused on dismantling these criminal groups operating across Europe. 

The organised criminal network, composed of mostly Ukrainian but also Armenian, Azerbaijani, or Kazakh nationals, has been providing cash courier and underground banking services to other criminal networks. Chinese actors were also part of this criminal network, providing money laundering services. This catalogue of crime-as-a-service offerings was used by various Russian-speaking and Asian criminal actors engaged in drug trafficking, tax evasion, or the smuggling of illicit goods. These crimes were mostly committed in Spain.Results of the action days include:23 suspects arrested (20 in Spain, 1 in France, and 2 in Slovenia)91 house searches carried out (77 in Spain, 1 in France, and 13 in Cyprus)17 additional suspects prosecutedEUR 8.2 million in cash seizedEUR 27 million in cryptocurrency seized or frozenEUR 2 million in bank accounts seized or frozen36 vehicles (including some luxury vehicles), real estate, luxury watches, jewellery as well as electronic devices seizedAbuse of temporary protection status as Ukrainian citizensThe suspects are believed to have abused the temporary protection status granted to Ukrainian refugees by the EU since 2022, as well as other citizens affected by the Russian war of aggression against Ukraine. Many of the millions of refugees from Ukraine took their savings with them to Europe in cash to safeguard it from the consequences of the war. Taking advantage of the exceptions put in place to facilitate the transfer of money between jurisdictions, the criminal network moved huge amounts of cash without being questioned in detail or scrutinised during customs checks. Declaring the cash sums as part of their own patrimony, the money mules, some of whom are family members of the criminal leaders, travelled regularly between Spain, Cyprus, France, and other countries. Once several cash couriers started to be arrested, the criminal network adapted their modus operandi. It moved from significant physical cash movements to the cryptocurrency sphere, making the money transfers harder to detect. According to initial estimates, at least EUR 75 million had been moved from March 2023 to February 2024. During raids performed in Cyprus, law enforcement seized and froze around EUR 26 million in one cryptocurrency.Europol’s roleEuropol supported this international operation with experts specialised in financial crime, fighting high-risk criminal networks, unravelling money laundering structures, and tracing cryptocurrency flows. Providing analytical, operational, and coordination support to the involved countries from the very start, Europol supported the action days by deploying analysts and specialists. During the action days, these experts performed cross-checks with their mobile offices, gave forensic support in reading out seized electronic devices, and provided cryptocurrency expertise. Europol was also part of the judicial Joint Investigation Team formed by Eurojust and involving Spain, Cyprus, and Germany. 

His Majesty the King of the Netherlands visited Europol today, where he gained insight into the Agency’s efforts to support EU Member States in tackling serious and organised crime, and terrorism.Europol’s Executive Director Catherine De Bolle welcomed His Majesty to the organisation’s headquarters as Europol recently marked 25 years of fostering law enforcement cooperation across Europe and beyond. Becoming fully operational in 1999, Europol is headquartered in The Hague, the Netherlands, serving as a hub for European police collaboration.During the visit, His Majesty toured Europol’s Operational and Analysis Centre, where he observed how live operational intelligence is processed to assist ongoing investigations. With a workforce of over 1 700 people and a network of more than 300 liaison officers, Europol provides around-the-clock support to law enforcement authorities across Europe and to partners worldwide.His Majesty was also briefed on Europol’s efforts to combat priority crime areas, including drug trafficking, migrant smuggling, human trafficking, and the online sexual exploitation of children. These transnational crimes pose significant threats to the safety and security of EU citizens, and Europol plays a vital role in coordinating efforts to dismantle the criminal networks behind them. In 2024 alone, Europol supported over 3 300 investigations across Europe and beyond.As part of his tour, the King met with liaison officers from Norway and Ukraine, who are based at Europol’s headquarters. They shared their experiences of working with Europol as partner countries to enhance international cooperation in the fight against organised crime.Europol’s headquarters in The Hague connect more than 3 000 law enforcement authorities from over 70 countries and international organisations, reinforcing its position as a central player in the international fight against serious organised crime.

