Crime News

The report underscores the rapid advancement and integration of unmanned systems in various sectors, including law enforcement. As these technologies become more sophisticated and widespread, they offer new opportunities for law enforcement operations and operational support. However, they also introduce new security threats – such as misuse by criminal and terrorist groups – and regulatory challenges that law enforcement agencies must address to ensure public safety and maintain trust.Catherine De BolleEuropol Executive DirectorThe integration of unmanned systems into crime is already here, and we have to ask ourselves how criminals and terrorists might use drones and robots some years from now. Just as the internet and smartphones presented significant opportunities as well as challenges, so will this technology. Our new report by Europol’s Innovation Lab explores the future operating environment for European law enforcement agencies and suggests actions needed today in order to effectively combat crime while upholding public trust and fundamental rights tomorrow.One chapter of the report highlights the role of war as a driver for innovation in unmanned systems. Recent conflicts, such as the ongoing Russian war of aggression against Ukraine, have accelerated the development and deployment of advanced unmanned systems. The lessons learnt from these conflicts are invaluable for law enforcement agencies in Europe as they prepare for the future operating environment.Some of the key topics covered in the report include:Increasing use of unmanned systemsUnmanned systems are becoming increasingly useful, affordable and widely available, with applications in both public and private sectors. Law enforcement agencies across Europe are scaling up adoption of such systems, including drones and robots, to enhance situational awareness, improve safety and extend operational reach. These systems are employed for a range of tasks, such as monitoring, crime scene mapping, search and rescue operations, and the disposal of explosive ordnance, among others. Converging technologies present a significant opportunity for a breakthrough in the capabilities of unmanned systems.Technical and regulatory challengesThe report highlights significant technical limitations and regulatory gaps that hinder the effective use of unmanned systems in law enforcement. Issues such as limited autonomy, dependence on industrial suppliers and the lack of clear guidelines for autonomous operations pose substantial challenges.Security threatsCriminal and terrorist groups are rapidly adopting unmanned systems for illicit activities. The report warns of the potential for these systems to be used for criminal surveillance, smuggling and even attacks. The increasing accessibility and versatility of drones, in particular, present serious security concerns.Public trust and regulationPublic trust is crucial for the legitimacy of law enforcement capabilities. The report emphasises the need for transparency, accountability and public engagement in the deployment of unmanned systems. Current regulations, while advancing, still have gaps, particularly in addressing non-compliant or criminal use.Future operating environmentThe future of law enforcement will require policing in a three-dimensional space, as unmanned systems operate in the air and on the ground, as well as on and under water. This shift will necessitate new strategies, technologies and training for law enforcement agencies.RecommendationsThe report provides a set of recommendations for European law enforcement agencies, including the development of a strategic direction, the establishment of a competency hub and the integration of unmanned systems into existing information systems. It also calls for investments in training, education and public trust-building initiatives.The report is available for download on the Europol website and includes detailed insights, case studies and recommendations for law enforcement agencies, policymakers and other stakeholders.

Europol Deputy Executive Director for Governance, Jurgen Ebner, joined the Heads of EU Justice & Home Affairs Agencies in Vienna to reflect on joint achievements and align their future cooperation with the wider EU priorities.Marking the 25th anniversary of the EU Charter of Fundamental Rights, they adopted a joint statement pledging to intensify efforts to uphold and promote fundamental rights in all their activities.The meeting also covered key topics of interest including the EU Internal Security Strategy 'ProtectEU', the EU Innovation Hub for Internal Security and the AI Act.Engaging with Javier Zarzalejos, Chair of the European Parliament’s LIBE Committee also served to align the Agencies’ work with the Committee’s priorities.The meeting brought together the Heads of the JHA agencies, alongside representatives from the European Parliament, the Danish and Cypriot Presidencies of the Council of the EU, the General Secretariat of the EU, the Danish coordinator of the European Multidisciplinary Platform Against Criminal Threats (EMPACT), European Commission, the European External Action Service, and the EU Agencies Network.Established in 2010, the network enhances cooperation among the nine agencies in the areas of freedom, security, and justice – CEPOL, EIGE, EUAA, EUDA, eu-LISA, Eurojust, Europol, FRA and Frontex. FRA holds the 2025 presidency of the network. EUDA will preside in 2026, followed by EIGE in 2027.

