Top Stories

During the action week, hundreds of law enforcement officers carried out more than 630 house searches and 107 arrests. Nearly 500 converted - or ready to be converted - firearms were recovered during the operation, together with almost 900 firearms. Other weapons, such as air guns or rifles designed to fire metal pellets, were also recovered, along with over 60 000 rounds of ammunition.Results of the action:107 arrests;636 house searches;495 unconverted and converted alarm and signal weapons seized;893 other weapons and firearms seized;60 192 rounds of unconverted, converted, and live ammunition seized;19.5 kg of drugs (heroin, cocaine, cannabis).From legal to lethalWhile 3D-printed weapons are often reported on, law enforcement authorities estimate that converted gas-alarm and signal firearms account for close to half of the illicit weapons in circulation within the EU.Individuals and organised criminal networks often use this type of firearms, as certain models remain easy to modify to discharge live ammunition and convert into lethal weapons.Once they enter the EU, they are usually bought for an affordable price from legitimate marketplaces. The weapons would then be converted and resold in other countries where obtaining, importing, and possessing a handgun requires a license.Converted firearms are dangerous, life-threatening weapons which have been used by criminal organisations in numerous recent deadly shootings in the EU.Europol’s role against firearms traffickingEuropol plays a key role in supporting Member States in the fight against criminal networks involved in illegal weapons trafficking. Europol’s experts and analysts work closely with counter-terrorism specialists on international investigations and combine efforts with Member States to help make Europe safer.Europol coordinated the international operation, analysed the collected data, and drafted intelligence packages to inform the affected countries about potential targets and arms sales. This input helped support the coordinated action days in February. The operation was supported by the European Commission and funded by the European Multidisciplinary Platform Against Criminal Threats (EMPACT).Countries involved in the operation:Belgium, Bulgaria, Germany, Greece, Latvia, Portugal, Romania, Slovenia, Sweden, Albania, Moldova, North Macedonia, Norway, Serbia, Ukraine, United Kingdom.

A joint operation involving law enforcement authorities from France and the United Kingdom, supported by Europol, led to the dismantling of a Vietnamese criminal network smuggling migrants across the English Channel. The network was also involved in sexual and labour exploitation and money laundering.The criminal network smuggled migrants from Poland and Germany through France to the United Kingdom. The main organiser - the right hand of the leader of the criminal network - organised the smuggling activities, while another their accomplice was in charge of collecting the money and organising migrant convoys. Most of the migrants had illegally entered the EU through the use of fraudulently obtained working visas. Some of the irregular migrants were smuggling methamphetamine to the region of Paris, supplying Asian drug trafficking groups based in the area in return for a reduced price for their journey. Other migrants suffered sexual exploitation or labour exploitation in grocery shops and nail salons.Results from 22 April 2024:16 locations searched (12 in France, 4 in the United Kingdom),16 arrests (12 in France and 4 in the United Kingdom),Seizures including: vehicles, luxury goods and watches, synthetic drugs, electronic equipment, documents and the equivalent of over EUR 100 000 in cash in different currencies and EUR 289 000 in bank accounts.Between EUR 15 000 and EUR 18 000 per migrantAnother member of the criminal network was in charge of arranging migrants’ accommodation in the Paris region, before their eventual smuggling to the United Kingdom. The same individual was also in charge of smuggling migrants entering the EU via Poland. After their stay in the region of Paris, the migrants were transported to the region of Dunkerque. Other smugglers then organised their crossing of the English channels using small boats. The investigation suggests that the network may have also organised the transportation of migrants from France to the United Kingdom by trucks. In total, the migrants had to pay between EUR 15 000 and EUR 18 000 to be smuggled to their final destination; the United Kingdom.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to France to cross-check operational information against Europol’s databases and to provide leads to investigators in the field.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Coordinated activities of law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania, Poland and Sweden, supported by Europol, targeted a large criminal network smuggling migrants from Belarus and Russia to the EU via the North Baltic route. During this coordinated action day in the framework of Europol’s Operational Task Force (OTF) Flow II, the efforts of the members of the OTF led to the arrests of High Value Targets and other main suspects in Finland, Germany, Lithuania and Poland as well as checks in Estonia, Latvia and Lithuania.The action days between 22 and 24 April led to:21 arrests of mainly Egyptian, Iraqi and Syrian nationals (4 in Finland, 1 in Germany, 1 in Lithuania and 15 in Poland),24 locations searched (10 in Finland, 8 in Germany, 2 in Lithuania, 1 in the Netherlands and 3 in Poland),The seizures include vehicles, golden jewellery, electronic equipment, forged ID documents, various other documents, money counting machines, drugs, counterfeit cigarettes and more than EUR 80 000 in cash.Between EUR 3 000 and EUR 5 000 to enter the EU from RussiaThe criminal network, composed mainly of Egyptian, Iraqi and Syrian nationals, was very flexible. They adapted their modus operandi and smuggling route quickly, depending on different factors such as visa regulations, natural conditions on the route and taking advantage of the geopolitical situation. The criminal network smuggled the migrants from Iraq via Russia and Belarus to the EU, the main final destination countries were Germany and the United Kingdom. The smugglers used cars, small vans, pickup trucks, and other enclosed vehicles, that are not intended for the transport of people, but exclusively for the transport of goods.The different criminal groups in the network were connected across borders and well positioned along the smuggling routes, forming an efficient smuggling network. They used shared organisers, drivers and other members dealing with the financial flows through the hawala underground banking system. The main organisers operated clandestine financial flows using the hawala network from regional offices in different countries including Germany, Iraq, Syria and Türkiye. The migrants paid between EUR 3 000 and EUR 5 000 per person depending on the illegal service (smuggling route, transportation means and circumstances). They paid the hawala offices directly, also in cryptocurrencies, while the drivers were paid in cash by local members of the criminal network. Investigations into the financial flows suggest that some of the illegal profits were used for the financing of terrorism.Migrant smuggling from Belarus and Russia to the EUIn February 2022, Europol set up OTF Flow with an operational base in Vilnius, Lithuania. The OTF led to the dismantling of a criminal network smuggling migrants from Iraq via Türkiye, Russia and Belarus into the EU and the arrests of 9 out of the 11 High Value Targets identified during this investigation. The successful outcome of the first OTF Flow, known as OTF Flow I, led to the continuation of the taskforce under OTF Flow II. New investigations have been launched via OTF Flow II, with the operational planning being adapted to current challenges, changes in smuggling routes and geopolitical developments affecting the criminal landscape. The investigations focused on 12 High Value Targets, the main organisers of the migrant smuggling activities.OTF Flow is composed of representatives from law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania and Poland, as well as Europol experts. Previous investigations led to increased cooperation with the Netherlands, Sweden and the United Kingdom. This special set-up was created specifically to support national authorities in combatting the increase in migrant smuggling activities across the EU-Belarus border. Through OTF Flow, Europol supports the coordination of joint investigative and operational activities, and facilitates the information exchange between the involved law enforcement authorities. The OTF was created following the Joint Investigative Cell (JIC), set up by Lithuania in June 2021, to tackle the newly-emerged phenomenon of migrant smuggling across the North-Eastern EU border.Law enforcement authorities involved:Estonia: Estonian Police and Border Guard Board (Politsei- ja Piirivalveamet);Finland: Finnish Border Guard (Rajavartiolaitos);Germany: German Federal Police (Bundespolizei);Latvia: State Border Guard (Valsts robežsardze);Lithuania: State Border Guard Service (Valstybės sienos apsaugos tarnyba) and National Police (Lietuvos policija);Netherlands: National Police (Politie);Poland: Border Guard (Polska Straż Graniczna);Sweden: The Swedish Police Authority (Polismyndigheten).Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Straightforward yet sophisticated modus operandiIn 2022 and 2023, the criminal group managed to steal rare books from national and historical libraries in Czechia, Estonia, Finland, France, Germany, Latvia, Lithuania, Poland and Switzerland. The thieves would target rare books by mainly Russian writers, such as first editions authored by the likes of Alexander Pushkin or Nikolai Gogol.When visiting libraries, the thieves would request to check the antique books in person, feigning a specific such as academic interest. On this occasion, they would meticulously measure the books and take photographs before handing them back. Several days, weeks, or months later, the perpetrators would return and ask to access the same books, this time returning counterfeit versions. Experts have established that the copies were of outstanding quality.In other cases, the perpetrators relied on a more crude approach and simply broke into libraries. In preparation of the thefts, they would typically visit libraries and research the books they later stole.International effort to tackle cultural goods theftThe international investigation came to life after France sent a SIENA message to Europol, which prompted further partners to confirm they had identified similar modi operandi in their territories. With reports of rare and historical books being stolen across Europe, Europol facilitated the information exchange between the affected countries and helped to identify the main suspects, three of which were swiftly apprehended. Europol’s analysis on this case helped to create links, identify leads and even uncover a theft that had not yet been discovered. Developing this investigation from the very beginning, Europol’s experts reached out to law enforcement in the affected countries to register the stolen antiques in the relevant databases. Leading up to the action day, two operational meetings were held in the Europol headquarters in The Hague, Netherlands.In Georgia, authorities opened an investigation to identify and locate several members of the organised crime group. Supported and funded by Eurojust, a joint investigative team involving France, Georgia, Lithuania, Poland, Switzerland as well as Europol was formed. A coordination centre was established at Eurojust on the action day.Joint investigation team:France, Georgia, Lithuania, Poland, SwitzerlandParticipating countries:Czechia, Estonia, Finland, Germany, LatviaParticipating agencies:Europol, Eurojust

A cross-border investigation led by the Romanian Police (Poliția Română), supported by Europol and involving the Austrian Police (Landeskriminalamt Salzburg) and the Italian Carabinieri Corps (Arma dei Carabinieri), has resulted in the dismantling of an organised crime group involved in migrant smuggling. The group arranged the illegal arrival in Romania of migrants via fraudulently obtained work visas, before facilitating their further illegal movements towards other EU countries.Results from 24 April 202429 locations searched (2 in Austria, 6 in Italy and 21 in Romania),12 arrests in Romania,Seizures including: luxury cars, electronic equipment, documents and the equivalent of over EUR 146 000 in cash in different currencies.Visa fraud to enable smuggling of migrants from Pakistan to the EUThe criminal network was composed mainly of Romanian and Pakistani nationals, who had established companies in Romania. The suspects allegedly brought Bengali, Egyptian and Pakistani nationals to Romania with work visas, fraudulently obtained by misleading the competent authorities. The investigation identified other Romanian companies, managed by Romanian nationals cooperating with the criminal network, which were also used for fraudulently acquiring work permits and visas. The criminal network requested 509 work permits in total from Romania and acquired permits for 102 migrants. The migrants used these fraudulently obtained visas to illegally enter Romania. Investigative leads suggest that 76 migrants who arrived in Romania using these fraudulent documents have then made secondary movements to other EU countries. During the investigation, 26 migrants were detected in Romania, Italy and Austria. The criminal network charged between EUR 5 000 and EUR 6 000 per person to arrange the arrival to Romania and another EUR 2 000 to EUR 5 000 per migrant for the secondary movement to another EU country. The criminal network is believed to have gained at least EUR 1 million illegal profits.Members of the network based in Pakistan were responsible for the local recruitment of migrants who wanted to reach the EU. Other members of the criminal network arranged the accommodation of migrants in different locations in Brasov and Bucharest before further transporting them to the area of Timisoara. From there, other accomplices picked up the migrants and transported to the Romanian-Hungarian border, where the migrants illegally crossed green borders on foot or hidden in various means of transport. National authorities detected a number of migrants smuggled by this network while they were crossing the borders or directly in the territory of other EU states, mostly in Italy and Austria. In one of the cases in Italy, the Italian authorities detected 45 irregular migrants on foot along the Italian-Slovenian border.Cross-border cooperationEuropol supported the investigation within the framework of the operational plan signed with Romania in regards to the Ukrainian crisis. Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed one analyst to Italy and one to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field.A joint investigation team (JIT) was set up between the Italy, Romania and Europol with the support of Eurojust in April 2024. Eurojust gave additional cross-border judicial support during the action day.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The primary objective of operation codenamed “Black Tie” was to indict and prosecute a Bosnian-Herzegovinian/Dutch national considered a High Value Target by Europol and the Netherlands. In 2023, the suspect was sentenced to seven years in prison for drug trafficking by Dutch authorities. Another operational objective was to disrupt the entire criminal organisation under the command and control of the High Value Target. This joint international investigation was comprised of Belgian, Bosnian-Herzegovinian, French, and United States law enforcement, supported by Europol.Despite his arrest in November 2022, the investigation showed that the High Value Target continued to steer drug trafficking from source countries in South America such as Brazil, Colombia, and Peru, to Europe and Australia from his base in Dubai, United Arab Emirates. Cooperating with other top-tier international drug traffickers in Dubai, with whom he jointly invested in multi-ton cocaine trafficking ventures, the Bosnian-Herzegovinian/Dutch national became a powerful figure in control of the massive cocaine supply towards Europe and other destinations. Furthermore, the High Value Target is also suspected to be responsible for the production of synthetic drugs in the EU.Targeting the drug kingpin’s ‘inner circle’Among the 23 persons arrested yesterday are not only accomplices, but also corrupt officials identified as facilitators of the network’s criminal activities. Leading up to this action, Bosnian-Herzegovinian authorities already arrested two suspects and seized EUR 55 000 in cash, 8 firearms, 11 police radios and money-laundering documentation. On the action day, law enforcement seized further cash, cars, laptops and other evidence.Following an information request received in June 2023 from Bosnia and Herzegovina, Europol supported the Bosnian-Herzegovinian authorities in the investigation against a core group, or ‘inner circle’, of trusted members of the High Value Target’s criminal organisation. Amongst other criminal offences, the national judicial case was centred on serious crimes such as large-scale drugs trafficking, money laundering and related organised crime in Bosnia and Herzegovina.Europol’s roleEuropol deployed two specialists with mobile offices to Bosnia and Herzegovina in order to gather and cross-check intelligence and assist in further coordinating activities. In addition to the support provided leading up to yesterday’s action, Europol has been supporting the overall investigation with intelligence and coordination. Since early 2021, Europol’s experts have developed and shared over 30 intelligence packages related to the high-value target and his criminal network.Participating law enforcement agencies:Belgium: Federal Judicial Police Antwerp (Federale Gerechtelijke Politie Antwerpen);France: National Police (Police Nationale - Office anti-stupéfiants (OFAST));Bosnia and Herzegovina: Ministry of Interior of Canton Police Sarajevo (Ministarstvo unutrašnjih poslova Cantona Sarajevo, Policija Kantona Sarajevo);United States: Drug Enforcement Administration (DEA); Federal Bureau of Investigation (FBI).

Privacy measures currently being rolled out, such as end-to-end encryption, will stop tech companies from seeing any offending that occurs on their platforms. It will also stop law enforcement’s ability to obtain and use this evidence in investigations to prevent and prosecute the most serious crimes such as child sexual abuse, human trafficking, drug smuggling, homicides, economic crime and terrorism offences.The declaration, published today and supported by Europol and the European Police Chiefs, comes as end-to-end encryption has started to be rolled out across Meta’s messenger platform.Joint Declaration of the European Police Chiefs (pdf)Europol’s Executive Director Catherine De Bolle, said:Our homes are becoming more dangerous than our streets as crime is moving online. To keep our society and people safe, we need this digital environment to be secured. Tech companies have a social responsibility to develop a safer environment where law enforcement and justice can do their work. If police lose the ability to collect evidence, our society will not be able to protect people from becoming victims of crime.This Joint Declaration was agreed upon at an informal meeting of the European Chiefs of Police in London hosted by the National Crime Agency on 18 April.Police Chiefs of all EU Member States and Schengen Associated Countries were invited, alongside Europol’s Executive Director.Earlier that week, Catherine De Bolle met in with Graeme Biggar, Director of the UK National Crime Agency, as part of regular, strategic exchanges on cooperation between Europol and the United Kingdom following the country’s departure from the European Union.