The fugitive was wanted in connection with multiple serious offenses across Poland and Germany. These included his suspected involvement in a fatal violent incident in Poland in December 2021, in which the victim succumbed to his injuries. He was also convicted in Poland for a violent offence in 2019, for which he was sentenced to one year in prison, and for additional crimes, including drug-related offences, resisting arrest, and insulting law enforcement officials, for which he received a 3.5-year prison sentence.This arrest highlights the effectiveness of Europol’s EU Most Wanted website and the critical role the public plays in supporting law enforcement efforts. By submitting information anonymously, individuals help ensure justice.This website has a proven track record since its launch in 2016:479 fugitive profiles have been published.167 fugitives have been apprehended.54 arrests occurred directly due to profiles published on the platform.One tip could make all the difference, check out our website to see if you recognise anyone. If you do recognise one of the fugitives featured on EU Most Wanted website, do not approach them directly. Let the national FAST teams know through the fugitives’ profile pages.

The Spanish Civil Guard (Guardia Civil), supported by Europol, has dismantled a large-scale drug trafficking network in an investigation involving Bulgaria, Colombia, Costa Rica and Panama. The suspects were allegedly involved in the reception and wholesale distribution of cocaine across the EU, as well as in money laundering. The sting was coordinated by Europol’s Operational Taskforce.Network spans Latin America, Europe and the Middle EastThe investigation, initiated in June 2022, uncovered this drug trafficking network operating across three continents. The members of the network – nationals from Albania, Bulgaria, Colombia and Spain – organised the trafficking of large quantities of cocaine from the source country to Europe. They each took on different roles within the logistical chain. The Colombian nationals handled the shipments from Colombia to Europe, while Bulgarian, Colombian and Spanish nationals oversaw the reception and further distribution of the drugs. The rescuers hid in a container to sneak into the port and, with the help of corrupt workers, extracted the cocaine during the night.  Other Albanian members, based in Dubai, acted as investors – they provided the finances needed to pay the producers for the shipments from Colombia. Members of the network also laundered the proceeds from their crimes. Intelligence suggests that the criminal network had the capacity to receive up to one tonne of cocaine per week. The shipments were made via air cargo and maritime containers. In October 2024, authorities seized 4.1 tonnes of cocaine in Panama, destined for Spain, in connection with this network. The network is allegedly linked to cocaine seizures totalling over seven tonnes. In addition, law enforcement authorities had seized another two tonnes of cocaine in Spain since the beginning of the investigation. Results of the action, carried out in three phases, between December 2024 and January 202522 arrests in Spain (Spanish and Colombian nationals);27 house searches in Barcelona, Cádiz, Madrid, Malaga and Valencia;Seizures include about 1 tonne of cocaine and 5 kg of ‘tusi’ (pink cocaine), 35 vehicles, including 8 luxury cars (estimated valued of about EUR 2.5 million), luxury watches and jewellery (estimated value of about EUR 1.5 million) and EUR 6.5 million in cash;48 weapons (5 long weapons, 5 handguns and 38 historical type weapons);53 bank accounts frozen.Europol’s support and Operational Taskforce The increase in cocaine shipments from South America to Europe, as well as the penetration of criminal networks into legal and illegal businesses in the EU, prompted the creation of an Operational Taskforce at Europol. The Taskforce targeted these groups in the source countries and along the distribution chain. During the investigation, Europol coordinated the exchange of information between national authorities, bringing them together to efficiently target the entire drug trafficking network. In addition, Europol provided continuous intelligence development, analysis and digital forensic expertise to support investigators. This intelligence gave law enforcement agencies the full picture of the covert network operating across various countries and continents. During the action days, Europol deployed experts to Spain to provide analytical and technical support to officers in the field.The following law enforcement authorities took part in the operation:Bulgaria: General Directorate Combating Organised Crime (Главна дирекция „Борба с организираната престъпност“)Colombia: Colombian National Police (Policía Nacional de Colombia)Panama: Panama National Police (Policía Nacional de Panamá)Spain: Civil Guard (Guardia Civil)