Migrant smugglers and human traffickers are exploiting today’s geopolitical instability and economic pressures with unprecedented agility. Their business models continue to evolve at high speed, allowing criminals to recruit, transport and exploit vulnerable individuals while maximising profits. As a result, the EU faces a constantly shifting and increasingly digital criminal landscape. Both crime areas have undergone significant transformation in recent years, fuelled in particular by the rapid expansion of online tools for recruitment, advertising and exploitation. These and other latest trends are outlined in the 2025 Europol’s European Migrant Smuggling Centre yearly activity overview, published today.Catherine De BolleEuropol Executive DirectorMigrant smugglers and human traffickers evolve constantly, and so must we. To succeed in our fight against these criminals, we must target the entire chain from recruitment, through transit, to exploitation and the financial flows behind it. Europol stands ready as a true operational partner: supporting investigations, facilitating intelligence sharing, and coordinating joint operations.Migrant smuggling remains driven by conflict, persecution, economic hardship and environmental changes, which motivate movements across border. These pressures make migrants highly vulnerable to criminal networks that offer “facilitation packages” including transport, guidance, accommodation in transit hubs and forged or fraudulently obtained travel documents. Human trafficking networks similarly prey on vulnerable individuals, deceiving or coercing victims with false job opportunities or safe-passage promises before subjecting them to exploitation. Victims are forced into sexual services, labour exploitation, forced criminality or other abuses for the sole profit of organised crime networks.Criminals expand online: from recruitment to controlThe digital domain is now deeply embedded across all phases of migrant smuggling and human trafficking. A rather new example is the proliferation of AI-generated advertisements and multilingual recruitment campaigns on social media. Criminal networks use encrypted communication channels for coordination and real-time logistics, while other tools enable digital surveillance to monitor and control trafficking victims. Criminal networks also make use of crypto-enabled payment systems, often integrated with hawala or informal banking structures to manage the financial flows. Criminals also increasingly mimic influencer strategies and “content-creator academies” to teach others how to lure and manipulate victims online.Violence as a business model, life threatening conditions as a realityMigrant smuggling networks increasingly make use of violence including threats, kidnappings, sexual assault and torture aimed at extorting migrants or forcing families to pay a ransom. Violence is also used to protect territorial control against rival networks and in some cases, to intimidate law enforcement. If the increase of violence is a rather new development, a component that has always been part of migrant smuggling operations is the dangerous and life-threatening conditions of transportation. Some routes are particularly dangerous.As an example, Europol supported a recent operation in Spain targeting a criminal network smuggling migrants from Senegal and Gambia to the Canary Islands. Back in October 2025, officers from the Spanish Guardia Civil arrested three suspects for arranging the extremely dangerous sea-crossing of migrants with cayucos. These small wooden boats are designed for coastal fishing and are not adapted for long-distance sea crossings. The journey from the African coasts to the Canary Islands can last up to 15 days and is notoriously perilous. In some instances, cayucos have drifted off course and been found weeks or even months later in the open Atlantic Ocean or as far away as Central America. Identifying the deceased has often proven impossible, with only documents and other papers found on board providing clues about the point of departure. This case is connected to an incident where eight people including a 14-month-old child died as a result of violence from the smugglers. In this event, 224 people were rescued by authorities from the boat that had left seven days before from Senegal.Combating migrant smuggling in 2024266cross-border operations supported.8operational taskforces supported, composed of a group of experts and resources formed to execute planned missions.48action days organised with law enforcement and judicial authorities to tackle high-risk criminal networks.over 14KSIENA messages received by Europol and accepted for further processing.791analytical and intelligence operational reports.Globalised, modular and resilient networksCriminal networks involved in human trafficking increasingly operate through dual-cell structures, with one cell responsible for recruitment and transit and another dedicated to exploitation. Many groups are also shifting towards poly-criminality, combining human trafficking with document fraud, money laundering and related offences. In some cases, the entire trafficking chain is outsourced to separate actors who provide specialised services on demand. At the same time, the spectrum of exploitation is widening, with victims being forced into sexual services, labour exploitation and various forms of street-level crime. Criminal networks are now more agile and interconnected than ever, exploiting both vulnerable individuals and structural weaknesses. Recent operations clearly illustrate how human trafficking in the EU swiftly adapts to changing conditions, responding to instability, shifting migration flows and growing digital connectivity.Combating trafficking in human beings in 2024188cross-border operations supported.3operational taskforces supported, composed of a group of experts and resources formed to execute planned missions.25action days organised with law enforcement and judicial authorities to tackle high-risk criminal networks.over 2.9KSIENA messages received by Europol and accepted for further processing.253analytical and intelligence operational reports.An activity increased by over 40%The activity overview, published today, highlights the main figures of Europol’s support to EU Member States’ investigations into migrant smuggling and human trafficking networks. One of these figures is the number of messages contributed to Europol’s databases – above 17 000, over 40% more than the information provided in 2016 (nearly 12 000 messages reported that year), outlining the increased information exchange through Europol and operational support provided by the Agency.As a response to this evolving threat landscape, the European Commission proposed in November 2023 a new regulation to reinforce Europol’s support to EU Member States’ law enforcement authorities in their fight against migrant smuggling and human trafficking. The proposal foresees strengthening the European Centre Against Migrant Smuggling, enhancing information exchange between Europol and EU Member States, reinforcing Europol’s biometric data processing capabilities and providing additional resources to help meet the growing demand for support in migrant smuggling and human trafficking investigations.Editor's note: this press release has been updated on two occasions to correct errors and reflect new figures:5 December, 16.22 CET: the month of the European Commission proposal was corrected from November 2025 to November 2023.8 December, 16:01 CET: two figures were corrected:The number of SIENA messages on trafficking in human beings was corrected from 29K to 2.9K.The total number of messages contributed to Europol’s databases was corrected from 43K to 17K.