Between Sunday 14 April and Wednesday 17 April a total of 70 addresses were searched across the world, resulting in the arrest of 37 suspects. This includes the arrest of 4 individuals in the United Kingdom linked to the running of the site, including the original developer of the service.The LabHost platform, previously available on the open web, has been shut down.This international investigation was led by the UK’s London Metropolitan Police, with the support of Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT) hosted at its headquarters.Europol has supported this case since September 2023. An operational sprint was organised at its headquarters with all the countries involved so that the national investigators could identify and develop intelligence on the users and victims in their own countries. During the action phase, a Europol specialist supported the Dutch National Police with their enforcement actions.Commoditising phishing attacksCybercrime-as-a-service has become a rapidly growing business model in the criminal landscape whereby threat actors rent or sell tools, expertise, or services to other cybercriminals to commit their attacks. While this model is well established with ransomware groups, it has also been adopted in other aspects of cybercrime, such as phishing attacks.LabHost had become a significant tool for cybercriminals around the world. For a monthly subscription, the platform provided phishing kits, infrastructure for hosting pages, interactive functionality for directly engaging with victims, and campaign overview services.The investigation uncovered at least 40 000 phishing domains linked to LabHost, which had some 10 000 users worldwide.With a monthly fee averaging $249, LabHost would offer a range of illicit services which were customisable and could be deployed with a few clicks. Depending on the subscription, criminals were provided an escalating scope of targets from financial institutions, postal delivery services and telecommunication services providers, among others. Labhost offered a menu of over 170 fake websites providing convincing phishing pages for its users to choose from.What made LabHost particularly destructive was its integrated campaign management tool named LabRat. This feature allowed cybercriminals deploying the attacks to monitor and control those attacks in real time. LabRat was designed to capture two-factor authentication codes and credentials, allowing the criminals to bypass enhanced security measures.Easily accessible, yet still a crimePlatforms such as LabHost make cybercrime more easily accessible for unskilled hackers, significantly expanding the pool of threat actors.Yet, however user-friendly the service portrays itself to be, its malicious use constitutes an illegal activity – and the penalties can be severe.A vast amount of data gathered throughout the investigation is now in the possession of law enforcement. This data will be used to support ongoing international operational activities focused on targeting the malicious users of this phishing platform.The following authorities have taken part in the investigation:Australia: Australian Federal Police-led Joint Policing Cybercrime Coordination Centre;Austria: Criminal Intelligence Service (Bundeskriminalamt);Belgium: Federal Judicial Police Brussels (Police judiciaire fédérale Bruxelles/ Federale gerechtelijke politie Brussel);Finland: National Police (Poliisi);Ireland: An Garda Siochana;Netherlands: Central Netherlands Police (Politie Midden-Nederland);New Zealand: New Zealand Police;Lithuania: Lithuania Police;Malta: Malta Police Force (Il-Korp tal-Pulizija ta’ Malta);Poland: Central Office for Combating Cybercrime (Centralne Biuro Zwalczania Cyberprzestępczości);Portugal: Judicial Police (Polícia Judiciária);Romania: Romanian Police (Poliția Română);Spain: National Police (Policía Nacional);Sweden: Swedish Police Authority (Polisen);United Kingdom: London Metropolitan Police;United States: United States Secret Service (USSS) and Federal Bureau of Investigation (FBI);Czechia: Bureau of Criminal Police and Investigation Service;Estonia: Estonian Police and Border Guard Board;Canada: Royal Canadian Mounted Police.The list of participating authorities was updated on 18 April 2024 at 12:14 CET.

The crackdown was the result of a long-running investigation led by the Spanish Police and Spanish Regional Catalan Police, supported by Europol and also involving Portuguese authorities. During the action days, law enforcement officers carried out 13 searches that led to the seizure of:EUR 156 000 in cash,gold bars worth EUR 35 000,more than 50 vehicles,jewellery and over 30 luxury watches worth a total of EUR 500 000,electronic devices, such as mobile phones, and a weapon.More than 100 bank accounts and 10 real estate properties worth over EUR 3 million were also blocked as a result of the operation.Europol supported the investigation since September 2021 by providing operational analysis, technical expertise and operational coordination. On the action days, a money laundering specialist with a mobile office was deployed in Spain.An investigation triggered by a cocaine seizureThe investigation began in 2018, when the police seized 1 400 kilos of cocaine hidden in a shipment from Brazil at the facilities of a company located in Sant Boi de Llobregat (Barcelona). The subsequent operation led to the arrest of several members of an illegal drug trafficking network in 2019 and 2020.With the support of Europol, law enforcement authorities discovered that the seized shipment was part of an international drug-trafficking operation aiming at distributing the drugs not only in Spain but across the EU. The high capacity for drug distribution uncovered the necessary economic network that made it possible to finance the drug shipments.Numerous hard-to-trace methods to launder moneyThe investigation revealed that the shipments were carried out by a large group of people and companies based mainly in Almería, Andalucía, Catalunya and Madrid. Authorities also uncovered that the criminals were using several complex methods to launder money, which allowed them go unnoticed for years. The most common of these was the use of money mules. The gang divided large amounts of cash into multiple small transactions made by several money mules (a practice known as ‘smurfing’). The deposits made in this way were small enough to remain under regulatory reporting limits, thus avoiding detection.The criminals also injected money into a network of companies they controlled, simulating business relationships to justify transfers of funds. At the same time, they had frontmen for registering ownership of assets in South America and used cars with hidden compartments to transfer cash, usually on the route Barcelona – Madrid – Lisbon.More potential arrestsThe criminal organisation had been active for more than eight years. Following a meticulous three-year investigation, Spanish and Portuguese authorities coordinated this joint operation in Andalucía, Aveiro, Catalunya, Lisbon and Madrid that led to the dismantling of the gang and the arrest of its leaders. 7 of the 20 arrested have already been imprisoned; 1 in Venezuela, another in Portugal and the rest in Spain. Some of the criminals linked to the gang were already imprisoned for other drug trafficking-related crimes.The operation is ongoing and law enforcement authorities do not rule out more arrests in the future.Participating authorities:Portugal: Portuguese Judicial Police (Policia Judiciária);Spain: Spanish National Police (Policía Nacional); Spanish Regional Catalan Police (Mossos d'Esquadra).Participating agencies:EuropolEurojustINTERPOL

According to judicial estimates, the total damages resulting from fake investments in the advertised cannabis cultivation crowdsourcing platform amount to a staggering EUR 645 million, but actual and unreported damages could be significantly higher. In total, an estimated 550 000 participants worldwide, most of them European citizens, were registered as online investors. Using bank transfers or cryptocurrencies, around 186 000 participants actually transferred funds into the elaborate Ponzi scheme active from early 2020 to July 2022.JuicyFields and its fake cannabis investment opportunitiesThe suspects, of mainly Russian but also Dutch, German, Italian, Latvian, Maltese, Polish, Jordanian, United States and Venezuelan nationality, used advertisements on social networks to lure victims to their websites. These platforms offered promising crowdsourcing investment opportunities in the cultivation, harvesting and distribution of cannabis plants to be used for medicinal purposes.With a minimum initial investment of at least EUR 50 in this so-called ‘e-growing’ opportunity, investors were promised to be linked with producers of medical cannabis. Upon the purchase of a cannabis plant, the platform assured investors – also referred to as e-growers – they could soon collect high profits from the sale of marijuana to authorised buyers. While the company pledged annual returns of 100 percent or more, they did not reveal exactly how they would accomplish this, let alone be able to guarantee it.The legalisation of cannabis cultivation or the expansion of permissible THC content in cannabis products for personal, recreational, and therapeutic purposes is a significant subject of public debate within the EU. This discourse is further fuelled by the reality that cannabis stands as one of the most widely consumed illicit substances both within the European Union and globally. As seen in other contexts, criminal networks are particularly adept at applying new narratives to existing criminal practices, particularly in periods of changes in regulatory frameworks, which may open up a window of opportunity for fraudsters to advertise low-risk, high-profit investment opportunities.A classic “too good to be true” Ponzi schemeA Ponzi scheme is a type of investment scam where criminals promise high returns with little or no risk to investors. Instead of actually generating profits through legitimate business activities, the scammers use money from new investors to pay returns to earlier investors. This creates the illusion of a profitable enterprise, but in reality, the scheme collapses when there aren't enough new investors to sustain the pay-outs, leaving most investors with losses.As an example, the average - even cautious - investor would make an initial investment of EUR 50 and receive a pay-out doubling their money soon after. Motivated by these financial gains, many investors would raise the stakes and pay in hundreds, thousands, or in many cases even tens of thousands of euros. The platform feigned credibility as it was not only represented in the digital world, but upheld the image of a trustworthy legal business structure with physical offices, staff and representation at cannabis industry events. Initially, the more than 500 000 e-growers were receiving their investment returns. In July 2022 however, the criminals behind the scheme abruptly removed company profiles from social media networks and stopped users from logging in to their accounts, thus freezing cash withdrawals.Complex investigation following elaborate fraud schemeThe widespread occurrence of police reports across Europe prompted Europol to initiate a coordinated approach for investigations involving multiple EU and non-EU countries. This law enforcement focus on JuicyFields and related investment platforms was followed by the establishment of a joint investigation team at Eurojust, led by German and Spanish Police, French Gendarmerie and supported by Europol, the National Crime Agency of the United Kingdom and other law enforcement from numerous Member States. After painstakingly piecing together breadcrumbs of digital evidence, investigators had drawn up a joint intelligence picture that allowed police forces across Europe to initiate this wave of arrests.One of the primary High Value Targets in this investigation was traced to a residence in the Dominican Republic. The Russian national, suspected to be one of the main organisers of the fraudulent scheme, had a property he was residing at searched by the Dominican Republic authorities with officers from the Spanish investigation team along with a Europol specialist deployed on site to assist with coordination.Europol’s roleEuropol supported this massive cross-border investigation from the very start, taking the lead in operational coordination and providing tailored analytical support. Furthermore, Europol shared results of financial investigations as well as other intelligence with the involved countries. On the action day, Europol deployed officers with mobile offices to various locations around the globe. Eurojust ran a coordination centre, staffed by senior police officers from the various investigation authorities, prosecutors and Europol staff, to assist with the coordination of legal coercive measures in multiple countries in multiple time zones. Avoid falling victim to online fraudAs with many things in life, if an online investment opportunity seems too good to be true, it probably is. Learn how to identify the most common cyber scams and how to avoid falling victim to them.Joint Investigation Team:France: National Gendarmerie (La Gendarmerie Nationale)Germany: Criminal Investigation Department Berlin (Landeskriminalamt Berlin); Berlin public prosecutor's office (Staatsanwaltschaft Berlin)Spain: National Police (Policía Nacional - Unidad de Delincuencia Económica y Fiscal (UDEF))Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Dominican Republic, Estonia, Finland, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovak Republic, Slovenia, Switzerland, United Kingdom, United StatesParticipating agencies:EuropolEurojustThe list of participating countries was updated on 12 April 2024 at 16:14 CET.

The platform enables the swift exchange of operational and strategic information among Europol, EU Member States and partner countries with which Europol has cooperation agreements or working arrangements. This service is available 24 hours a day, 7 days a week.In a world where threats can materialise at a moment’s notice, and criminals operate across borders with unprecedented speed and sophistication, the timely exchange of information facilitated by SIENA is essential for law enforcement at local, national and international levels to respond swiftly and decisively.In 2023, the number of messages exchanged via SIENA grew to a historical high of 1.79 million, reflecting the role of SIENA as the preferred European communication channel for law enforcement. That same year, over 151 000 cases were initiated via SIENA. The most commonly indicated crime areas were drug trafficking, fraud and illegal immigration. The expansion of SIENA to encompass more countries will ultimately benefit European citizens, as the intelligence picture of criminal threats affecting the European Union will be significantly enriched the more law enforcement authorities are connected.Europol’s Deputy Executive Director for Capabilities, Andrei Linta, stated: “One of Europol’s strategic priorities is to continue to provide Member States with access to a growing number of partners and sources of information. SIENA is at the core of these efforts. In an increasingly globalised world, access to real-time information from all corners of the EU and beyond enables law enforcement authorities to have a more comprehensive picture of the criminal activities, allowing them to protect their communities more effectively.”In May 2023, SIENA received a “legislative home” in the shape of the Directive 2023/977 of the European Parliament and of the Council on the exchange of information between the law enforcement authorities of Member States (IED), which requested that all competent law enforcement authorities that might be involved in exchanges of information should be directly connected to SIENA.

The investigation was initiated by Carabinieri anti-counterfeiting investigators in January 2023, who received support from Europol. The aim of the investigation was to take down the Naples-based criminal group. The group was mostly active in France, Spain, Germany, Belgium and the Netherlands, but they sold their counterfeit banknotes across Europe.Europol facilitated the information exchange and financed and coordinated several operational activities. Europol also provided analytical support to identify countries in which the banknotes were distributed. During the action day, Europol deployed an expert to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems.Participating authorities:Italy: Carabinieri (Comando Carabinieri Antifalsificazione Monetaria (CCAFM))France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))

Europol’s new report, published today, entitled “Decoding the EU’s most threatening criminal networks”, delves into the characteristics of the criminal networks that pose the highest threat. This Europe-wide analysis focuses on criminal actors in a first-of-its-kind mapping of the most threatening criminal networks. It describes, in detail, how the most threatening criminal networks are organised, which criminal activities they engage in, and how and where they operate. It also assesses which of their characteristics increase the threat posed by these networks.This mapping report is one of the key deliverables of the Belgian presidency of the Council of the European Union which strongly encouraged the efforts of Europol in this respect. It will be an essential tool to fight organised crime, a top EU priority, as outlined in the recent roadmap presented by the European Commission.Speaking at a press conference on the occasion of the presentation of the main findings of the report, Europol’s Executive Director, Catherine De Bolle, said:Criminals thrive in secrecy, but we are changing that. This Europol report is the most extensive study on key criminal networks ever undertaken at the European level by law enforcement. Thanks to the collaboration of all EU Member States and 17 Europol partner countries, we are shining a light on the activities of the most threatening criminal networks in the EU. This data, now centralised at Europol, will give law enforcement agencies the edge they need to better target and conduct cross-border criminal investigations.The Belgian Minister of Home Affairs, Annelies Verlinden, said:We are introducing a new tool in the battle against serious and organised crime – a testament to the power of unity and innovation within the European Union. This report represents a significant milestone for our Belgian Presidency, and indeed, for the entire European community, reflecting our unwavering commitment to safeguarding the safety and security of our citizens. While this report is a very important achievement in itself, it is just the beginning. Considerable work and further steps are required in the coming months and years.The Belgian Minister of Justice, Paul Van Tigchelt, said:Combating organised crime is an absolute priority for the Belgian Presidency and this is an important new weapon in that fight. We now have, for the first time, all crucial data on the most threatening criminal networks in one location - with Europol. The next step is for the various police forces of the Member States to continue to enrich this centralised information so we can further prosecute and dismantle these networks.The European Commissioner for Home Affairs, Ylva Johansson, said:Organised crime is one of the biggest threats we face today, threatening society with corruption and extreme violence. We need to know what we’re fighting – that’s why mapping organised crime is a key objective of our EU organised crime strategy and the roadmap I launched last October. The result is this important report showing the criminal threat posed by over 800 criminal networks with tens of thousands of members. I congratulate Europol on this important report.The European Commissioner for Justice, Didier Reynders, said:The impact of these findings will have significant implications for justice systems across the EU and the rule of law. Judges and prosecutors can only fight organised crime if they are free from intimidation, threats or attempts to influence their professional integrity. We must assure that this is the case. As the most threatening criminal networks run borderless criminal operations, cooperation between experts is vital. This is why the Commission will be supporting proposals for a new EU judicial network, to be placed at Eurojust, with a focus on organised crime, including High Value Targets.A unique datasetThis analysis is based on a unique dataset which was shared with Europol specifically for this purpose, and complemented with additional information already shared with Europol as the European hub for criminal information.All EU Member States and 17 of Europol’s partner countries contributed data to identify the most threatening criminal networks in Europe. This resulted in a unique dataset of 821 highest-risk criminal networks, with extensive information on all aspects that describe them and help assess their threat.These criminal networks, whose membership exceeds 25 000 individuals, were selected based on criteria around the threat they pose. These networks are active in a range of crime areas, from drug trafficking to migrant smuggling, property crime and others.Trends around the most threatening criminal networks were identified by Europol through the analysis of the full dataset of 821 networks.The ABCD of the most threatening criminal networksThrough a comprehensive analysis of 821 criminal networks, an ABCD framework was developed, shedding light on their fundamental characteristics. By categorising key aspects of these groups into four distinct dimensions—A for Agile, B for Borderless, C for Controlling, and D for Destructive—the ABCD framework offers valuable insights into their modus operandi, structures, and operational patterns.The most threatening networks are:Agile: They exhibit a remark agility to adapt their criminal business processes to opportunities and challenges, including those challenges posed by law enforcement. They are able to extensively infiltrate and misuse legal business structures. This helps their criminal businesses thrive, allows them to launder their criminal profits and shields them from detection. 86 % of the most threatening criminal networks make use of legal business structures, the vast majority in the EU.Borderless: The most threatening criminal networks run borderless criminal operations. Their activities touch upon many countries in the world, and their composition is very international, with network members from many countries in the EU and the world. A total of 112 nationalities were represented among the members of the 821 most threatening criminal networks, with 68% of the networks composed of members of multiple nationalities. However, looking at the locations of their core activities, the vast majority maintain a strong geographical focus and do not extend their core activities too broadly.Controlling: The highest-risk criminal networks exert strong control and focus over their criminal operations. They tend to specialise in one main criminal business; truly polycriminal networks are the exception rather than the norm. The leadership of 82% of the most threatening criminal networks is settled either in the main country of activity, or the country of origin of the key members.Destructive: The criminal activities and corruptive practices of the most threatening criminal networks are inflicting significant damage to the EU’s internal security, rule of law and economy. Half of the most threatening criminal networks are involved in drug trafficking as the/a main criminal activity. More than 70 % of networks engage in corruption to facilitate criminal activity or obstruct law enforcement or judicial proceedings. 68% of networks use violence and intimidation as an inherent feature of their modus operandi.The threat posed by these networks is pervasive and complex. There is a need for a concerted, sustained, multilateral response and joint cooperation.The ABCD of criminal networks highlights important elements to guide policy and operational action. It is a starting point for future analysis of criminal actors and will be further elaborated in forthcoming Europol analytical products, such as the EU Serious and Organised Crime Threat Assessment 2025.This data, now centralised at Europol, will assist national law enforcement authorities to better target and conduct their cross-border criminal investigations.