What began as an investigation into a single fraudulent cryptocurrency platform gradually unfolded into a complex, far-reaching operation, revealing a vast network of deceit and money laundering.The criminal network operated numerous fake cryptocurrency investment platforms, luring thousands of victims with sophisticated advertisements promising high returns. The victims were then repeatedly contacted by criminal call centres, where callers used social engineering to pressure victims into making further payments by showing them inflated returns on fake trading platforms.Once victims had transferred their cryptocurrency, the funds were stolen and laundered across various blockchains and cryptocurrency exchanges. As investigators peeled back the layers of the operation, it became clear that the network had grown far beyond a single fraud scheme, involving multiple fraudulent platforms and sophisticated financial infrastructure spanning Europe and beyond.A coordinated disruption across multiple countriesOn 27 October 2025, the first phase of the operation was executed, with coordinated police raids across Cyprus, Germany and Spain at the request of French and Belgian authorities. These initial actions led to the arrest of nine individuals suspected of laundering illicit funds generated by fraudulent cryptocurrency platforms.Authorities seized millions of euros in assets, including:EUR 800 000 in bank accountsEUR 415 000 in cryptocurrenciesEUR 300 000 in cashDigital devicesHigh-value watchesThe operation was carried out in close collaboration with national authorities from France, Belgium, Germany, Spain, Malta, Cyprus and other countries. Europol and Eurojust supported this first phase of the investigation.Second phase targets affiliate marketing infrastructureThe second phase, targeting another key pillar of the investment fraud ecosystem, took place on 25 and 26 November 2025. It focused on the affiliate marketing infrastructure that supports these online scams. Coordinated actions were taken against the companies and suspects behind fraudulent advertising campaigns on social media platforms. In recent years, deceptive advertisements impersonating renowned media outlets, celebrities and politicians – often using deepfake videos - have posed a significant global challenge. The data of potential investors obtained through manipulated advertising, even on reputable platforms, is crucial to the functioning of the crypto-scam industry as a whole.During the action days, law enforcement teams in Belgium, Bulgaria, Germany and Israel carried out searches and additional operational measures with Europol’s support. Targets included companies that had previously offered affiliate marketing services.Significant infrastructure dismantledThe joint measures taken in October and November represent a coordinated strike against the various pillars of the online crypto fraud industry.The scale of this criminal operation is vast. The investigation uncovered more than EUR 700 million laundered through a labyrinth of cryptocurrency exchanges, exploiting digital anonymity to conceal illicit flows. Following these two coordinated actions and multiple arrests and seizures, investigative authorities will continue to track the criminal organisation’s assets in the countries where it operates and resides.Europol’s support in coordinating this investigationEuropol played a central role in facilitating the cross-border coordination of the operation, providing both operational and analytical support to ensure its success.Key contributions from Europol included:Operational meetings involving law enforcement agencies from all participating countries to coordinate operational strategy and intelligence.Logistical support for the action days, assisting with operational arrangements and resources.Deployment of dedicated case specialists and analysts to cross-check data, develop intelligence and ensure key insights were shared among partners.Deployment of a cryptocurrency specialist to support efforts in identifying and seizing illicit cryptocurrency.Operational and crypto-analysis intelligence products, which provided crucial insights into the movement of illicit funds and the structure of the fraud network.Participating authoritiesBelgium: Federal Judicial Police Limburg (Police Judiciaire Fédérale Limburg)Bulgaria: Bulgarian Cybercrime Directorate, General Directorate Combating Organized CrimeCyprus: Cyprus PoliceFrance: National Gendarmerie (Gendarmerie Nationale)Germany: Bavarian Central Office for the Prosecution of Cybercrime, Police Headquarters Chemnitz (Polizeidirektion Chemnitz), Police Headquarters Görlitz (Polizeidirektion Görlitz), Criminal Investigation Department Würzburg, Police Headquarters Düsseldorf (and others)Israel: National Cybercrime Unit, Intelligence DivisionMalta: Malta PoliceSpain: National Police (Policía Nacional), Spanish Regional Police of Catalonia-Mossos d'Esquadra (Mossos d'Esquadra)

Action day resultsClose to 150 police officers took part in the action, searching six premises in Stockholm, Sweden and two in Murcia, Spain. Five key suspects were arrested (three in Sweden and two in Spain).Several hundred thousand euros’ worth of valuables were seized, including luxury watches and cash. During the search of a property in Sweden, believed to have been used as an illegal gambling club, authorities also seized drugs prepared for resale and found signs of possible human trafficking.The suspects form the core of a local criminal network known for its use of violence and intimidation, allowing the group to secure revenues, enforce debts and control sections of the illegal gambling market in the Stockholm area.The investigation revealed a criminal business model combining:illegal gambling, with an estimated annual turnover of EUR 20 million;money laundering services for the network and other criminal groups;drug trafficking, reinforcing the group’s influence in local and regional markets.By offering services to other criminals, the group operated as a key facilitator within the wider criminal environment.From international to local: a coordinated multi-agency strategyThese latest actions are part of a wider, multi-agency strategy to systematically dismantle networks that harm local communities while relying on international criminal connections.Europol plays a central role in this approach by linking international intelligence with local enforcement actions. By connecting national authorities across borders, Europol ensures that information collected in one jurisdiction can be turned into operational impact in another – including on the streets of Stockholm.Authorities involved:Spain: Spanish National Police (Policía Nacional)Sweden: Swedish Police Authority (Polisen)

Apart from arresting three suspects linked to the international right-wing terrorist organisation 'The Base', the action days also led to the following seizures:a variety of weapons (including bladed weapons and two firearms) as well as ammunition;military tactical equipment used in training activities;accelerationist and supremacist material and documentation as well as ‘The Base’ organisation propaganda, neo-Nazi paraphernalia, and documentation glorifying other terrorist organisations.‘The Base’ on EU Terrorist ListIn July 2024, the Council of the European Union decided to add ‘The Base’ to the EU Terrorist List. This marked the first time the EU listed a far-right entity, indicating a shift in the threat landscape and counter-terrorism priorities. 'The Base' is known for its neo-Nazi militant accelerationist ideology and advocates achieving the goal of white supremacy through terrorism, creating an international network of paramilitary cells that self-train militarily in training camps, with the ultimate aim of carrying out attacks.The organisation operates as a decentralised and clandestine network of small operational cells, whose main ideological tenets are supremacism, militant accelerationism, and preparation for what they refer to as a ‘racial war’.Significant success against right-wing extremismInvestigators uncovered the existence of a cell consisting of three individuals. It is believed that the leader of this Spanish cell was in direct contact with Rinaldo Nazzaro, the founder of ‘The Base’, who recently called for the consolidation of cells expanded across several countries and the commission of selective attacks to collapse Western democratic institutions.The members were highly radicalised, basing their lifestyle on the principles of the terrorist organisation and ready to carry out attacks. They allegedly had already conducted several tactical training sessions using paramilitary techniques and equipment. The suspects allegedly also used social media to recruit new members, glorify violent actions by other terrorist organisations, and share accelerationist content with other users.In recent months, the suspects had hardened their radical discourse, encouraging violent actions, even openly stating that they were willing to carry out selective attacks for the cause. These acts and the observed stockpiling of weapons observed led law enforcement to arrest the three suspects.Europol’s supportEuropol's counter-terrorism experts provided analytical support and expertise throughout the operation, including intelligence packages, cross-match reports, and hit notifications. During the action days, Europol staff was deployed in Madrid and supported from Europol’s headquarters in The Hague.