The report is the first of its kind to analyse in depth the characteristics that make criminal actors particularly threatening to the EU’s internal security.All EU Member States and 17 third countries contributed data for this analysis, resulting in a unique dataset over 800 criminal networks. The assessment will help law enforcement and policymakers to identify measures to disrupt them.The press conference will start with opening remarks, followed by a Q&A.WhoEuropol’s Executive Director Catherine De BolleBelgian Minister of Home Affairs Annelies VerlindenBelgian Minister of Justice Paul Van TigcheltEuropean Commissioner for Home Affairs Ylva JohanssonEuropean Commissioner for Justice Didier ReyndersWhenFriday 5 April at 08:30 CESTWhereResidence Palace – Room Polak, Rue de la Loi 155, 1040 Brussels, BelgiumThe press conference will also be livestreamed.Questions will only be taken from the media attending in person.AccreditationMedia wishing to be accredited for in-person need to send their details (name of the journalist + name of the media) to press@europol.europa.eu by Thursday, 4 April, at 17:00.The conference room will be available for media to set up as from 07:45 CEST. Everything must be pre-set by 08:20 CEST.NOTE: Material for media will be made available on Europol’s website on the day at 08:30 CEST.

This Working Arrangement not only brings together CBI and Europol but also links the law enforcement authorities in the Republic of India with law enforcement authorities of the Member States of the European Union, as well as third countries and organisations associated with Europol. It establishes clear mechanisms for communication, cooperation, and collaboration, ensuring that respective law enforcement agencies can seamlessly collaborate, share best practices, and support each other.The cooperation may, in addition to the exchange of information, include the exchange of specialist knowledge, general situation reports, strategic analysis results, and training activities. The Working Arrangement also allows for the provision of advice and support in individual criminal investigations. The Director of the CBI, Mr Praveen Sood, said:This working arrangement is an outcome of years of negotiation between CBI and Europol to reach this common ground. This moment marks a significant milestone in our ongoing efforts to combat crime and enhance cooperation between our agencies.” He further highlighted that “The international dispersal of crimes, criminals and proceeds of crimes have necessitated need for expeditious international cooperation. Criminal networks operate across borders, exploiting differences in jurisdictions and taking advantage of modern technologies to evade detection. The arrangement we are signing today reflects our shared commitment to address these challenges through enhanced cooperation and mutual assistance.Europol’s Executive Director, Ms Catherine De Bolle, said:In an increasingly globalised world, the security of the European Union starts abroad. Security challenges have become more complex and multidimensional. Nowadays there is a strong link between what happens outside of the EU’s borders and security within Europe. The Working Arrangement which Europol has signed today with the CBI underscores the interconnected nature of security threats and the necessity of international cooperation to effectively address them. By joining forces with India, Europol further solidifies the EU's commitment to proactive and comprehensive security measures, recognising that safeguarding our citizens requires a coordinated effort on a global scale.After entry into force of the Arrangement, this new level of cooperation will be important for tackling priority crime areas affecting both the European Union and the Republic of India.

The criminals’ technique was as unsophisticated as it was effective. Operating in gangs of three to five members, one accomplice would stake out potential victims in establishments such as fine-dining restaurants or upper-scale hotels. Once they had identified a person wearing an expensive wristwatch, the victim would be observed and followed by a gang member in anticipation of the ideal opportunity. Acting fast and, when necessary, with violence, the other gang members would assault the watch owner, detach the expensive timepiece from the owner’s wrist and typically flee on a scooter.Europe-wide pattern identified at EuropolAn almost exponential increase in the price of luxury watches in recent years has incentivised criminals to increase targeted robberies. Certain rare timepieces have a market price that far exceeds the retail price, which regularly lies in the four or five digits. Typically, these types of robberies would be investigated at local level. However, with incidents of ruthless watch robberies being reported across Europe, national law enforcement authorities shared this information with Europol, where a pattern of organised crime was identified.After sharing analytical findings with its partners, Europol invited investigators from the Naples Squadra Mobile and other involved law enforcement authorities for operational meetings to discuss the gathered intelligence picture. Based on the information at hand, the partners issued European Arrest Warrants for the remaining 8 Italian suspects based in Naples. Europol coordinated the international action day against the criminals and deployed staff to Italy during the raids. The investigation and the action day itself were supported by the @ON Network funded by the EU Commission, led by the Italian Antimafia Investigation Directorate (DIA).Participating authorities:Austria: Criminal Intelligence Service (Bundeskriminalamt); Criminal Police Vienna (Landeskriminalamt Wien);France: National Police (Police Nationale – Brigade de Répression du Banditisme à Paris (BRB PARIS)); Judicial Police (Police Judiciaire Paris);Germany: Federal Criminal Police Office (Bundeskriminalamt); Berlin Police (Polizei Berlin, Direktion 2); Munich Police (Polizei München, Kommissariat 21);Italy: Central Operations Service of the National Police (Servizio Centrale Operativo della Polizia di Stato); Mobile Squad of the Naples Police Headquarters (Squadra Mobile Napoli) with the cooperation of the "Decumani", "Montecalvario" and "Dante" police stations as well as the Naples Air Border Police Office (Polizia di Frontiera Aerea);Spain: National Police (Policía Nacional);Switzerland: Federal Police (fedpol) and various Cantonal Police Forces.Participating agencies:Europol

During the operation on 19 March, law enforcement authorities also conducted 22 house searches in Sibiu and Vâlcea, Romania, where the gang was located. The group operated internationally and had branches in Spain.The operation led to the seizure of:over EUR 174 000 and RON 41 000 in cash55 g of goldelectronic devices, including 135 mobile phones, 29 laptops, 5 tablets, 23 memory sticks, and 326 SIM cards, among others.Europol’s European Cybercrime Centre supported the investigation by providing extensive analytical support. In response to the scale of the crime, Europol brought together national investigators from Romania and Spain. The investigators worked together to establish a joint strategy and prepare the final phase of the investigation. The information exchange was facilitated by the Joint Cybercrime Action Taskforce (J-CAT), hosted at Europol’s headquarters. On the action day, a Europol analyst was deployed to Romania to assist with the investigative measures.A professional and systematic criminal networkThe criminals operated in a sophisticated professional structure comprised of three groups, each with a specific task. One group was responsible for coordinating the gang, while another was in charge of posting fake advertisements on both genuine selling sites and fraudulent phishing platforms. A third group recruited money mules to launder profits acquired from the illegal activities.Although most of the published advertisements listed holiday rentals, criminals would also publicise second-hand cars and electronic devices. According to authorities, the amount spent per victim ranged between EUR 200 and EUR 10 000.The criminal organisation also conducted a type of phishing scam called a Business Email Compromise. The criminals would use malware to intercept victims’ emails and mislead them into sending funds to accounts owned by the criminal network.Romanian and Spanish police believe that the number of victims impacted by this scam could exceed one thousand. The police also noted that the victims were mainly from Spain. Through all of these illegal activities, the criminal organisation garnered profits estimated to amount to millions of euros.Fake online advertisements ruin holidaysHoliday fraud happens when a victim pays a travel agent, private entity or agency for rental services offered online, such as accommodation, transport tickets, rental cars or complete holiday packages to then find out that the service does not exist.To help prevent people from falling for holiday scams, Europol has published a full prevention guide "Protect yourself from holiday and ticket fraud".

A joint operation between the Spanish National Police (Polícia National) and the Spanish Civil Guard (Guardia Civil), supported by Europol, has led to the arrests of two men and a woman in Cádiz and Granada. The suspects carried out migrant smuggling activities, which resulted in deaths. The presumed members of the smuggling network allegedly facilitated the travel of migrants, in boats, between Kenitra (Morocco) and Cádiz (Spain). The joint investigation between the Spanish National Police and the Civil Guard resulted in the discovery of the precise location of the boat and the identification of the itinerary of this smuggling activity. On the action day, the officers carried out searches at the suspects’ addresses in the city of Granada and the towns of Algeciras and San Roque (Cádiz) and arrested them.  The investigation led to the identification of three suspects, allegedly responsible for the death by drowning of five migrants who were thrown into the sea in November 2023. The three suspects allegedly forced the migrants - through violence and intimidation - to jump off of a high-speed boat into the water. They threatened them with machetes, forcing their passengers to jump into the sea, knowing that there were strong currents active and that many of the migrants were not able to swim. A boat crew, which was in the area at the time, managed to save five migrants out of the 37 on board, all of whom were forced to jump into the water. Later on, national authorities recovered the bodies of five migrants, who were also travelling on this boat. The migrants had paid between EUR 3 000 and 12 000 for this risky journey between Kenitra and Cádiz.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed two analysts to Spain to support the national authorities with technical expertise, to cross-check operational information against Europol’s databases, and to provide leads to investigators in the field. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

A cross-border investigation led by the Romanian Border Police (Poliția de Frontieră), supported by Europol and involving the Bulgarian General Directorate Combating Organised Crime (Главна Дирекция Борба с организираната престъпност) and the German Police (Bundespolizeiinspektion Waidhaus), has resulted in the dismantling of an organised crime group involved in migrant smuggling. The group were smuggling migrants from Bulgaria to Romania, across the Danube river, and then toward Western Europe. Results from 12 March 202433 locations searched (18 Calafat, 11 Timișoara, 4 Argeș),42 arrests,Seizures including:7 cars,passports,weapons,electronic equipment,EUR 32 000, LEI 75 000 and GBP 7 500 in cash.Up to EUR 5 000 from the Danube river to GermanyThe investigative activities established that the criminal network, composed mainly of Bangladeshi, Iraqi and Romanian citizens, was formed in the beginning of 2023. The suspects recruited migrants from Middle-East who wanted to reach Western European countries, especially Germany.The criminal network smuggled the migrants in two phases. In the first phase, the suspects picked migrants up from Bulgaria and transported them in boats across the Danube river. The migrants would then be taken in groups of 20-30 via cargo transport to the western part of Romania, mainly the areas of Timișoara/Arad and Caraş Severin. The smugglers also used off-road vehicles, but mainly transported groups of 13-17 migrants in 5-seat vehicles. This particularly dangerous means of transportation resulted in the hospitalisation of migrants following a traffic accident in July 2023.Once in the western Romania, the second phase would take place. The suspects would place migrants in clandestine accommodation for several days, before transporting them hidden between goods in trucks across the Hungarian border to Western Europe, mainly Germany. The migrants paid between EUR 3 500 and 5 000 per person to be smuggled from the Danube river to their final destination. The investigation identified 20 transportations across Romania of a total of about 500 migrants.Cross-border cooperationEuropol supported the investigation within the framework of the operational plan signed with Romania in regards to the Ukrainian crisis. Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field. Europol also facilitated the deployment of investigators from Bulgaria and Germany to support the Romanian officers involved in the operational actions in the field.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

During the action day on 12 March, authorities also conducted 26 searches in Belgium, Israel, Netherlands and Slovakia, resulting in the seizure of: 165 luxury watches with certificates, jewellery and other counterfeit products;200 diamonds;EUR 209 000 in cash;Crypto ledgers;Weapons;14 kg of drugs;Multiple electronic devices, including phones and computers;Credit cards and financial documentation.Additional involvement in drug traffickingThe investigation started in 2022, when the police intercepted a package containing 600gr of cocaine in Brussels destined for Israel. Thanks to a subsequent investigation, it was revealed that a large criminal organisation which engaged in drug trafficking also counterfeited luxury items. According to law enforcement authorities, the criminal network manufactured fake luxury watches outside the EU by mixing original parts with fake components to mislead potential customers. Once the watches were produced, they would import them to Belgium and introduce counterfeit diamonds and watches into the market. Besides confusing buyers, this modus operandi also undermines the reputation of Antwerp’s “Diamond District” and calls into question the unique certification applied to these luxury items in which customers place their trust.The suspects also trafficked cocaine and synthetic drugs across the world. They also laundered money through complex schemes, including cryptocurrencies, illegal banking systems and reinvestments in real estate, notably in Portugal.Europol’s role in the investigationEuropol deployed specialists with expertise in cryptocurrencies and OSINT capabilities to Antwerp on the action day. The agency supported the investigation by fostering the exchange of information, organising operational meetings, and providing operational coordination and analytical support.The operation was supported by the @ON Network, funded by the EU Commission and led by the Italian Anti-mafia Investigation Directorate (DIA).Law enforcement authorities involved:Belgium: Antwerp Police Department (Politiezone Antwerpen), Belgian Federal Police (Federale Gerechtelijke Politie, DSU), General Administration of Customs and Excise (Algemene Administratie van de Douane en Accijnzen), Federal Economic Inspection (FOD Economie).Netherlands: Police Amsterdam (Politie Amsterdam), Investigators District East Amsterdam (District Oost Amsterdam), International Legal Assistant United Amsterdam (Internationaal Rechtshulp Centrum).Portugal: Judicial Police (Polícia Judiciária), Asset Recovery Office-ARO (Gabinete de Recuperação de Ativos-GRA).Slovakia: National Crime Agency of the Police Force Presidium (Národná kriminálna agentúra Prezídia Policajného zboru)Israel: National Unit for serious and International crimes (Yahbal), NCB Jerusalem (MATAM). 

The suspects were arrested in Madrid, Palma, Barcelona and Poland during an action day on 14 November 2023. Seven house searches were also carried out, with six in Palma and one in Barcelona, leading to the seizure of electronic devices, documentation, and EUR 15 000 in cash.The criminal network also profited from the sale of sexual invigorates, so that male customers would spend more time using their illicit services. The network channelled these profits through a catering company owned by the leader of the organisation.Lured through a messaging appThe victims were lured into being trafficked by compatriots via a messaging app. The criminals charged victims EUR 15 000 for travel to Europe, which would be paid by the trafficker who received them in Poland. On occasions, this same individual would further extort the victims by forcing them to pay an extra EUR 400 per month.From Poland, the victims would be transferred to Mallorca and promised a good job there. However, they were actually forced into prostitution in order to pay off the criminal network.According to Spanish law enforcement, the victims lived under a regime of slavery where they had to be available 24 hours, 7 days a week, and were under permanent surveillance by the criminal organisation. They could keep only half of the benefits acquired from their sexual services and could not reject any clients.Europol’s role in the investigationEuropol supported the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one expert to Palma to cross-check operational information in real time, support investigators on the ground, and perform forensic extractions of the mobile phones used by the suspects.The investigation benefited from funding from the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

Overall results of the two action days:The leader of the network (High Value Target), a woman from Bosnia and Herzegovina, was arrested in Bosnia and Herzegovina18 significant criminal organisation members arrested (9 in Bosnia and Herzegovina and 9 in Croatia)10 locations searched (in Bosnia and Herzegovina and Croatia)Seizures include vehicles, electronic equipment and about EUR 65 000 in cashShift in migration routes in the Western Balkans regionBack in 2023, the Bosnia and Herzegovina-Croatia border was the second most used crossing point for smugglers in Balkans. In 2024 criminals have further intensified their activities on the route Bosnia and Herzegovina – Croatia - Slovenia. Consequentially, this border section is now on the route, which is mostly used to smuggle migrants from the Balkans to Western Europe.The criminal network targeted by these action days used a very dangerous modus operandi. They transported the migrants between Bosnia and Herzegovina and Croatia, hiding them in concealed sections in modified wagon cars. The migrants were placed in hide out under car floors, which made the transportation extremely dangerous. During the investigation and before the action days, Croatian authorities arrested 28 suspected smugglers. Authorities have detected smuggling incidents connected to this network. During these interceptions, more than 360 migrants were found.The migrants were then led to cross the EU borders mainly on foot. After the migrants had crossed the border, the smugglers would then transport them further by car, van or in the back of a lorry. The investigation led to the identification of several networks operating in the region. The leaders of these networks are believed to reside in surrounding countries, but also in Germany and Türkiye.The leaders are suspected of coordinating different cells operating at local level to ensure temporary accommodation and then transferring migrants along the route to their final Western European destination. Operational intelligence suggests that approximately 40 networks are active in the region, which are attracting different individuals potentially playing various roles in the smuggling activities.Regional OTF at Europol to address the criminal networksThe Balkan region is a key transit area for secondary movements, where criminal networks proactively offer their services to irregular migrants. To provide a concerted response to this criminal phenomenon, in March 2023 Europol has set up a regional OTF involving Bosnia and Herzegovina, Croatia, Germany and Slovenia. The OTF focuses on tackling criminal networks involved in migrant smuggling along the main Western Balkan migration routes.Europol established a dedicated financial instrument to facilitate such high-profile investigations. Europol supported the overall coordination of the investigative activities, while also organising operational meetings of the members of the OTF. During the length of the investigations, Europol facilitated the exchange of information and provided analytical support to the national authorities involved. During the action days, Europol deployed experts to Bosnia and Herzegovina and Croatia to assist the national authorities to cross-check in real time operational information against Europol’s databases, perform digital forensics and support the investigators in the field with new leads.

Overall results of the four action days:11 arrests (3 Palestinians, 3 Latvians, 2 Iranians, 2 Syrians, 1 Lebanese),4 print shops dismantled,Seizures including:4 650 illegal documents,electronic equipment,10 high-end laser printers and other equipment/material for the production of false documents,over EUR 20 000 in cash.Up to EUR 1 200 for a false IDThe investigation identified that the criminal network was active since September 2023. The suspects used sophisticated equipment (laser printing devices, software and document scanners) to produce high-quality false travel and identification documents, which were especially difficult to detect as fraudulent. The costs of false documents ranged from EUR 400 to EUR 1 200, depending on its type and country of origin.The large number of seizures made during the action days shows the particularly intense activity of the network. The documents seized during the raids alone held an estimated market value of EUR 600 000. In addition to producing and disseminating false documents, the suspects also allegedly organised smugglings by air, for which they used their own forged documents and charged EUR 6 000 per person for the full criminal service including the flight tickets.The documents found during the raids were predominantly forgeries of EU documents (for example imitating Belgian, Dutch, Danish, Finish, Greek, German, Italian, Hungarian, Slovenian, Spanish, Swedish, Norwegian, as well as Colombian and Ukrainian documents). The forgers, who were running independent print shops, collaborated with each other on a case-by-case basis, mainly in the exchange of raw materials or in the preparation of specialised documents. The forgers avoided direct contact with customers, irregular migrants or members of other migrant smuggling networks, instead using intermediaries who were concluding the deals and delivering the false documents on their behalf.The outcome of this operation confirms migrant smugglers’ increasing use of fraudulent documents in order to facilitate illegal entry into the EU. The smugglers also provided false documents which would enable migrants to change their residence status within the EU. The operational information contributed to Europol indicates that document fraud is present in many migrant smuggling cases. Enhancing international cooperation and Europol’s support to national authorities will be crucial for increasing the effectiveness of investigations into the production and dissemination of false documents.Europol’s supportEuropol supported this investigation by facilitating information exchange, coordinating operational activities and providing tailored operational analytical support. During the action days, Europol deployed two experts to Greece to support the field activities by crosschecking the operational information collected in real-time. Europol also provided operational analysis to help deliver possible leads to investigators on the ground.

Officers learned how to carry out targeted investigations against perpetrators suspected of abusing their own children or at least possessing and distributing material depicting the sexual abuse of children. During the action, over 100 000 illegal files were seized. As the forensic examination of the seized digital devices is still ongoing, investigators estimate that a final total of more than one million images and videos will be found and confiscated.The training was held by expert investigators and focused on how various file-sharing networks can be used to search for perpetrators who possess and distribute material depicting the sexual abuse of children. Another aim was to find out whether perpetrators are in possession of text-based material such as paedophile manuals about grooming or the sexual abuse of children.Suspects from all walks of lifeThe men arrested in this action for downloading and disseminating child sexual abuse material using peer-to-peer (P2P) networks stem from all walks of life. Aged  between 23 and 72, on average the perpetrators are 49 years old. Four of the suspects are school teachers and one suspect works with disabled children, which renders this successful law enforcement effort even more meaningful.Europol classifies perpetrators who possess or distribute material depicting the sexual abuse of children, and simultaneously possess manuals about committing sexual abuse, as High Value Targets. They are assumed to be the most likely to physically abuse children. The 57 national investigations into the crimes committed by the arrested persons will also be a starting point for further law enforcement action, with more arrests and seizures to be expected across Europe. Europol facilitated the information exchange between all the countries involved, and further enhanced the operational picture by cross-checking the seized data and providing intelligence packages to continue the investigative work.Potential and actual victims safeguardedThe overall ultimate strategic goal of operations such as this one is to eliminate the risk of children being sexually abused. Every child counts, and for every child saved this means a world of difference. Some of the arrested suspects had direct access to children via their profession, while ten suspects have children of their own. At least one child was saved from ongoing physical abuse, the other children can be considered as safeguarded from potential abuse.Law enforcement awareness campaignsEuropean law enforcement, in collaboration with relevant partners via EMPACT, focuses on combatting the distribution and possession of abuse material on file sharing networks. Through the Police2Peer initiative, files appearing as child abuse material are made available to those seeking it, dispelling the illusion of ‘safety in numbers’ on peer-to-peer networks. These files, though they appear to contain illicit content, are clear warnings or feature police officers from partner countries, emphasising that users sharing abuse material are neither safe nor untraceable. Additionally, Europol's ‘Say No!’ prevention campaign, disseminated in over 30 countries, educates parents, children, and teachers on online risks and provides guidance on reporting and prevention measures.Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark (project leader), Estonia, Finland, France (action co-leader), Germany, Greece, Hungary, Italy, Latvia, Lithuania, Malta, Poland (action co-leader), Romania, Slovakia, Slovenia, Sweden, Iceland, North Macedonia, Norway, Switzerland, Ukraine

Who was involved?This year's exercise brought together law enforcement representatives involved in applying both the EU Crisis Protocol and Regulation (EU) 2021/784, online service providers, the Global Internet Forum to Counter Terrorism (GIFCT), as well as policymakers from governments and EU bodies.A rapid, coordinated response to terrorist content onlineThe EU Crisis Protocol, adopted by the Justice and Home Affairs Ministers in October 2019, is a voluntary mechanism that allows EU Member States and online platforms to respond rapidly and in a coordinated manner to the dissemination of terrorist content online in the event of a terrorist attack, while ensuring strong data protection and fundamental rights safeguards.The development of the Protocol came about in the aftermath of the terrorist attack in Christchurch, New Zealand in 2019, whereby leaders from governments, tech industry, civil society and the European Commission agreed on the ‘Christchurch Call for Action’. Since then, other crisis mechanisms have been developed both at a national level and by the tech sector.The practical implementation of the Protocol is tested annually through tabletop exercises. Following several tabletop exercises and the activation of the Protocol in 2020, the EUCP was revised in 2023 to integrate lessons learned. Main changes in the update include the clarification of the relationship between the voluntary EU Crisis Protocol and the Regulation (EU) 2021/784, in particular Art. 14(5), refined activation criteria, greater focus on interoperability with other crisis response mechanisms, stronger protection of fundamental freedoms, among other through debrief processes, and guidance on the response to bystander footage.Europol has undertaken a central role in the EU Crisis Protocol implementation by managing the coordination of information exchange and communication among relevant stakeholders in a rapid and secure manner.  Recent acts of terrorism in France (Arras, Paris), Belgium (Brussel) and the October 7 terrorist attack by Hamas against Israel have further demonstrated the importance of disrupting the dissemination of terrorist and violent extremist propaganda during, and in the aftermath of, terrorist attacks, while at the same time supporting investigations. Europol hosts targeted tabletop exercises in order to enhance cross-sector collaboration and further advance the EU Crisis Protocol processes.

The new report offers a strategic and top-level summary of the EU drug market, based on a robust understanding of the current drug landscape and emerging threats. It also provides an overview of key developments by drug and outlines actions to address current threats and increase preparedness.The report is the final module of the broader EU Drug Markets: In-depth analysis from the two agencies, their fourth comprehensive overview of illicit drug markets in the EU since 2013.A multifaceted drug market in a globalised worldThe EU retail drug market is estimated to be worth more than EUR 30 billion annually, making it a major source of income for organised crime. Europe occupies a central position in drug supply and trafficking, as evidenced by the large-scale production of cannabis and synthetic drugs within the EU and the huge volumes of cocaine arriving from Latin America.The EU drug market also intersects with other crime areas, such as the trafficking in firearms and money laundering. Some EU Member States are currently experiencing unprecedented levels of drug market-related violence, including killings, torture, kidnappings and intimidation. This often takes place between criminal networks, although innocent people are also victims, increasing the perception of public insecurity.Corruption is also a key threat in the EU, as criminal networks rely on it across all levels of the drug market to facilitate their activities and mitigate risks. Corruption has a corrosive effect on the fabric of society, undermining governance, security and the rule of law.An additional concern is the fact that criminal networks operating in the EU drug market are highly adaptable, innovative and resilient to global crises, instability and significant political and economic changes. Recent examples of such shocks include the COVID-19 pandemic, Russia’s war on Ukraine and the Taliban’s rise to power in Afghanistan. In response, criminal networks have adapted, changing trafficking routes and diversifying their methods.Tackling current threats and boosting resilienceThe new report highlights key areas for action at EU and Member State level to respond to the current threats of the illicit drug market. These include improving monitoring and analysis of drug market-related violence, further prioritising operational activities that dismantle criminal networks, boosting international cooperation, increasing the human and financial resources devoted to operational and strategic response and strengthening policy, public health and safety responses, among others.Ylva JohanssonCommissioner for Home AffairsDrugs damage our health and our society. Drugs cause addiction, overdose and death. And the organised criminal networks trafficking the drugs undermine society with corruption and violence. To counter this dual threat, the EMCDDA and Europol have joined forces in this new report to offer key insights on the EU drug market to inform policy and practice. One critical drug market threat today lies in the exploitation of key logistical infrastructure, particularly seaports. In response, the EU has launched the European Ports Alliance to protect ports from drug trafficking and criminal infiltration and strengthen their resilience. This is just one example of actions under the EU Roadmap to fight drug trafficking and organised crime.Catherine De BolleEuropol’s Executive DirectorCriminal networks infect the very core of our communities, weaving through the fabric of our democracy and economy. They erode trust, fuel violence, and create cycles of addiction and poverty. A vigilant, unified response is needed to safeguard our citizens and society from the omnipresent influence of this invisible enemy. Using Europol, EU Member States can pool resources, exchange criminal intelligence, and coordinate actions to tackle the illegal distribution of drugs.Alexis GoosdeelEMCDDA DirectorViolence and corruption, long witnessed in more traditional drug-producing countries, are now increasingly seen within the EU. Violence can occur at all levels of the market. It is both a by-product and facilitator of the drugs trade – a trade that is often secured through fear and force. Drug-related violence may be driven by organised crime, the personal struggles of users and wider socio-economic issues. We are now at a critical juncture. We need a holistic European approach to tackle this problem through strengthening our communities, building resilience and preventing the recruitment of young people into crime, providing them with long-lasting alternatives.

The EU retail drug market is estimated to be worth at least EUR 30 billion annually and is a major source of income for organised crime. The large-scale production of cannabis and synthetic drugs taking place in the EU or the drug flows of particularly cocaine arriving from Latin America, are examples of how Europe takes a central position in drug production and trafficking.The new Europol and EMCDDA report offers a strategic and top-level summary of the EU drug market, based on a robust understanding of the current drug landscape, organised crime and emerging threats. It is targeted at decision-makers, who develop and implement policies and actions in Europe, as well as at practitioners working in the drugs field and the general public. The report will be the last module of the broader EU Drug Markets: In-depth analysis from the two agencies, their fourth comprehensive overview of illicit drug markets in the EU since 2013.The press conference is open to press, policymakers and stakeholders. It will take place from 15:00-16:00 CET. (14:00-15:00 local time in Portugal). Press conference recording

The action day in mid-February led to the arrests of eight suspects in Belgium and Hungary. Officers in Belgium arrested four Belgian, one French and one Hungarian, while officers in Hungary arrested one Belgian and one Hungarian national. During the raids, authorities seized 16 high-end vehicles, luxury goods including jewellery and luxury watches, digital equipment, and mobile phones, as well as EUR 40 000 in cash. The raid in Belgium led to the identification of three potential victims. Similarly, during the operational activities in Hungary, officers identified and brought several other potential victims of this network to safety. Europol facilitated the exchange of information and provided support during the course of this investigation. Europol also provided operational analysis, operational intelligence and coordinated the operational activities. During the action day, Europol deployed two of its experts to Belgium and one to Hungary to provide analytical and technical support to the national authorities.The case was opened by Eurojust in February 2023 at the request of the Belgian authorities. A Joint Investigation Team was set up between the Belgian and Hungarian authorities with the support of Eurojust in May 2023. One coordination meeting was hosted by the Agency to facilitate judicial cooperation.

According to Spanish authorities, the criminal network fixed football, tennis and table tennis matches in more than 20 countries, including Romania, Bulgaria, Ukraine, Russia and Bolivia. The suspects sold their personal data and betting platform account details to the criminal network. With this information, the kingpins of the organisation would bet massively on predetermined results, defrauding betting houses and obtaining great economic benefits. The investigation unveiled that the criminal organisation had control of over more than 1 500 betting accounts and amassed winnings of an estimated value of EUR 2 million.In parallel, the criminals used sophisticated technology to manipulate livestreams by intercepting satellite signals and capturing feed content. This allowed them to access the live signal ahead of the betting houses and place massive winning bets. The criminal network had also created a complex system to launder the money acquired from gambling. The suspects are now charged with being members of a criminal organisation, defrauding gambling operators and money laundering.Europol deployed two experts in the field to provide on-the-spot assistance, and provided operational coordination and support to the investigation.The operation is the second phase of an investigation that started in 2020 and had already led to the arrest of 22 suspects, including both leaders of the criminal organisation. In total, it has now led to:75 suspects arrested (22 arrests in the first phase and 53 in the second phase);4 house searches;Seizures of EUR 13 000 in counterfeit banknotes, 2 large satellite dishes and signal receivers, 47 bank accounts, 80 telephone terminals, electronic devices, documentation, and cash, as well as parabolic antennas, signal receivers and IT equipment.

Over 180 searches were carried out simultaneously in Albania, Austria, Cyprus, Croatia, Czechia, Estonia, Germany, Hungary, Italy, Malta, the Netherlands, Poland, Portugal, Slovakia, Slovenia, Sweden and the United Kingdom.  Over 680 tax and police investigators supported the investigative measures. During the searches, law enforcement seized vast quantities of smartphones, worth more than EUR 15.3 million, as well as a yacht, worth EUR 3 million, and EUR 1.2 million in cash and cryptocurrency. Several cars were seized, including a Rolls Royce, a BMW and a Range Rover. Jewellery, luxury watches and 2.5 kilograms of gold were also found in the suspects’ residences.   The investigation revealed that the suspected organisers of the VAT fraud scheme created a complex criminal ecosystem, which allowed them to defraud up to EUR 195 million through several criminal schemes involving the sale of small electronic devices, such as smartphones.It is understood that the suspects used fraudulent chains of missing traders, which would vanish without fulfilling their tax obligations.In 2020, the same organisers of these VAT fraud schemes are believed to have entered the market for protective face masks. The company managed by the suspects is understood to have bought them from a missing trader, and channelled them through several buffer companies to disguise their final destination.On paper, their company was based in Hong Kong, but the face masks were actually in a warehouse in Germany, and remained there until the German Federal Ministry of Health purchased them from the company ostensibly based in Hong Kong. According to the investigation, neither the company at the beginning of the supply chain, nor the Hong Kong-based company, reimbursed the VAT they had received upon the sale of the face masks to the Ministry.The arrests are the result of years of special investigative measures carried out by a number of German Tax Investigation Offices in Berlin, Bielefeld, Cottbus, Münster and Nuremberg. This extensive undertaking also counted on the support of Europol and Eurojust. In Germany, these included Police Headquarters (Polizeipräsidium) from Nordhessen and Brandenburg, as well and State Criminal Police Offices (Landeskriminalamt) from Brandenburg and Berlin. Leading up to the action day, Europol provided analytical support to the partners in this investigation. Furthermore, Europol supported the action day by providing over 100 secure communication channels (VCP-Virtual Command Post), deploying a specialist with a mobile office to the operational command centre at EPPO’s headquarters in Luxembourg. The case was opened at Eurojust in 2021 at the request of the German European delegated prosecutor. Seven coordination meetings were hosted by the Agency to facilitate judicial cooperation between the EPPO and national authorities involved in the case. Eurojust facilitated the exchange of information and the execution of several European Investigation Orders and European Arrest Warrants.

A third main suspect, leading another organised crime group (OCG), was arrested in the same operation for defrauding the Italian authorities of EUR 15 million in public funds. These funds were laundered via the same web of myriad enterprises, centred around the financial institution in Lithuania.During an action day on 27 February, around 250 judicial representatives and law enforcement officers were active on the ground. In total 18 persons have been arrested, including the 3 main suspects. In total 55 locations were searched and over EUR 11.5 million in assets and bank accounts have been frozen. Eurojust and Europol played pivotal roles in facilitating and coordinating the international activities.The financial institution offered money laundering as a service to thousands of criminals across the EU by making fictitious financial transactions via the web of enterprises, which were run by strawmen. It advertised its alleged consultancy services online and was set up in Lithuania in 2016 by an Italian-based OCG.The financial institution was led by the two main suspects, who resided in Lithuania and Latvia. The OCG laundered the proceedings of a range of criminal activities, including tax evasion, cyber fraud, fake bankruptcy and organised crime such as drug trafficking. Part of the proceeds were injected into the Latvian and Lithuanian economies via the purchase of real estate and luxury vehicles.The laundered money included the EUR 15 million from unlawfully obtained so-called building bonuses, provided by the Italian national authorities. These bonuses were given for renovation and insulation works and other energy-saving measures of existing buildings. In reality no repairs took place, and the applicants were not the owners or the buildings did not even exist. The main perpetrator of this fraud was a practising tax consultant, who arranged the awarding of bonuses for 72 other individuals who were aware of the abuse.Investigations into the OCG were initiated in 2021 by the Public Prosecutor’s Offices of Naples and Lecce in Italy, involving their counterparts in Latvia and Lithuania in 2022 via Eurojust.In 2022, the financial and judicial authorities in Lithuania already closed down the electronic payment institution. Its banking licence was revoked and bankruptcy procedures were started for non-compliance with money laundering prevention regulations. A rapid reaction of Latvian and Lithuanian authorities to reports on suspicious transactions led to the identification and freezing of millions in funds, real estate properties and luxury vehicles, which now can be confiscated.During the same year, Eurojust supported the setting up and funding of a joint investigation team between all national authorities involved. Eurojust also set up a coordination centre to support the simultaneous actions in the three countries.Furthermore, Eurojust organised eight coordination meetings to prepare for the simultaneous actions of the Italian, Latvian and Lithuanian authorities. These preparations also prevented potential conflicts of jurisdiction. Eurojust has also already facilitated the restitution to Italy of over EUR 3 million of the illegally obtained public funds, which have been frozen by the Lithuanian authorities.Europol has been supporting the case since January 2022, working closely with the national investigators to uncover the magnitude and complexity of the activities carried out by the OCG. During the action day, two Europol experts were deployed to Latvia to support the authorities with their investigative measures. A third Europol specialist was deployed to the coordination centre at Eurojust, with an analyst on hand at Europol’s headquarters to handle the contributions shared via Europol’s secure communication channels.The operations against the OCG are the result of long-term intensive cooperation across Europe of the three countries involved.The Head of Europol’s European Financial and Economic Crime Centre at Europol, Mr Burkhard Mühl, commented: Europol firmly believes that the 'follow the money' approach, coupled with close cooperation between EU law enforcement agencies and Europol, constitutes the most powerful strategy for combatting transnational criminal threats and frauds related to public funds. By pooling resources, expertise, and intelligence, we can effectively disrupt illicit financial flows and dismantle criminal networks.The actions in the three countries were carried out at the request of and by the following authorities:Italy: Public Prosecutor’s Offices of Naples and Lecce; Guardia di Finanza of Naples and LecceLatvia: Prosecutor General’s Office, Rīga Judicial Region Prosecution Office; 1st Unit of the Economic Crime Enforcement Department of the Central Criminal Police Department of the State PoliceLithuania: Vilnius Regional Public Prosecutor’s Office; Vilnius County Police Headquarters

Their Majesties the King and Queen of the Belgians have visited Europol today in The Hague, the Netherlands, where they heard about the Agency’s work in helping EU Member States fight serious and organised crime across Europe.Europol’s Executive Director Catherine De Bolle welcomed their Majesties, who were accompanied by the Belgian Minister of the Interior Annelies Verlinden.Their Majesties and the delegation toured Europol’s Operational Centre, which provides round-the-clock support to over 2 600 law enforcement authorities connected to Europol’s secure channels.Their Majesties were briefed on Europol’s latest investigations into Europe’s most threatening criminal networks. In 2023, Europol supported 3 155 investigations into high-level organised crime and produced over 23 000 operational reports.The King and Queen of the Belgians also heard about the challenges associated with investigating child sexual abuse online. Europol emphasised that sustainable solutions must be found to facilitate the flow of information to prevent this heinous crime. Their Majesties visited Europol’s forensic cybercrime laboratory.Finally, the King and Queen of the Belgians met with the Belgian community at Europol. Some fifty Belgian nationals are currently working across the organisation. Belgium is holding the Presidency of the Council of the European Union until 30 June 2024. The Belgian Presidency has put forward different priorities that are of direct importance to the work of Europol. Tackling large-scale organised crime networks is one such priority. 