Three servers were seized in Switzerland, along with the cryptomixer.io domain. The operation resulted in the confiscation of over 12 terabytes of data and more than EUR 25 million worth of the cryptocurrency Bitcoin. After the illegal service was taken over and shut down, law enforcement placed a seizure banner on the website.A service to obfuscate the origin of criminal fundsCryptomixer was a hybrid mixing service accessible via both the clear web and the dark web. It facilitated the obfuscation of criminal funds for ransomware groups, underground economy forums and dark web markets. Its software blocked the traceability of funds on the blockchain, making it the platform of choice for cybercriminals seeking to launder illegal proceeds from a variety of criminal activities, such as drug trafficking, weapons trafficking, ransomware attacks, and payment card fraud. Since its creation in the year 2016, over EUR 1.3 billion in Bitcoin were mixed through the service.Deposited funds from various users were pooled for a long and randomised period before being redistributed to destination addresses, again at random times. As many digital currencies provide a public ledger of all transactions, mixing services make it difficult to trace specific coins, thus concealing the origin of cryptocurrency.Mixing services such as Cryptomixer offer their clients anonymity and are often used before criminals redirect their laundered assets to cryptocurrency exchanges. This allows ‘cleaned’ cryptocurrency to be exchanged for other cryptocurrencies or for FIAT currency through cash machines or bank accounts.Europol’s supportEuropol facilitated the exchange of information in the framework of the Joint Cybercrime Action Taskforce (J-CAT), which is hosted at Europol’s headquarters in The Hague, the Netherlands. One of Europol’s priorities is to act as a broker of law enforcement knowledge, providing a hub through which Member States can connect and benefit from one another’s and Europol’s expertise.Throughout the operation, the agency provided crucial support, including coordinating the involved partners and hosting operational meetings. On the action day, Europol’s cybercrime experts provided on-the-spot support and forensic assistance.In March 2023, Europol already supported the takedown of the largest mixing service at that time, ‘Chipmixer’.Participating countries:Germany: Federal Criminal Police Office (Bundeskriminalamt); Prosecutor General’s Office Frankfurt am Main, Cyber Crime Centre (Generalstaatsanwaltschaft Frankfurt am Main, Zentralstelle zur Bekämpfung der Internet- und Computerkriminalität)Switzerland: Zurich City Police (Stadtpolizei Zürich); Zurich Cantonal Police (Kantonspolizei Zürich); Public Prosecutor‘s Office Zurich (Staatsanwaltschaft Zürich)Participating agencies:EuropolEurojust

France and Spain: disrupting a Chinese human trafficking networkConducted jointly by France and Spain, this operation targeted a Chinese organised crime group involved in trafficking human beings for sexual exploitation. The network, active for several years, coordinated sexual exploitation rings across France and multiple EU Member States. Members of the network rented apartments online for short terms, a modus operandi also known as ‘sex tours’ or ‘carousels’.Action day results (4 November):15 house searches conducted (9 in Spain, 6 in France);37 victims discovered: 34 victims identified and interviewed in France across 23 locations, of whom 8 accepted social support and 5 filed a complaint; 3 victims released in Spain; 10 suspects arrested (2 in Spain, 8 in France), of whom 7 were placed in pre-trial detention;EUR in 47 000 in cash and EUR 160 000 in bank accounts seized;Seizure of 126 mobile phones, including around 50 found at sexual exploitation locations, 1 car, 40 luxury items, 5 computers, and 3 tablets.This organised criminal group used multiple recruitment methods, targeting primarily Chinese women through call centres based in China, Spain, and France. Some victims were recruited in China and aware they would engage in prostitution but were misled about the exploitative conditions awaiting them. Others believed they were travelling to the EU for legitimate work before being coerced into sexual exploitation. Additionally, the criminal network also targeted vulnerable Chinese women who already were in the EU. Many of the hundreds of victims either had legally obtained tourist or labour visas, others were smuggled into the EU. Europol supported the operation by facilitating information exchange, providing analytical support, and coordinating cross-border cooperation.Italy and Romania: disrupting a Romanian human trafficking networkConducted jointly by Italy and Romania, this operation targeted a family clan of Romanian nationals based in Iasi, Romania. The organised crime group, operating for over 20 years, exploited young girls through coercion, violence, and psychological manipulation, and had strong ties to Albanian nationals involved in sexual exploitation in Rome, Italy.Action day results (18 November):25 house searches conducted (20 in Romania, 5 in Italy);EUR 20 000 in cash seized;19 Romanian suspects arrested; two persons put under judicial control;99 bank accounts allegedly used for laundering the criminal proceeds identified;7 swords, 1 axe, and 4 guns seized;10 real estate properties, 8 luxury cars, jewellery, 45 documents, 32 mobile phones, and 3 computers seized in Romania.The criminal network used the "lover boy" technique to recruit and groom victims, often starting at a young age, and forced them into prostitution in Rome. In the investigation timeframe alone, the criminal network is suspected of having generated an estimated profit of EUR 1.7 million.Europol supported this operation by facilitating information exchange, providing analytical support, and coordinating cross-border cooperation. Eurojust coordinated the international investigation by setting up a joint investigation team and organising several meetings at the Eurojust premises in The Hague.This investigation and the action day itself have been supported by the @ON Network funded by the EU Commission, led by the Italian Antimafia Investigation Directorate (DIA), who financially supported the operational meetings and the mutual deployment of investigators.Both operations underscore the persistent threat posed by criminal networks involved in human trafficking and the importance of international cooperation in combating these crimes. Human trafficking is a serious crime that abuses people’s fundamental rights and dignity. It involves the criminal exploitation of vulnerable people for the sole purpose of economic gain. Human trafficking is a modern form of slavery. It is often international in character and its victims are of both genders, all ages, and backgrounds. That is why it is so important to look beyond the stereotypes, enabling us to identify those who may be at risk and recognise the warning signs.Participating countries and agencies:France: Office central pour la répression de la traite des êtres humains (OCRTEH); Judicial Police - Montpellier Territorial Directorate (Direction Territoriale de Police Judiciaire de Montpellier)Spain: National Police - Central Unit for Immigration Networks and Document Fraud (Policía Nacional - Unidad Central de Redes de Inmigración y Falsedades Documentales (UCRIF))Italy: Italian State Police – Mobile Squad of Rome and the Central Operational Service (Polizia di Stato – Squadra Mobile di Roma e Servizio Centrale Operativo); Public Prosecutor’s Office Rome (Procura Distrettuale di Roma)Romania: Romanian Police - Brigade for Combating Organized Crime Ia?i (Poli?iei Român? - Brigada de Combaterea Criminalit??ii Organizate Ia?i)Eurojust

In time for the upcoming holiday and gifting season, a newly issued report on the distribution and dangers of counterfeit toys in the EU, titled ‘Cheating the toy world’, shows that criminal networks remain highly active and adept at counterfeiting toys. Intellectual property (IP) crime – and specifically the counterfeiting of toys – generates enormous financial losses for legitimate companies, undermines brand credibility and endangers economic development and the environment. Most concerningly, counterfeit toys expose children and other consumers to serious health and safety risks.Coordinated law enforcement action against fake toysThe annual effort to tackle this criminal phenomenon is codenamed Operation LUDUS – from the Latin word for ‘toy’. As counterfeit sales increase significantly around holidays, these coordinated law enforcement actions typically take place at the end of the year. Operations LUDUS IV and LUDUS V have led to the following results:Operation LUDUS V (2024-2025):8.2 million packages of toys seized, with an assessed value of EUR 8.7 million86 persons reported to judicial authorities194 persons reported to administrative or health authoritiesOperation LUDUS IV (2023-2024):8.4 million packages of toys seized, with an assessed value of 28.1 million125 persons reported to judicial authorities150 persons reported to administrative or health authoritiesThe seized counterfeit toys were mainly imported through regular shipping routes. Investigators determined that the main infringements were intellectual property rights violations, the presence of dangerous substances, and the absence of CE marking or EU conformity certificates.Many of the seized toys indicated various hazards and risks. Completely evading the EU’s strict rules on products intended for children, these fake toys can cause asphyxiation, suffocation, drowning, cuts or burns, and expose children to chemical substances. Some pose choking hazards and could be ingested, while others may damage children’s hearing or sight.Fake toys can pose serious health hazards…Within the European Union, strict regulatory standards govern the design, production and sale of toys and games. Criminal actors involved in counterfeit toys evade such criteria, which are designed to protect the health and safety of consumers, especially children. Poor build quality and the use of low-grade toxic materials can cause severe and even life-threatening injuries to children playing with fake toys.This is especially concerning in counterfeit toys intended for baby mouthing, as infants are directly exposed to these substances. Other dangers come from electronic toys whose sound levels may exceed legal decibel limits, causing irreversible hearing loss. Many toys also rely on electrical components and other combustible materials, such as batteries, which may not conform to the relevant regulations.…and cause major economic losses for the EUAccording to the report issued today, the toy sector has the highest average sales loss from counterfeit goods in the EU. With an estimated 8.7% of total sales, this represents around EUR 1 billion in lost sales and 3 600 fewer people employed in the industry. In addition, the tax evasion linked to this crime area significantly affects the EU’s economy.For all these reasons, customers are warned to beware of fake toys and other products intended for children. Buying from reputable retailers provides accountability, peace of mind and a warranty.A coordinated approach between countries and agenciesOperation LUDUS is a recurring operation that cracks down on the trafficking of counterfeit toys. It involves law enforcement and customs authorities from most EU countries and relies on close collaboration with the private sector.The operation involves a dedicated analytical preparation phase, followed by an operational phase in which all participating countries perform inspections and raids to detect illegal shipments and storage places. In certain operations, raids follow investigations that began on e-commerce platforms and marketplaces. Collaborating with the private sector enables better detection and identification of counterfeit toys, as well as the subsequent seizure of packages that are often distributed among multiple shipments.Apart from organising and coordinating