The action day on 21 February led to:19 arrests in Germany (7 under Belgian judicial order and 12 under French judicial order)5 High Value Targets (the leader and the main organisers) arrested28 locations (19 houses and 9 storage places) searched in GermanySeizures include: 24 inflatable boats, 175 life vests, 81 flotation devices for children, 60 air pumps, 13 outboard mounts, 14 engines, almost 60 electronic devices, arms and several thousand euros in cashThe investigative activities, initiated at the end of 2022, identified the structure and modi operandi of this large criminal network, made up of Iraqi and Syrian nationals of Kurdish origin. The suspects, all based in Germany, organised the purchase, storage and transportation of inflatable boats for their subsequent use to smuggle migrants from the beaches near the French city of Calais towards the UK. The migrant smuggling network was highly professional. The suspects had set up their own logistical infrastructure with specific branches in charge of organising the delivery of large amounts of nautical equipment to the EU.Drivers, who were typically active members of the criminal network, transported up to 8 boats at a time. During the transportation from Germany to France, a forerunner car secured the vehicle charged with boats, aiming to avoid police detection. The drivers were located in rest areas in Belgium before they drove the equipment to the spot at the time of departure. The investigative activities identified that the criminal network was able to facilitate up to 8 departures per night depending on the weather conditions.Between EUR 1 000 and EUR 3 000 for a spot in a boatThe smugglers used low quality boats, mainly originating from China, transported via Turkey to Germany. The legal purpose of these boats may include fishing or sailing on rivers and city canals. When used legally, such boats would not be suitable nor safe for the transportation of more than 10 individuals. However, on average, smugglers put around 50 migrants in one of these boats. In total, the investigators have gathered evidence linking at least 55 departures that were facilitated solely by this smuggling network. The suspects collected between EUR 1 000 and EUR 3 000 per migrant for a place on the dangerous vessel. Further investigative activities are ongoing into the individuals managing the financial and money laundering activities for the criminal network.Migrant smuggling; a continuously deadly threatThe migrant smuggling activities via small boats have continuously increased since 2019, before becoming in 2021 the most commonly used modus operandi for smuggling migrants from the EU to UK, surpassing smuggling in lorries. The criminal networks involved in the phenomenon remain extremely active, and are becoming increasingly violent while adapting their activities through the implementation of new crossing techniques. In parallel, the strengthened law enforcement measures led to a significant decrease of over 30% fewer incidents and migrants smuggled in the 2023 in comparison to 2022. In 2023, law enforcement authorities detected almost 61 000 (as compared to about 79 000 in 2022) irregular migrants attempting to cross the English Channel in small boats. However, during the same year, 30,000 irregular migrants (compared to over 47 000 in 2022) and 600 boats (compared to 1 100 in 2022) managed to reach the UK. Dedicated Task Force at Europol to connect the dotsFollowing the successful outcome of the Operational Task Force Dune in July 2022, which led to the dismantling of the largest (at the time) network smuggling migrants from France to the UK via small boats, Europol set up a second Operational Task Force. OTF Wave targets migrant smuggling activities across the English Channel, a criminal phenomenon putting migrants’ lives at great risk. OTF Wave, coordinated by Europol, involves Belgium, France, Germany, the Netherlands and the UK. OTF Wave targets the full chain of smuggling activities – from the recruitment of migrants through to the logistical cells and up to the main organisers. The investigative activities focused on five High Value Targets, as the prosecution of these suspects is instrumental in dismantling the criminal organisation as a whole. The dedicated Europol experts, who were fully involved in the work of the OTF, contributed to the identification of criminal connections between several national investigations.The work of the national authorities’ members of OTF Wave was also enabled by the dedicated investigation cell (URO/CIC), set up by France and the UK, to specifically target migrant smuggling via small boats. Europol has a permanent deployment attached to this cell since its creation, in the aftermath of the tragedy unfolding in the English Channel in November 2021.Europol has established a dedicated financial instrument to facilitate such high-profile investigations. Under OTF Wave, Europol made over EUR 120 000 available to the participating countries to manage various aspects of their investigative work. Europol managed the overall coordination of investigative activities, while also organising over 10 operational meetings between the members of the taskforce.During the action day, Europol facilitated the deployment of 10 investigators from Belgium and 33 from France to several locations in Germany. In addition to these coordination activities, Europol deployed two Europol experts to the coordination centre in Cologne to assist the German authorities in cross-checking, in real time, operational information against Europol’s databases. The experts also performed digital forensics and supported the investigators in the field.Active judicial cooperation by Eurojust to ensure compliance of legal procedureEurojust enabled the cross-border judicial cooperation. Three coordination meetings were organised to compile and exchange the existing information, to explore how to best cooperate without jeopardising each other's investigations and to prepare for the joint action day. With the support of Eurojust National Desks, judicial authorities exchanged European Investigation Orders and European Arrest Warrants, and they carefully ensured that all legal instruments were in place to take action.During the action day, the agency set up a coordination centre to facilitate the rapid cooperation between the judicial authorities. At the coordination centre, each participating country was represented by a member of its National Desk. Coordination centres provide a central hub for the real-time exchange of information during an operation, including the results of searches and interceptions. They also facilitate the quick resolution of any complex legal issues that may arise during the action.Law enforcement authorities involved in the action day:Belgium: Federal judicial Police of West-FlandersFrance: French Border Police (OLTIM-Antenne de Coquelles)Germany: German Federal Police (Bundespolizei)Judicial authorities involved in the action day:Belgium: Investigative Judge of West-Flanders, section Bruges; Federal Prosecutors’ OfficeFrance: JIRS Lille (Interregional Specialised Jurisdiction) - Court of LilleGermany: General Public Prosecutor`s Offices Düsseldorf, Hamm, Köln, Naumburg; Public Prosecutor`s Office Bonn.For media inquiries:Europol: 24/7 media line: +31 (0)70 302 5001; press@europol.europa.euEurojust:Eurojust Press Team, + 31 70 412 55 00media@eurojust.europa.euBelgium: Federal PPO, Eric Van der Sypt, federal magistrate+32 485 53 25 20 ; FPF.press@just.fgov.beFrance: Court of Lille (Tribunal Judicaire de Lille)+33 6 18 17 81 58 ; presse.pr.tj-lille@justice.frGermany:Jens Floeren, +49 (0) 173 5425845  +49 (0) 2241 / 238 – 5555; bpold.sanktaugustin.oea@polizei.bund.

A large-scale operation involving law enforcement and judicial authorities from Belgium, France and Germany and coordinated by Europol and Eurojust, has led to the dismantling of one of the most active networks involved in the smuggling of migrants across the English Channel in small boats. The investigation focused on an Iraqi-Kurdish network suspected of smuggling middle-Eastern and East African irregular migrants from France to the UK with the use of low quality inflatable boats. German authorities raided houses and storage spaces. This resulted in the arrest of more than 15 individuals under Belgian and French judicial orders following a year and a half long joint investigation under Europol’s OTF Wave. The full press release about the case will be published on 22 February.Involved law enforcement authorities:Belgium: Federal judicial Police of West-Flanders France: French Border Police (OLTIM-Antenne de Coquelles)Germany: German Federal Police (Bundespolizei) Involved judicial authorities:Belgium: Investigative Judge of West-Flanders, section Bruges; Federal Prosecutors’ Office France: JIRS Lille (Interregional Specialised Jurisdiction), Court of LilleGermany: General Public Prosecutor`s Offices Düsseldorf, Hamm, Köln, Naumburg; Public Prosecutor`s Office Bonn.

Three individuals, suspected of being the ringleaders of the fraud scheme, were arrested in Germany. During the searches, carried out in several locations across Germany (including Munich, Cologne and Rostock) and Italy, over 40 expensive vehicles and a luxury apartment in Munich were seized. In addition, several bank accounts, valuing over EUR 1.2 million were frozen. Law enforcement seized cash in several currencies, as well as luxury watches, jewellery and several luxury bags found in the suspects’ residences. Officers on the scene found a robot used to print signatures in invoices and discovered a weapon. The suspects are believed to have used German companies to fraudulently export cars – both used and new – from Germany to other EU Member States. To that end, they allegedly relied on an intra-community VAT ‘carousel’ fraud. This complex criminal scheme takes advantage of EU rules on cross-border transactions between Member States, as these are exempt from value-added tax (VAT). VAT fraud, or Missing Trader Intra-Community (MTIC) fraud, is a highly profitable crime that results in billions of euros in annual tax losses for Member States.According to the evidence, the suspects purchased vehicles on a large scale from various German car dealers, and then used a network of shell companies and forged invoices to simulate that the cars were being sold in other Member States so as to evade the payment of VAT. There are reasonable grounds to believe that the vehicles were delivered to missing trader companies, often located in Italy. According to the investigation, more than 200 of the companies that appeared on invoices as buyers of the vehicles are in fact missing traders who do not fulfil their tax obligations in their country. In some instances, it is also suspected that the vehicles were being kept in Germany.The investigation counted on the support of Europol, Germany’s Tax Investigation Offices in Munich (Finanzamt München – Steuerfahndungsstelle) and Hagen (Finanzamt für Steuerstrafsachen und Steuerfahndung Hagen), the Police of Hagen and the Italian Financial Police (Guardia di Finanza) in Prato, Tuscany. The searches, carried out simultaneously in Germany and Italy, were conducted by hundreds of officers from the Tax Investigation Offices in Germany, the Bavarian and North Rhine-Westphalian police forces, including a special police command (SEK) and the Italian Financial Police. Leading up to the action day, Europol provided analytical support to the partners in this investigation. Furthermore, Europol supported the action day by providing over 80 secure communication channels (VCP-Virtual Command Post), deploying four Universal Forensics Extraction Devices (UFEDs) to the action sites, and deploying a specialist with a mobile office to the operational command centre in Germany.

During the action day, over 460 police officers were deployed to carry out the searches. Germany also deployed four officers to support the investigations and searches in Latvia and Malta. In addition to the arrests, various bank accounts and properties were seized.The Maltese financial institution laundered at least EUR 4.5 million in proceedings from criminal activities since end of 2015. The total sum of laundered money could amount to tens of millions of euros. The financial institution and organised crime group (OCG) behind it offered money-laundering services via a network of fake enterprises and individuals who were registered directors, without performing any real business activities. The OCG operated mainly from Riga and Berlin. Investigations were initiated in 2021 by the Latvian authorities after they noticed unusual money transfers from Latvia to the Maltese financial institution. Simultaneously, the German authorities had started investigations into suspicious money flows involving the same financial institution.On the action day, Europol deployed a money laundering expert to Latvia and set up a mobile office at Eurojust’s coordination centre to support the operation. Since December 2021, Europol has been supporting the investigation by providing operational and financial analysis and operational expertise. The agency also supported the joint investigation team and provided financial support to the case. Eurojust supported yesterday’s concerted action by setting up a coordination centre and establishing and funding a joint investigation team between the German and Latvian authorities. The agency also organised five dedicated coordination meetings to prepare for the action day and assisted with the execution of European Investigation Orders in the countries involved. The operations were carried out by the following authorities:Estonia: Office of the Prosecutor General of the Republic of Estonia, Estonian Police and Border Guard BoardFrance: Public Prosecutor’s Office and Investigative Judge – Judicial Court of Nice; National Police (DIPN) Alpes-Maritimes Division (Judicial Police Nice; Research and Intervention Brigade; Financial Brigade) - Border PoliceGermany: Public Prosecutor‘s Office Berlin (Staatsanwaltschaft Berlin), State Office of Criminal Investigations Berlin (Landeskriminalamt Berlin)Italy: Public Prosecutor’s Office Rome, Guardia di Finanza, Financial Police Unit Rome (Nucleo Polizia Economica e Finanziaria di Roma)Latvia: Rīga Northern Prosecution Office, Rīga Judicial Region Prosecution Office, 1st Unit of the Economic Crime Enforcement Department of the Central Criminal Police Department of the State PoliceMalta: Malta Police Financial Crimes Investigations Department, Asset Recovery Bureau 

LockBit is widely recognised as the world’s most prolific and harmful ransomware, causing billions of euros worth of damage.This international sweep follows a complex investigation led by the UK's National Crime Agency in the framework of an international taskforce known as ‘Operation Cronos’, coordinated at European level by Europol and Eurojust.The months-long operation has resulted in the compromise of LockBit’s primary platform and other critical infrastructure that enabled their criminal enterprise. This includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States and the United Kingdom.In addition, two LockBit actors have been arrested in Poland and Ukraine at the request of the French judicial authorities. Three international arrest warrants and five indictments have also been issued by the French and U.S. judicial authorities.Authorities have frozen more than 200 cryptocurrency accounts linked to the criminal organisation, underscoring the commitment to disrupt the economic incentives driving ransomware attacks.The UK's National Crime Agency has now taken control of the technical infrastructure that allows all elements of the LockBit service to operate, as well as their leak site on the dark web, on which they previously hosted the data stolen from victims in ransomware attacks.At present, a vast amount of data gathered throughout the investigation is now in the possession of law enforcement. This data will be used to support ongoing international operational activities focused on targeting the leaders of this group, as well as developers, affiliates, infrastructure and criminal assets linked to these criminal activities. The world’s most harmful ransomware LockBit first emerged at the end of 2019, first calling itself ‘ABCD’ ransomware. Since then, it has grown rapidly and  in 2022 it became the most deployed ransomware variant across the world.The group is a ‘ransomware-as-a-service’ operation, meaning that a core team creates its malware and runs its website, while licensing out its code to affiliates who launch attacks.LockBit’s attack presence is seen globally, with hundreds of affiliates recruited to conduct ransomware operations using LockBit tools and infrastructure. Ransom payments were divided between the LockBit core team and the affiliates, who received on average three-quarters of the ransom payments collected.The ransomware group is also infamous for experimenting with new methods for pressuring their victims into paying ransoms. Triple extortion is one such method which includes the traditional methods of encrypting the victim's data and threatening to leak it, but also incorporates Distributed Denial-of-Service (DDoS) attacks as an additional layer of pressure.The gang's move to triple extortion was partly influenced by a DDoS attack they themselves experienced, which impeded their ability to publish stolen data. In response, LockBit enhanced their infrastructure to resist such attacks.This infrastructure is now under law enforcement control, and more than 14 000 rogue accounts responsible for exfiltration or infrastructure have been identified and referred for removal by law enforcement.Europol’s coordinating role With countries involved on either side of the world, Europol – which hosts the world’s biggest network of liaison officers from EU Member States – played a central role in coordinating the international activity.Europol’s European Cybercrime Centre (EC3) organised 27 operational meetings, and four technical one-week sprints to develop the investigative leads in preparation of the final phase of the investigation.Europol also provided analytical, crypto-tracing and forensic support to the investigation, and facilitated the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at its headquarters. In addition, three Europol experts were deployed to the command post in London during the action phase.In total, over 1 000 operational messages have been exchanged on this case via Europol’s secure information channel SIENA, making it one of EC3’s most active investigations.The case was opened at Eurojust in April 2022 at the request of the French authorities. Five coordination meetings were hosted by the Agency to facilitate judicial cooperation and to prepare for the joint action.Decryption tools available on No More Ransom With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit Ransomware.These solutions have been made available for free on the ‘No More Ransom’ portal, available in 37 languages. So far, more than 6 million victims across the globe have benefitted from No More Ransom which contains over 120 solutions capable of decrypting more than 150 different types of ransomware.  Report it to the policeThis investigation shows that law enforcement has the capabilities to disrupt high harm cybercriminals and reduce the ransomware threat. However, continued victim and private sector engagement is key to us continuing this work.The first step to putting cybercriminals behind bars is to report cybercrime when it happens. The earlier people report, the quicker law enforcement is able to assess new methodologies and limit the damage they can cause.Reporting cybercrime can be as simple as clicking a button on a web browser. Europol has compiled a list of the reporting websites in EU Member States.Robust cybersecurity measures are also key. Europol has put together some tips and advice on how to prevent ransomware from infecting your electronic devices. Taskforce Operation CronosThis activity forms part of an ongoing, concerted campaign by the international Operation Cronos taskforce to target and disrupt LockBit ransomware. The following authorities are part of this taskforce: France: National Gendarmerie (Gendarmerie Nationale – Unité nationale cyber C3N)Germany: State Bureau of Criminal Investigation Schleswig-Holstein(LKA Schleswig-Holstein), Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Team Cybercrime Zeeland-West-Brabant, Team Cybercrime Oost-Brabant, Team High Tech Crime) & Public Prosecutor’s Office Zeeland-West-BrabantSweden: Swedish Police AuthorityAustralia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Japan: National Police Agency (警察庁)United Kingdom: National Crime Agency (NCA), South West Regional Organised Crime Unit (South West ROCU)United States: U.S. Department of Justice (DOJ), Federal Bureau of Investigation (FBI) NewarkSwitzerland: Swiss Federal Office of Police (fedpol), Public Prosecutor's Office of the canton of Zurich, Zurich Cantonal PoliceThe successful action was made possible thanks to the support of the following countries:Finland: National Police (Poliisi)Poland: Central Cybercrime Bureau Cracow (Centralne Biuro Zwalczania Cyberprzestępczości - Zarząd w Krakowie)New Zealand: New Zealand Police (Nga Pirihimana O Aotearoa)Ukraine: Prosecutor General`s office of Ukraine (Офіс Генерального прокурора України), Cybersecurity Department of the Security Service of Ukraine (Служба безпеки України), National Police of  Ukraine (Національна поліція України)

On 6 February, a Spanish-led investigation involving Ecuador and supported by Europol, resulted in a major hit on a high-risk drug trafficking network supplying cocaine to the EU. To support the field activities on the action day, Europol deployed two experts to coordination centres set up in Marbella, Spain and Quito, Ecuador. Europol also funded the deployment of two Spanish investigators to Ecuador to enable further coordination between the national authorities on the ground in Ecuador and Spain.The joint action day in Spain and Ecuador led to:31 arrests (13 in Spain and 18 in Ecuador);2 High Value Targets arrested;66 location searches (22 in Spain and 40 in Ecuador);Seizures included: 25 vehicles, 10 firearms, electronic equipment estimated at about EUR 13 million and almost EUR 3 million cash in various currencies, including euros;Property frozen for a total value of about EUR 48 million (EUR 12 million in Spain and EUR 36 in Ecuador).Tonnes of cocaine shipped under fruit coverLaw enforcement authorities initiated an investigation into an Italian businessman of Argentinian origin residing in Marbella. Further investigations revealed that these companies were used to conceal both criminal activities and financial transactions. Authorities identified the businessman's criminal association with an Albanian national based in Ecuador. The Albanian national orchestrated the importation of cocaine from Colombia to Ecuador and its subsequent distribution to the EU. Operational information indicates that the businessman had a contractual agreement with Colombian suppliers to receive 4 tonnes of cocaine monthly in Ecuador.The organisation employed Ecuadorian fruit companies as a front to import cocaine into the EU, utilising various shipping methods. Frequently, smaller quantities of cocaine were concealed within banana shipments, ranging from 15 to 40kg. Despite the varying quantities, the company consistently denied any involvement in the trafficking activities. The organisation arranged the transportation of the large cocaine shipments from the port of Guayaquil towards the port of Algeciras and other European ports.During the course of the investigation, law enforcement authorities in Albania, Belgium, Ecuador, Netherlands and Turkey seized several sizable shipments of cocaine totalling 3.2 tonnes. The leader of the criminal network played a pivotal role in laundering the criminal assets through investing in legal businesses in Spain. He managed several companies, including one focused on the production and importation of bananas from Ecuador to the EU, as well as sports centres in Marbella, commercial centres in Granada, and multiple bars and restaurants. Many of his main associates had strong ties to the Western Balkans and handled the distribution network, which was widespread across Europe.The operation targeted the two leaders (High Value Targets) of this criminal network. Both leaders had been orchestrating the drug trafficking and laundering the substantial criminal proceeds into the legal economy through the purchase of property, luxury vehicles and goods. So far, investigators have connected the targets to financial transactions totalling EUR 48 million across Ecuador and Spain.Europol facilitated the exchange of information and provided support during the course of this joint investigation. Europol also provided operational analysis, operational intelligence and coordinated operational activities. Europol’s Executive Director Catherine De Bolle said:Cocaine trafficking is a threat, not only to the health of Europeans and our economy, but also to the security of our neighbourhoods, as gang violence is becoming increasingly visible in our communities. This joint action day is a textbook example of how an international coalition of law enforcement agencies, coordinated by Europol, can successfully disrupt global and organised criminal activities. In October, I signed a Working Arrangement with Ecuador to increase our information exchange, especially in the area of cocaine trafficking. Today’s joint operation between Ecuador and Spain, supported by Europol, is a firm statement of our shared determination to take down the drug cartels from their local operating cells to their core.     Europol initiated this cooperation with Ecuador, one of the main transit hubs for cocaine shipments to the EU. The common efforts to combat these large-scale criminal activities resulted in the signature of a Working Arrangement between Europol and Ecuador in October 2023. This new framework enhances the cooperation between law enforcement authorities from EU Member States and their Ecuadorian counterparts in the joint fight against multinational drug cartels. Funding through EU financial mechanismsOfficers from the Spanish National Police and Spanish Customs, supported by Europol, carried out these joint operations in partnership with Ecuador in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem. To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combating criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.  High-value fugitive arrested | Update 23 June 2025A high-value fugitive, on the run since the action day in February 2024, was arrested in Abu Dhabi in May of this year. He is believed to be the leader of the criminal organisation.His arrest was made possible through close cooperation between the Spanish National Police and the authorities of Ecuador and the United Arab Emirates, with support from Europol and INTERPOL.The fugitive is suspected of personally coordinating the group’s drug trafficking operations — maintaining direct contact with Colombian cocaine suppliers and overseeing the transport and safekeeping of the illicit goods from Colombia to Ecuador. There, his associates, who held influence at the port of Guayaquil, loaded the drugs into containers operated by fruit-exporting companies under his control.Once the drug-laden containers reached European ports, the fugitive allegedly resumed command, instructing trusted contacts to extract the cocaine, store it, and arrange its onward distribution to final buyers.Spanish judicial authorities have now requested his extradition so that he can face proceedings in Spain.

Europol supported this wide-reaching operation with several operational meetings and the deployment of specialists with mobile offices offering analytical and forensic support. Operation SHIELD’s 2023 edition was led by a steering group composed of Italian, French, Greek and Spanish law enforcement authorities.  The trafficking of pharmaceuticals is a growing issue in the European Union and beyond. The investigations under SHIELD IV have highlighted a pattern of large scale trafficking which is highly lucrative for organised crime, which in turn incentivises more criminal groups to enter the trade. This crime area inflicts significant costs for the health and social care systems of EU Member States, as well as alarming effects on public health.Illegal vendors continue to advertise doping substances on social media, mostly targeting non-professional athletes and members of restricted or private sport groups. Along with performance-enhancing products, medicines for erectile dysfunction are offered via dubious channels online and remain among the most seized counterfeits by law enforcement. Unregulated use of medicines and doping substances, especially of counterfeit products, can cause serious and irreversible bodily harm.Results of Operation SHIELD IV1 284 individuals charged (296 arrests and 988 under prosecution) 52 organised crime groups investigatedTotal seizures worth above EUR 64 million, including: 636 263 illegal packages of illegal pharmaceuticals69 255 kilograms of powders and raw material11 551 litres of active ingredient121 503 vials and ampoules over 12 million tablets and pills 4 underground labs dismantled92 websites shut down3 935 inspections carried out4 321 anti-doping “in competition” controls carried out3 659 anti-doping “out competition” controls carried outHighlights of Operation SHIELD IVTrafficking of unauthorised pharmaceuticals and medical devices targeted in GreeceGreek authorities dismantled a criminal network which had been trafficking unauthorised pharmaceuticals and medical devices since 2019. The products included counterfeit botox and vitamin acid preparations used in cosmetic surgery. The criminals’ customer base of these counterfeits covered various regions of the country. The seized products were imported via couriers or transported by a member of the group from Turkey and Poland.San Marino underground lab uncovered by Italian authoritiesThe Italian authorities searched the logistical base of a criminal group operating from San Marino. Investigators identified a rural underground lab set up for the production, labelling and packaging of doping products. Police seized vast quantities of doping substances in the form of vials, tablets, capsules, bottles and packaging, all intended for sale in Italy as well as around EUR 180 000 in cash. The suspect allegedly imported pure Nandronole, an anabolic steroid classified as a narcotic drug in Italy. His trafficking routes spanned all over Europe and as far as China.Misuses of medicinesThe consumption of medications beyond medical oversight remains a persistent social issue. The reasons for use vary from psychotropic and recreational purposes to performance-enhancing effects. Some users disregard medical prescriptions and inject non-injectable products (such as sublingual pills, patch contents, or eye drops) or resell medicines prescribed for medical treatment.The excessive consumption of medications nurtures a demand that cannot be satisfied through legal means, leads to diversion from the regulated supply chain. Counterfeit medicines are circulated among those diverted from the legitimate chain. Authorities have seen these counterfeit medications re-enter the legal supply chain through the parallel market. One increasing trend is the traffic of sedatives and the use of counterfeit or illegal medicines for diabetes.Medicines are often counterfeited in underground laboratories without any regulation or safety measures in place. Counterfeit products created under such circumstances do not produce the desired effect; in the best case scenario the patient remains untreated, however such products can cause serious health issues or be potentially lethal.Operation SHIELD IV Steering Group:Italian Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri) French Law Enforcement Directorate for Environment and Public Health (Commandement pour l'Environnement et la Santé - CESAN) Hellenic Police - Financial Police Division (oικονομική υπηρεσία της ελληνικής αστυνομίας) Spanish Civil Guard (Guardia Civil) Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, France, Germany, Greece, Hungary, Ireland, Italy, Lithuania, Poland, Portugal, Romania, Slovak Republic, Slovenia, Spain, Albania, Bosnia Herzegovina, Colombia, Georgia, Iceland, North Macedonia, Norway, Serbia, Switzerland, United Kingdom, United StatesParticipating agencies:EUIPO, Eurojust, Europol, Frontex, INTERPOL, OLAF, WADA

On 7 February, two suspects were arrested in Malta and Nigeria in the framework of the operation. The suspects are accused of selling the malware and supporting cybercriminals who used the malware for malicious purposes. Europol provided analytical support to the investigation which led to the operation involving Australia, Canada, Croatia, Finland, Germany, Malta, the Netherlands, Nigeria, Romania and the United States. These countries provided valuable assistance securing the servers hosting the Warzone RAT infrastructure. The Warzone RAT malware, a sophisticated Remote Access Trojan (RAT), was on sale via internet domains. The RAT malware enabled cybercriminals to browse victims’ file systems, take screenshots, record keystrokes, steal victims’ usernames and passwords, and watch victims through their web cameras, all without the victims’ knowledge or permission.Avoid RAT-ingThe public and businesses can follow simple steps to help protect themselves from malware:Update your software, including anti-virus software;Install a good firewall;Don’t open suspicious email attachments or URLs – even if they come from people on your contact list;Create strong passwords.Find out how to protect yourself against Remote Access Trojans.

The Carabinieri Anti-Money Counterfeiting Command of Rome initiated the investigation into this criminal network in September 2020. This uncovered that the suspected members had allegedly facilitated illegal immigration through the production and dissemination of fake driving licences, registration documents, and national identification documents. The criminal network is also suspected of forging and trafficking foreign currency banknotes.Faking EU IDs and Congolese francsThe criminal group was particularly active in Italy and Malta, where they disseminated large quantities of blank false passports to irregular migrants from sub-Saharan and Middle Eastern countries. The forged documents, which were of particularly high quality, enabled the migrants to board flights from Malta and Italy towards a number of destinations in Western Europe. Authorities seized many of these forged documents in Belgium, Switzerland, France and Italy.The investigation also uncovered that the criminal group was involved in a number of other criminal activities, including the concealment of stolen vehicles and the production of large quantities of counterfeit 20 000 Congolese franc notes. It is estimated that counterfeit banknotes with a total value of 54 million Congolese francs (about EUR 18 000) were produced with the intention of being introduced into the in the financial system of the Democratic Republic of the Congo.Europol’s supportEuropol supported this investigation by facilitating information exchange, coordinating operational activities and providing tailored operational analytical support. During the action day, Europol deployed two experts to Italy – one specialist in migrant smuggling and one in currency counterfeiting – to support the field activities by crosschecking the operational information collected in real-time. Europol also provided operational analysis to help deliver possible leads to investigators on the ground. 

Initial investigations against the OCG were launched in 2019 by the Public Prosecutor’s Office (PPO) of Florence – District Antimafia Directorate. From January 2020, the Italian and Albanian authorities of the Special Anti-Corruption Structure (SPAK) in Tirana contacted Eurojust to coordinate cross-border judicial cooperation against this complex network. It operated from both Albania and Italy, transporting drugs by car to Spain and Germany, while other suspects were based in the Netherlands and the United Kingdom. Judicial cooperation with Albania is facilitated by Eurojust, as it is one of the 11 countries outside the EU that has a Liaison Prosecutor at the Agency. At request of the Italian and Albanian authorities, Eurojust supported the creation of dedicated joint investigation teams between the PPO of Florence and SPAK and provided financial, logistic and operational support.The Agency organised coordination meetings to prepare for today’s major action. It also set up a coordination centre to enable judicial cooperation with all national authorities involved during the action day. Europol has been supporting the case since 2020. Its experts provided extensive analytical support and expertise on Albanian organised crime, enabling the identification of key targets and the mapping of their criminal activities across Europe. Two Europol officers were deployed on the ground in Albania and Italy during the action day to support the national authorities in their investigative measures. The operation was carried out on the ground at the request of and with support from the following authorities:Italy: Public Prosecutor’s Office of Florence; Carabinieri Corps with the support of the Italian Ministry of Internal Affairs – International Police Cooperation Service (SCIP) Albania: National Public Prosecutor’s Office – Special Anti-Corruption Structure (SPAK); Albanian State Police, General Directorate Germany: Public Prosecutor General's Office in Naumburg; Public Prosecutor’s Office in Dessau-Roßlau; State Criminal Office MagdeburgSpain: Antidrug Public Prosecutor’s Office at Audiencia Nacional; Central Court num.4 at Audiencia Nacional in collaboration with Investigative Court num.2 of Barcelona; FAST Spain of Policia NacionalUnited Kingdom: The National Extradition Unit (NEU) of the Joint International Crime Centre’s (JICC)

Following the initial disclosure of two vulnerabilities at the beginning of January, two additional vulnerabilities were disclosed on 31 January 2024, which impact all supported versions of Ivanti Connect Secure and Ivanti Policy Secure Gateway products and make it possible for attackers to run commands on the system. Broader exploitation of the initially disclosed vulnerabilities had been observed already as early as mid-January. As this is a developing situation, we strongly recommend all organisations to regularly check the guidance provided by the CSIRTs Network members and CERT-EU for the latest assessment and advice. For detailed instructions on how to complete the advised factory reset, organisations may also follow the detailed vendor instructions. It is crucial for organisations to respond appropriately to the latest developments in order to resume their critical business activities.The latest advisories published by the CSIRTs Network members can be found on their relevant official communication channels. Organisations may also refer to guidance given by CERT-EU. ENISA maintains an advisory collection. ENISA and all relevant EU actors will continue to monitor this threat, to contribute to the overall situational awareness at the Union level.EU PolicyOrganisations should be further aware that the EU Cyber Resilience Act (CRA), once in force, will require manufacturers of hardware and software products, including VPN solutions, to follow security-by-design principles throughout the lifecycle of such products. This includes the remediation of vulnerabilities without delay. Given their criticality, VPN solutions will be subject to strict conformity assessment requirements.Resources for mitigation actionsIvanti recovery instructions For technical background information about the vulnerability and recommendations: Security Advisory 2024-004 - CERT-EUFor guidance on response please refer to the relevant national authority: CSIRTs by Country - Interactive Map — ENISALatest advisories published by CSIRTs network members Report cybercrime online: Competent law enforcement authorities in EU Member States  