operational activities, Europol also liaised with the private sector. This included obtaining information on specific products on the market and analysing the data collected throughout the operation.EUIPO supported the logistical organisation of the operation and facilitated collaboration between rights holders and enforcement authorities through the Intellectual Property Enforcement Portal (IPEP). This collaboration enabled the private sector to share relevant information with enforcement authorities using IPEP’s ‘alert and interesting cases functionalities’, while authorities could request data from the private sector to address suspicious cases. As a strategic and financial partner, EUIPO strengthened cross-sector collaboration, reflecting its commitment to fostering a robust, inclusive, diverse and sustainable IP ecosystem that works for everyone.OLAF played a key role by coordinating efforts among the customs authorities of participating EU Member States.Participating agencies:European Union Agency for Law Enforcement Cooperation (Europol; organiser and coordinator); European Union Intellectual Property Office (EUIPO; strategic and financial partner); European Anti-Fraud Office (OLAF; coordinating partner)Participating countries*:Albania, Austria, Belgium, Bulgaria, Colombia, Croatia, Cyprus, Czech Republic, France (operational co-leader LUDUS IV), Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Netherlands, North Macedonia, Poland, Portugal, Romania (operational co-leader LUDUS IV&V), Slovak Republic, Spain (operational co-leader LUDUS IV&V), Sweden, United Kingdom, United States of America*24 countries participated in LUDUS IV; 19 countries participated in LUDUS V

On 19 November 2025, a coordinated effort led by Bulgarian authorities and supported by Europol, resulted in the dismantling of a criminal network involved in large-scale trafficking of cultural goods across Europe and beyond. This operation was conducted under the framework of a Europol operational taskforce. The action day involved law enforcement and judicial authorities from Albania, France, Germany, Greece, Italy, and the United Kingdom. The operational actions during this day were coordinated from coordination centres in Sofia, Bulgaria, and at Eurojust. Investigative activities are still ongoing.The investigation began after a house raid conducted in 2020 in Bulgaria, where authorities seized about 7 000 cultural artifacts with inestimable historical and monetary value. These items, primarily Greco-Roman and Thracian antiquities, are of immense value due to their uniqueness and historical significance. The lack of clear provenance documentation for many of these items, established by the Bulgarian authorities at the time, raised suspicions of illegal acquisition. Since their seizure, the artifacts have been housed in the Bulgarian National History Museum in Sofia pending further investigation.Results from the action day on 19 November 202535 arrests in Bulgaria131 searches including houses, vehicles and bank safes searched (1 in Albania, 120 in Bulgaria, 3 in France, 3 in Germany, 4 in Greece)Seizures include over 3 000 artefacts (antique golden and silver coins and other antiquities) with an estimated value of over EUR 100 million, artworks, weapons, documents, electronic equipment, over EUR 50 000 in cash, and investment goldThe primary High-Value Target (HVT) in this case is suspected of financing illegal excavations across Bulgaria and neighbouring Balkan countries. Local looters, allegedly working for middlemen acting on behalf of the HVT, are believed to have been involved in the illicit operations. The art collection seized in 2020 includes unique items, some of them dating back to 2000 BC, such as masks, military equipment, jewellery, vases, rhytons and cups from Thracian and Greco-Roman civilizations. Most of the artefacts had no provenance documentation, while only a few had questionable ones issued by auction houses and art galleries worldwide, primarily based in France, Germany, the United Kingdom, and the United States.Europol taskforce to connect the dots across bordersSince June 2024, at the initiative of the Bulgarian authorities, Europol established an operational taskforce to facilitate information exchange, coordination, and analytical support. The work of the taskforce led to the identification of links between individuals, based in different countries as well as the location of other artefacts believed to have been trafficked by members of the network. New investigations were also initiated in some of the eight countries taking part in the taskforce. On the action day, Europol deployed two experts to Sofia, Bulgaria, to support the coordination of the activities across borders and to provide analytical support and expertise.Balkan legacy: a breeding ground for art theftThe Balkan region and Italy, steeped in ancient history, are home to invaluable Greek and Roman archaeological treasures that have long attracted criminal networks. These criminal actors, often composed of local cells, engaged in looting, theft, and other cells, laundering stolen artifacts through the art market. The art market's unique vulnerability to criminal activities is exacerbated by high demand from art collectors and those seeking to launder illicit funds.Governments face challenges in combating illegal excavations due to the art market's complexities and the difficulties in verifying the provenance of cultural and art objects. Criminal networks exploit these gaps, bypassing due diligence checks to introduce looted artifacts, including those from conflict zones like Syria and Iraq, into the market. Traffickers have developed methods to sell and launder these illegally acquired artifacts, posing a significant threat to cultural heritage preservation.International cooperation and information exchange among national authorities are vital to detect illegally obtained antiquities, dismantle art trafficking networks, and preserve cultural heritage for future generations.