During the action week, the involved authorities carried out checks on passengers and their luggage, as well as on parcels and cargo shipments, at 61 major airports. The checks aimed at detecting the possession or trafficking of drugs, especially cocaine, originating from Latin America. Another objective was to enhance the cooperation between police and customs authorities on both sides of the Atlantic.The operational phase, focusing on intensification of security at airports, was prepared during a preliminary intelligence phase. This led to an analysis of relevant information related to drugs trafficking flows, the identification of possible suspects and modus operandi besides the development of coordinated activities to be carried out during the action week.Arrests and seizures during the operation:46 arrests356 464 kg of cannabis354 209 kg of cocaine37 kg of synthetic drugs101 559 kg other drugsEuropol facilitated the exchange of information and provided continuous analytical support during the action week.Airports covered during the operational activities:Europe (29):Austria: Vienna International AirportBelgium: Brussels Airport Zaventem, Brussels South Airport Charleroi, Liege Bierset AirportBulgaria: Sofia AirportCzechia- Vaclav Havel Airport PragueGeorgia: Tbilisi International AirportFrance: Paris-Charles de Gaulle Airport, Orly AirportGermany: Frankfurt Airport, Leipzig/Halle Airport, Cologne/Bonn AirportIreland: Shannon Airport, Cork Airport, Dublin AirportItaly: Roma-Fiumicino Airport "Leonardo Da Vinci"Luxembourg: Luxembourg AirportNetherlands: Amsterdam Airport SchipholNorth Macedonia: Skopje International AirportPoland: Warsaw Chopin AirportPortugal: Humberto Delgado AirportSlovenia: Ljubljana Jože Pučnik AirportSpain: Adolfo Suárez Madrid–Barajas Airport and Barcelona-El PratSweden: Stockholm Arlanda Airport, Malmö Airport Toftanäs terminal, and Gothenburg-Landvetter AirportSwitzerland: Zurich Airport, Geneva AirportUnited Kingdom: Heathrow AirportAfrica, Americas & the Caribbean (32):Argentina: Ministro Pistarini International AirportBenin: Cardinal Bernadin Gantin International AirportBolivia: El Alto International Airport, Viru Viru International AirportBrazil: Guarulhos/São Paulo International Airport, Viracopos/Campinas International Airport, Rio de Janeiro/Galeão International Airport, Fortaleza–Pinto Martins International AirportCape Verde: Nelson Mandela Praia International AirportColombia: El Dorado International Airport, Jose Maria Cordova International Airport, Alfonso Bonilla Aragón International AirportDominican Republic: Punta Cana International Airport, Santo Domingo Las Américas International AirportEcuador: José Joaquín de Olmedo, Mariscal Sucre International AirportGambia: Banjul International AirportGuinea-Bissau: Osvaldo Vieira International AirportIvory Coast: Félix-Houphouët-Boigny International AirportJamaica: Norman Manley International Airport, Sangster International AirportNigeria: Nnamdi Azikiwe International Airport, Murtala Muhammed AirportPanama: Tocumen International Airport, Enrique Malek International Airport: David, Panamá Pacífico International Airport, Albrook Gelabert Airport.Peru: Jorge Chávez International AirportTogo: Gnassingbé Eyadéma International AirportUnited States: Miami International Airport, John F. Kennedy International AirportParticipating countries:EU Member States: Austria, Belgium, Bulgaria, Czechia, France, Germany, Ireland, Italy, Lithuania, Luxembourg, Netherlands, Poland, Portugal, Slovenia and Sweden.Non-EU countries: Argentina, Benin, Brazil, Bolivia, Cape Verde, Colombia, Ivory Coast, Ecuador, Gambia, Georgia, Guinea Bissau, Jamaica, North Macedonia, Nigeria, Panama, Peru, Togo, Switzerland, United Kingdom and United StatesAgencies: Europol, Frontex, INTERPOL through project AIRCOP

The mandates of both EU agencies have been significantly enhanced in recent years, opening new possibilities to work together, particularly in the fields of migrant smuggling and human trafficking. The joint statement outlines how the two agencies can better coordinate their activities to complement each other. The statement identifies concrete short and long-term priority actions. In practice, Frontex’s role is to provide intelligence from its border surveillance and monitoring. Europol’s role is to provide a law enforcement response to organised cross-border crime and terrorism within the EU. In this context, close and efficient partnership between the two agencies is the way to succeed in common endeavours.Frontex's Executive Director, Hans Leijtens, said:Our agencies complement each other and must support each other not only by exchanging operational information, but also in how we interpret and implement new laws and policies, such as the Commission’s proposal for the new Regulation on migrant smuggling. Today’s statement serves as the basis for closer cooperation, but I am already looking ahead towards the renewal of the Working Agreement with Europol. This will be the ambitious change-maker that will take our partnership to a higher level.Europol's Executive Director, Catherine De Bolle, stated:The joint statement we signed today marks a new chapter in our cooperation with Frontex. As the EU’s criminal analysis hub, Europol recognises the importance of bringing together relevant partners for cross-border cooperation and joint actions. We look forward to further combining our respective capabilities and strengths to realise the full potential of the enhanced mandates of both agencies. Frontex and Europol have been working together to counter migrant smuggling, in risk analysis and in operations within the European Multidisciplinary Platform Against Criminal Threats (EMPACT). 

The investigation into this criminal network uncovered that the suspects allegedly recruited Latvian and Portuguese nationals and facilitated their journeys to Cyprus, where the women entered into arranged marriages with third-country nationals. The suspects, mainly Indian, Pakistani and Portuguese citizens, arranged all the logistics including the purchase of flight tickets and the acquisition of passports and other required documents. The OTF’s activities led to the identification of a number of perpetrators, suspicious transactions and a total of 133 marriages of convenience between Portuguese and Latvian women, and Indian and Pakistani men. The marriages enabled the non-EU nationals to obtain residence permits from third countries, which they then used to travel to other European countries. The sham marriage ceremonies took place in town halls around Aradippou, Livadia and Nicosia, Cyprus. The work of the OTF led to searches and arrests in Cyprus, including the arrest of two of the main organisers in Latvia and Portugal following European Arrest Warrants issued by the Cyprus.The joint action day led to:15 arrests (13 in Cyprus, 1 in Latvia and 1 in Portugal)4 of which are High Value Targets (2 in Cyprus, 1 in Latvia and 1 in Portugal)Seizures including electronic equipment and documentationEuropol’s role:Europol’s OTF Limassol was set up to facilitate the joint efforts of Cyprus, Latvia and Portugal into dismantling this criminal network dedicated to facilitating illegal immigration via sham marriages. Europol supported this OTF by facilitating information exchanges, coordinating and financing operational activities and providing tailored operational analytical support. During the action day, Europol supported the field activities by crosschecking in real-time the operational information collected. Europol also provided operational analysis to help deliver possible leads to investigators on the ground.Nine cases were opened at Eurojust between 2022 and 2024 to facilitate the execution of European Investigation Orders and European Arrest Warrants. Eurojust organised dedicated coordination meetings and facilitated the judicial cooperation between the authorities involved during the action day.Law enforcement authorities involved:Cyprus: Cyprus Police (Αστυνομία Κύπρου) and Law Office of Republic of Cyprus (Νομική Υπηρεσία της Κυπριακής Δημοκρατίας)Latvia: State Police of Latvia (Latvijas Valsts policija)Portugal: Polícia Judiciária (Judicial Police)

Results of the operation include:15 persons arrested18 victims or possible human trafficking victims detected4 new investigations initiated398 flights monitored13 harbours monitored19 postal services and express delivery companies monitored57 checkpoints at borders and hotspots establishedSerious organised crime coordinated from NigeriaNigerian criminal networks have long been renowned for trafficking in human beings and a variety of fraud, but in recent years they have also gained a strong foothold in drug trafficking across several EU markets. In this crime area, Nigerian drug traffickers are particularly active in transporting and distributing both cocaine and heroin. One of the most commonly observed modus operandi for transporting drugs in and out of the EU is by air. Drug mules from both Nigeria and the EU take frequent trips and smuggle drugs on their person typically swallowed, concealed in body cavities or hidden in luggage.In addition, the intelligence picture put together by international law enforcement shows that Nigerian criminal networks coordinate a large share of amphetamine trafficking. These drugs are usually sent from African countries via the EU towards Asian or Australian destinations. These criminal activities, while generally orchestrated from Nigeria, could pose a risk to the safety of citizens across the EU. Criminal leaders live luxurious and lavish lifestyles, directing their couriers and lower-level organisation members from a distance. To ensure drug mules or victims of human trafficking remain under their control, the kingpins apply measures such as severe threats, the use of extreme violence or intimidation with obscure religious practices.Typically, Nigerian criminal networks are well organised with an almost militia-style hierarchy. With the promise of protection and power, secret societies recruit new members. These secret societies are sometimes called confraternities. These crime syndicates have been established across the globe and act as the backbone of Nigerian organised crime.Europol’s roleGiven the alarming intelligence picture gathered by Europol and its partner countries and agencies, this joint operation was the first of its kind specifically targeting Nigerian criminal networks operating across Europe. Based on an intelligence-led approach, participating countries and law enforcement agencies targeted identified national hotspots and took action at airports, harbours and other border crossings.During the action phase in December 2023, Europol hosted an operational centre to coordinate the international activities and provide crosschecks against its database. INTERPOL supported the action with an analyst at the coordination centre as well as a team remotely cross checking all organisations’ databases and providing field expertise.The large-scale law enforcement effort was supported by EMPACT and funded by @ON. @ON is an operational network financed by the Internal Security Fund (ISF) and created to counter mafia-style serious and organised crime groups. The network focus on EU organised crime priorities outlined in the EU Policy Cycle and support actions adopted within EMPACT projects.This two-year long operational action was part of the EMPACT priority operational action plan “High Risk Criminal Networks” and led by Sweden and Belgium.Participating countries:Belgium, Bulgaria, Colombia, Germany, Greece, Iceland, Malta, Nigeria, Republic of Benin, Spain, Sweden, United States, United KingdomParticipating authorities:Europol, Frontex, INTERPOL, UNODC CrimJust, UK Home Office International Operations in Nigeria 

Deliberate breach of EU sanctions against RussiaInvestigations into the case were initiated at the end of 2022 by the Dutch authorities and led to the uncovering of a web of enterprises that were used to circumvent the ban for exports to Russia. Europol supported the investigation by providing analytical support, as well as conducting crosschecks on the data gathered during the searches. Eurojust enabled the cross-border judicial cooperation and organised a coordination meeting to prepare for the joint actions, at the request of the Dutch authorities. Eurojust also set up a coordination centre during the action day in January 2024, which took place simultaneously in all of the involved countries.

The analysis describes the European market for heroin (the most frequently used illicit opioid), from production and trafficking, to distribution and use. It also details the processes, materials and criminal actors involved at different stages and levels of the market. Where available, data on heroin are supplemented by insights into other opioids trafficked and consumed in the EU. The EU retail heroin market is estimated to be worth at least EUR 5.2 billion annually*. The quantity of heroin seized by EU Member States more than doubled in 2021 to 9.5 tonnes — the highest amount in 20 years — with large individual consignments detected at seaports. Illicit opioid use remains a major concern in the EU, being responsible for around three-quarters of the over 6 000 drug-related overdose deaths in 2021. There are around 1 million high-risk opioid users in the EU. The trafficking and distribution of heroin is the mainstay activity for some criminal networks operating in the EU which rely on well-established infrastructure and contacts. As with other drug types, the abuse of legal business structures, money laundering and corruption are among the key enablers of the illicit heroin market.Decline in Afghan opium poppy cultivation and production: potential implications for EuropeAlmost all heroin consumed in Europe comes from Afghanistan, where the Taliban announced a ban on opium poppy cultivation and opium production in April 2022. Latest UNODC figures for 2023 show a 95 % decline both in cultivation and in illicit opium production in the country. Cultivation in Afghanistan was estimated at 10 800 hectares in 2023 (233 000 hectares in 2022) and opium production at 333 tonnes (6 200 tonnes in 2022). At present, there are no signs of heroin shortages in Europe. 'Nonetheless, the Taliban’s ban on opium cultivation, if it is sustained, could have a significant impact on heroin availability in Europe in the future', states the report. While it will take time for the developments in Afghanistan to be felt in the EU, a decrease in heroin availability could lead to market gaps being filled by potent synthetic opioids or stimulants (e.g methamphetamine, cathinones), with significant negative effects on public health and security. Traffickers adjust routes to minimise risks and exploit new opportunitiesFour main routes are used for trafficking heroin from Afghanistan to Europe: Balkan, Southern, Caucasus and Northern. The analysis describes how traffickers are adjusting routes and methods to minimise risks and exploit new opportunities. While the Balkan route remains a key corridor for heroin trafficking into the EU, seizures along it appear to be decreasing, due to perceived, or actual, stricter border controls along the overland section through Türkiye and Bulgaria. Heroin trafficking on the Southern route to the EU, on the other hand, seems to be increasing. This can be seen in the large quantities of heroin departing from ports in Iran and Pakistan, as well as significant seizures at European ports. The use of the Northern and Caucasus trafficking routes continues, however, the Russian war of aggression against Ukraine has likely contributed to changing trafficking patterns, with some criminal networks seeking alternative routes. The United Arab Emirates (UAE) has emerged as a significant transhipment point that is used to conceal the origin and nature of heroin shipments. It is also a key hub for money laundering and criminal coordination.A complex and evolving opioid marketThe European opioid market is increasingly complex, including diverted medicines and internationally controlled or new highly potent synthetic opioids. Methadone, buprenorphine, fentanyl and its derivatives and new synthetic opioids have become more visible in data on health consequences (e.g. drug-related deaths, hospital emergencies). Concerningly, over the past five years, most of the newly identified opioid substances reported to the EU Early Warning System on new psychoactive substances have been highly potent benzimidazole (nitazene) opioids, rather than fentanyl derivatives as in previous years. Compared to North America, the EU has been impacted to a much lesser extent by synthetic opioids. This can be attributed to protective factors such as strict prescribing practices, social healthcare provisions in most countries, and well-developed treatment and harm reduction services for existing opioid users. Nevertheless, these substances play a prominent role in some EU Member States, particularly Nordic and Baltic countries, and the analysis calls for actions to increase preparedness across the EU.Addressing current threats and boosting resilienceThe findings of the report draw on data and information from the EMCDDA’s drug monitoring system and from Europol’s operational information on serious and organised crime. Taking a threat assessment approach, the agencies highlight key areas for action at EU and Member State level to respond to developments in the illegal heroin and other opioids market. These include improving the strategic intelligence picture, strengthening responses to reduce supply and enhance security, boosting international cooperation, investing in capacity-building, strengthening policy, public health and safety responses.Europol’s Executive Director Catherine De Bolle states: Although we are seeing a decline in opium poppy cultivation in Afghanistan, close monitoring of the supply chain and the diversification of the market is paramount, as criminal networks are known to be business-oriented, flexible and always on the lookout for new opportunities. Europol remains committed to fostering intelligence sharing, operational coordination and international cooperation with our partners in the fight against this concerning threat posed to the EU.EMCDDA Director Alexis Goosdeel says: Europe’s opioid problem is fast-evolving and increasing in complexity, shaped by global developments that may have far-reaching implications for our preparedness and response. It is imperative that we strengthen our capacity to rapidly detect and counter health and security threats emerging from a changing opioid market. At the same time, maintaining and developing further an integrated and evidence-based portfolio of health and social responses is more important than ever. For this purpose, we need to build on the results and the lessons learned from 30 years of European drug policy, based on the fundamental rights and the active participation of all stakeholders, including people who use drugs. As substance use and patterns of use change and become more complex, we must revise our model and adapt our prevention, treatment and harm reduction offer to respond to these new challenges.*Probable range EUR 4.1 billion to EUR 6.7 billion based on data from 2021.

This message is addressed to former staff of Europol.By means of the new Service Level Agreement, Europol has continued the practice of delegating the following services to the European Commission Pay Master Office (PMO):Sickness insurance - Accidents - Occupational Disease UnemploymentPayment of Retirement Pension - Survivors and Orphans Pension – Transfer IN and Transfer OUT – Severance Grant Invalidity AllowanceBy delegating the above services, Europol has also delegated its decision making powers in that regard to the PMO. Please be informed that the legal and practical consequence of such delegation is that any introduction of related requests and complaints under Article 90 of the Staff Regulations, shall be made to the PMO and not to Europol, and handled by the competent entity of the PMO, as per the distribution of responsibilities within the PMO.A novelty of this SLA is that the PMO is now considered a data controller for personal data it processes on the basis of the SLA. Any request as data subject in relation on these matters should therefore also be addressed them. 

What is The Europol Podcast about?In season 1, Europol agents and police from around the world took listeners behind the scenes on some of our biggest operations against serious and organised crime. Episodes covered all kinds of crimes that Europol investigates, from drug trafficking to cybercrime. In season 2, we have an all-new selection of cases and topics for you to learn about. Ever wondered how organised crime move their drug shipments through Europe’s ports? Or how Europol and our partners take down terrorist propaganda networks? Perhaps you’re curious about how we track down the High Value Targets at the top of organised crime, or money launderers who are defrauding European taxpayers for millions?If the answer is yes, then follow the links below to add The Europol Podcast to your subscriptions.How to find The Europol PodcastTo find the show, simply open up your preferred podcasting app or website and search for ‘The Europol Podcast’. Alternatively, you can find episodes by clicking the following links:I want to listen on…Europol’s websiteSpotify Apple PodcastsDeezerWe hope you enjoy the podcast. 

The 29-year-old individual was apprehended in Mykolaiv, Ukraine, on 9 January. Three properties were searched to gather evidence against the main suspect. The arrest comes after months of intensive collaboration between Ukrainian authorities, Europol and a cloud provider, who worked tirelessly to identify and locate the individual behind the widespread cryptojacking operation.The suspect is believed to have mined over USD 2 million (EUR 1.8 million) in cryptocurrencies.Free money for attackers, huge cloud bills for account usersCryptojacking in a cloud environment is a malicious activity; malicious actors gain unauthorised access to cloud computing infrastructure and use its computational power to mine cryptocurrencies.By stealing cloud resources to mine cryptocurrencies, the criminals can avoid paying the necessary servers and power, the cost of which typically outweighs the profits.The compromised account holders are left with huge cloud bills. When law enforcement works with private industryThis case illustrates the power of law enforcement joining forces with the private sector.A cloud provider approached Europol back in January 2023 with information regarding compromised cloud user accounts of theirs. Europol shared this information with the Ukrainian authorities, who subsequently opened an investigation.Since then, all three partners have been working closely together to develop operational leads and prepare for the final phase of the investigation.Europol’s European Cybercrime Centre (EC3) set up a virtual command post on the action day, supporting the Ukrainian National Police from Europol’s headquarters, with analysis and forensic support on the data gathered during the searches. How to protect yourselfTo defend oneself against cloud cryptojacking, Europol encourages cloud users and providers to implement robust security practices, as indicated below.Strong access controls: use strong authentication methods and access controls to prevent unauthorised access to cloud resources.Regular monitoring: continuously monitor cloud environments for suspicious activities, unauthorised access, and unexpected resource utilisation.Security updates: keep all cloud resources, including virtual machines and containers, updated with the latest security patches to mitigate vulnerabilities.Use security services: consider using cloud security services and tools provided by cloud service providers to enhance security.

During the action day, houses were searched simultaneously in several Lithuanian cities. In addition to the arrest of the two criminal masterminds behind the criminal network, a large amount of evidence was seized. Officers found raw materials for the production of vehicle number plates, as well as forged registration stickers in a metal processing workshop with embossing tools. A range of sophisticated printing machinery was seized including commercial printers, CO2 laser engraving machines, copy films, polymer plates, chemicals, embossing tools, cutting and punching machines, UV curing machines and presses. In addition, law enforcement authorities seized property worth approximately EUR 1 million. Operational Task Force ‘KEYLESS’In the run-up to the action day, law enforcement agencies from both Germany and Lithuania were supported by Europol in an extensive investigative effort triggered by a sharp increase in car thefts. Initially, a Lithuanian national was arrested in 2020 and subsequently convicted on charges related to organised gang crime. However, investigations following this initial success unveiled a vast criminal network involved not only in organised property crime but also international drug trafficking, money laundering and counterfeiting.In order to unravel the network’s structure and identify its members, the Operational Task Force (OTF) ‘KEYLESS’ was set up earlier this year. With the aim of further strengthening and optimising international cooperation, the participants in the OTF analysed hundreds of thousands of encrypted chats and took measures to track down gang members in Lithuania. In addition, the OTF identified crime enablers such as counterfeiters and business infrastructure operating as counterfeit workshops.Convenient but vulnerableVehicles equipped with remote keyless systems use a radio signal to recognise the key when it is near the vehicle. While convenient, keyless entry systems are also vulnerable: thieves use the radio communication between the vehicle and the key to gain unauthorised access to the car. To do this, they use signal enhancers to intercept and extend the radio communication between the vehicle and the key, thus setting up a relay station. This technology simulates an authorised key in the vehicle, despite it not being there.Protect yourself against car thieves:Do not leave the key near the house or apartment door.Shield the radio signal (e.g. with aluminium covers or a tin can), then carry out a test in the vehicle. You will only be sufficiently protected if the shielded key does not work directly in the vehicle.Watch out for people with large bags or briefcases behaving suspiciously around you when leaving your vehicle. They could be professional car thieves.You can also ask the vehicle manufacturer whether it is possible to temporarily deactivate your vehicle’s keyless entry system. With some keys, the keyless function can be switched off completely by pressing the lock button on the key twice, for example. Your dealer or garage may also be able to advise you on the options available specifically for your vehicle.Europol’s roleEuropol contributed extensively to this EMPACT-supported operation by providing awareness sessions on encrypted data analysis and by hosting table-top exercises with leading investigators to assess and exploit incoming intelligence from different sources. Europol experts supported the national investigations by implementing advanced analytical techniques used to pinpoint additional accomplices in the criminal network. Furthermore, intelligence products were shared, including the analysis of encrypted data attributed to key criminal actors. Finally, Europol also provided on-the-spot support during the action day. 

Drug trafficking operations on the high seasThe investigation was initiated in February 2023, when law enforcement authorities gathered evidence of drug trafficking by known local narcotics clans along the Portuguese coast. The drug trafficking operations were carried out by retrieving cocaine shipments in the waters of the Atlantic. Portuguese authorities seized one such shipment of cocaine in Peniche (Portugal). The information gathered by law enforcement authorities indicated that the notorious Galician narcotics clan was deploying significant resources in terms of personnel, land and maritime equipment in Portugal to retrieve shipments of drugs on the high seas and then transport them to the Spanish region of Galicia. Investigative units thwarted this plan, seizing a large part of the cargo on the Portuguese coast and in a stranded speedboat. This law enforcement action came just as the Galician clan intended to retrieve the merchandise from the beach. Later, in April 2023, law enforcement officers seized another 220 kg of cocaine in the Salnés region of Pontevedra, Spain. The investigative leads revealed that the drug shipments were destined for a notorious criminal gang originating from the Western Balkans region.Eurojust set up a joint investigation team to facilitate judicial cooperation between Spain and Portugal.Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall coordination of the case between the various agencies. During the action day, Europol deployed an expert to the field in Spain to cross-check operational information in real time and provide leads to investigators in the field.

Digital skimming is the act of stealing credit card information or payment card data from customers of an online store. Criminals use sophisticated information technology to intercept data during the online checkout process, without customers or online merchants noticing anything unusual.Data theft often goes unnoticedDigital skimming attacks can go undetected for a long time. Payment or credit card information stolen as a result of these criminal acts is often offered for sale on illicit marketplaces on the darknet. Customers are usually not aware that their payment details have been compromised until the criminals have already used them to carry out an unauthorised transaction. Generally, it is difficult for customers to find the point of compromise.Europol is participating in the digital skimming action with the aim of informing affected e-commerce platforms and other online merchants that they have been unintentional points of compromise for such stolen payment data. Europol, national law enforcement authorities, national Computer Security Incident Response Teams and trusted private industry partners identify affected online merchants and provide technical support to these platforms to resolve the issues and protect future customers.For more information on digital skimming attacks and how to protect your business, please visit our multilingual awareness guide on digital skimming. Participating countries:Greece (action leader), Albania, Belgium, Bosnia and Herzegovina, Colombia, Croatia, Finland, Germany, Georgia, Hungary, Moldova, Netherlands, Poland, Romania, Spain, United Kingdom, United States.Participating agencies:EUROPOL, ENISAParticipating partners from the private sector:Sansec, Group-IB 

Fraud schemes are perpetrated with the intention of defrauding victims of their assets using false and deceitful pretexts, or with the use of cyberattack techniques. This results in the voluntary or involuntary transfer of personal or business information, money or goods to criminals.From ATM attacks and account takeovers to skimming and shimming, the wide availability of crime-as-a-service has made this criminal activity more accessible. Criminals show great versatility and adaptability in adjusting their modi operandi and modelling their narratives around socio-economic trends as well as current crises, taking advantage of emergency situations to create charity scams.This report is an accompanying module to Europol’s IOCTA, which aims at providing and understanding of modern cybercrime to equip law enforcement with the knowledge to tackle it and keep people safe. It delves into the complexities of online fraud schemes and sheds light on how different schemes overlap and victimise targets multiple times.Key findings:Relay attacks targeting payment card chips (shimming) are increasingly detected.Charity scams leveraging emergency situations have increased. This was visible during the COVID-19 pandemic, the Russian invasion of Ukraine and the earthquake in Türkiye and Syria.Logical attacks on ATMs still occur in the EU, with criminal networks testing ways to exploit new vulnerabilities at the ATMs they target.Fraudsters display sophisticated modi operandi, which are usually a combination of different types of fraud. Victims of fraud are often re-victimised within the same criminal scheme.Social engineering techniques that fraudsters use have been growing in complexity. Criminals adapt their techniques according to the profile of the victim and the typology of fraud.Europol’s responseEuropol’s mission is to support EU Member States and cooperation partners in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism.In 2013, Europol set up the European Cybercrime Centre (EC3) to provide dedicated support for cybercrime investigations in the EU to help protect European citizens, businesses and governments from online crime. EC3 offers operational, strategic, analytical and forensic support to Member States’ investigations.EC3’s dedicated Analysis Project Terminal, focused on the threat of online fraud schemes, supports international investigations and operations into fraud targeting various victims and payment systems in the EU and beyond.

During the operational phase, specialised police departments and public prosecutors' offices from all 16 German Federal States carried out enforcement actions, alongside the German Federal Criminal Police Office and their counterparts in Poland, Austria, Switzerland and Luxembourg. Europol coordinated the international activity.  Around 1 000 law enforcement officers, including special intervention units, were involved daily in this operational phase.Thanks to the large-scale operation led by the Berlin Police, the perpetrators were arrested in the act; extensive evidence was secured and large sums of money and valuables such as jewellery belonging to the victims was recovered.In total, 27 suspects were arrested, and 74 ‘shock call’ crimes were stopped, preventing some EUR 5 million from ending up in the criminals’ pockets.Europol deployed staff to the coordination centre in Berlin throughout the entire action period, assisting with the cross-checking of the evidence collected and facilitating the information exchange between the different countries involved.Cold calling about fictitious accidentThe scams committed by this criminal network always followed the same pattern.The suspects would call their victims posing as a police officer, a representative from the public prosecutor’s office or even a family member. They would claim that a family member had been involved in a car accident, and that the victim must post bail for their release.The investigation uncovered how the suspects had been using information from obituaries in newspapers to carry out their scams. From the obituaries, the suspects learnt the names of the deceased's children, which they then used to contact the bereaved. They would impersonate a family member, adding credibility to the fraudulent call.The demands in these cases usually exceeded EUR 100 000.Be sceptical about the ‘emergency’There are simple precautions to avoid falling victim to such scams:Avoid letting third parties know too many personal details about you.Ask for their telephone number and check it.If necessary, try to reach your allegedly implicated family member by phone.Hang up if in doubt.If you receive or have received such a call, we ask you to notify the Police immediately and under no circumstances to respond to the perpetrators' demands.This investigation received financial support from the European Multidisciplinary Platform Against Criminal Threats (EMPACT) and the ISF Lumen project focusing on cross-border organised property crime within the EU. The following authorities took part:Germany: State Police (Landespolizei) of all 16 Federal States, Federal Criminal Police Office (Bundeskriminalamt);Austria: Criminal Intelligence Service Austria (Bundeskriminalamt), all 9 provincial Criminal Investigations Departments (Landeskriminalämter) and 9 regional Anti-Street Crime Operational Teams (Einsatzgruppen zur Bekämpfung der Straßenkriminalität), Surveillance Teams;Law enforcement in Poland, Luxembourg and Switzerland.

This report was first presented at the SIRIUS Annual Conference. Over 900 participants took part in this hybrid conference between 21-23 November 2023. The latest SIRIUS publication outlines the experiences of EU authorities in retrieving electronic data held by foreign-based service providers, as well as their experiences in delivering data for the purpose of criminal investigations over the past year. The report highlights a new frontier in electronic evidenceThe EU Electronic Evidence legislative package, adopted in July 2023, marks a new era in obtaining electronic evidence, as it will enable competent authorities to issue legally binding orders directly to service providers offering services within the EU, regardless of their place of establishment. This move will help address issues regarding lengthy judicial procedures to obtain data across borders, as well as legal uncertainties surrounding practices of voluntary cooperation between competent authorities and service providers.Furthermore, other new legal instruments, such as the Second Additional Protocol to the Budapest Convention on Cybercrime will introduce novel legal bases for direct cooperation between competent authorities and private entities. The EU Digital Services Act, which introduces standardised minimum requirements for orders to provide information under EU Member States’ national laws, also provides further tools and clarity for authorities in need of obtaining data across borders. However, challenges persist. The report highlights the need for comprehensive preparation among all stakeholders. From law enforcement's perspective, social media platforms, messaging apps, and cryptocurrency exchanges are pivotal in investigations. While formal training on electronic evidence has been provided to officers, gaps in familiarity with the new legislation remain, emphasising the need for extensive training programs. Judicial authorities face time-consuming hurdles when accessing data from foreign service providers, urging the need for enhanced legal powers and EU-wide legislative efforts to regulate data retention for the purposes of criminal investigations and proceedings. Service providers, on the other hand, grapple with authenticating requests and resource allocation, emphasising the benefits of centralisation of requests.A strategic roadmap to navigate this new frontier in electronic evidence Amidst the challenges posed by advancing technology and the expanding electronic landscape, the report provides recommendations for law enforcement and judicial authorities, as well as service providers, which serve as a strategic roadmap.By strengthening capacity and mutual trust, law enforcement and judicial authorities can successfully navigate the complexities of electronic evidence. Collaborative efforts and shared solutions will pave the way for a more secure digital environment in the EU, as well as effective and efficient prosecutions. To prepare law enforcement and judicial authorities as well as service providers to successfully pioneer this new frontier of electronic evidence, it is imperative to raise awareness and  provide training on those novel legal instruments so significant to this project.  Celebrating five years of SIRIUSCelebrating its fifth anniversary in 2023, the SIRIUS Project has been a beacon of support for approximately 7 500 law enforcement officers and 500 judicial authorities from 47 countries, aiding them in navigating the complex realm of electronic evidence.SIRIUS achievements in numbers over the last five years:built a community of authorities of 8 000 members from 47 countries;provided real-time support to 64 ongoing investigations;created 77 service provider-specific guidelines and 20 legal and policy reviews on cross-border access to electronic evidence; published 5 editions of the SIRIUS EU Electronic Evidence Situation Report;developed 52 technical tools for investigations;trained over 2 300 members of law enforcement;trained over 500 members of the judiciary;expanded the Single Point of Contact (SPoC) Network to 21 EU Member States to support cross-border investigations;expanded the membership of the SIRIUS Advisory Board to include a total of 10 members;developed webinars, online modules and a fully fledged video game.Download the SIRIUS Report 2023.The SIRIUS project has received funding from the European Commission's Service for Foreign Policy Instruments (FPI) under contribution agreement No PI/2020/417-500 

Law enforcement authorities targeted 209 individuals, mainly right and left wing extremists, for their alleged involvement in serious offences related to the spread of violent hate speech, incitement to commit violent hate crimes, and death threats. Some of the individuals are linked to religiously motivated extremism, while others are believed to have incited violence against politicians, violent acts towards the political system and specific communities. Officers from participating countries implemented different actions, which included multiple location raids and seizures of electronic devices, mobile phones, weapons and propaganda material. German authorities carried out 65 houses searches and interrogated 54 individuals. During the coordinated action day, French authorities targeted 72 individuals for various online and offline offences. Among these offences were the use of forbidden weapons and symbols of terrorist organisations, the dissemination of propaganda, public incitement to commit offences, and the defamation of politicians. Italian authorities investigated, under the order of the Judicial Authority of Monza, an individual who incited others to commit crimes while disseminating racist, xenophobic and supremacist propaganda. Spanish authorities arrested two individuals for criminal acts against vulnerable communities, and two other individuals are under investigation for hate motivated violence allegedly resulting in bodily injuries.The operational actions focused on combating and preventing the proliferation of hate crime, racism and xenophobia via social media, online fora and other online platforms. Law enforcement actions also targeted the dissemination of hate speech, which goes beyond the online world. As an example, French authorities took action against an individual who was targeting and dating gay men to scam them out of money. Europol provided operational coordination and facilitated the exchange of information between the participating authorities. Experts from Europol’s Counter Terrorism Centre monitored all contributions, provided analytical support, and gave a continuous overview on the operational activities through direct contact with the involved law enforcement authorities. Law enforcement authorities involved:Austria: Directorate State Protection and Intelligence Service (Direktion Staatsschutz und Nachrichtendienst)France: National Gendarmerie (Gendarmerie Nationale/OCLCH), National Police (Police Nationale), local police authoritiesGermany: Federal Criminal Police (Bundeskriminalamt), local police authoritiesItaly: National Police (Polizia di Stato / DCPP-DIGOS of Monza-Brianza) Spain: National Office for Combating Hate Crimes (Oficina Nacional de Lucha Contra los Delitos de Odio / ONDOD), Civil Guard (Guardia Civil) and Regional Navarre Police (Policía Foral).   

The arrested individual was wanted by Slovenian authorities and was under investigation for drug trafficking and money laundering. Authorities believe the suspect recruited accomplices and provided them with vehicles with purpose-built hidden compartments in order to transport and sell cocaine and heroin. They would then launder the profits by purchasing real estate and luxury vehicles. During the operational activities, law enforcement authorities seized drugs, firearms and ammunition, phones, vehicles, electronic equipment and over EUR 120 000 in cash.Europol supported the operational activities, facilitated the exchange of information, and provided an intelligence package and analytical support. On the action day, Europol provided remote support to crosscheck operational information in real time. Participating law enforcement authorities:Bosnia and Herzegovina: Special Anti-Terrorist Unit of Ministry of Interior of Republika Srpska (Specijalna antiteroristička jedinica Ministarstva unutrašnjih poslova Republike Srpske) and East Sarajevo Police Department (Policijska uprava Istočno Sarajevo)