Europol’s operational push: Target Group SanctionsEuropol has reinforced its operational support to EU Member States with the establishment of a ‘Target Group Sanctions’, a new team within its European Financial and Economic Crime Centre dedicated to identifying and disrupting criminal networks involved in sanctions evasion.Building on the work of Operation OSCAR launched in 2022, the Target Group Sanctions uses Europol’s intelligence, analytical and financial-tracing capabilities to help investigators uncover illicit trade routes, track financial flows and detect related criminal activities, such as money laundering, customs fraud and document forgery.The new capability has already provided direct support to several investigations into suspected sanctions evasion across the EU.Europol and OLAF launch ‘Project Transporter’To further reinforce the EU’s response to sanctions circumvention, Europol and the European Anti-Fraud Office (OLAF) have launched a joint initiative: Project Transporter. This project focuses on vehicle exports to third countries for possible onward transfer to Russia and Belarus.EU Member States have reported a sharp increase in these shipments, often supported by forged paperwork, complex diversion routes and money laundering indicators pointing to organised, commercially driven attempts to evade EU measures.Project Transporter will bring together specialist investigators from customs, police and financial crime services to strengthen information exchange, share investigative techniques and deepen operational coordination across Europe. The initiative complements Europol’s expanded operational role through Target Group Sanctions.By combining Europol’s analytical capabilities with OLAF’s expertise on customs and EU expenditure fraud, Project Transporter aims to provide stronger, more coordinated support to Member States tackling sanctions evasion. 

Three awards were given out, each decided by a different group of voters:the international law enforcement community represented at Europol’s headquarters,members of the public,and the Heads of Communication of the European law enforcement authorities.The winners of Capture25The Europol Community Vote by the Liaison Bureaux went to Johan Jacob Kleist from Denmark with his photo of a ‘police officer patrolling beneath the northern lights in the freezing winter’. This image was the favourite of the 300 liaison officers from around the world, representing the EU Member States and Third Parties at Europol’s headquarters in The Hague.The Public Vote was awarded to Cláudio Alexandre from Portugal with his image showing ‘maintaining public order during the CIREX 2024 exercise’. His photograph received the most votes in the online ballot advertised on our social media channels, which was open to anyone who wanted to participate.Dmytro Haiduk from Ukraine entered the favourite picture of the Heads of Communication of the European law enforcement authorities, who were asked to cast their vote during the annual “European Law Enforcement Communicators Conference”. His winning image shows ‘patrol officers rescuing people from a fire after shelling by Russian forces’.The three winners win a trip for two to The Hague, including a visit to Europol’s headquarters. Their images also feature in Europol’s 2026 calendar and will be used in other Europol publications.Do you want to take part in next year's photo competition? Sign up via the subscription form on this page to receive an update when the 2026 edition opens!

Between 10 and 14 November, Europol, in collaboration with the European Union Intellectual Property Office (EUIPO) and the Spanish National Police (Policía Nacional), organised an "Intellectual Property Crime Cyber-Patrol Week”. A total of 30 investigators participated in this operation hosted at the EUIPO headquarters in Alicante, Spain, where they used advanced Open-Source Intelligence Techniques (OSINT) and cutting-edge online investigative tools to identify potential intellectual property infringements.Overall, the Cyber-Patrol Week led to:69 sites identified and targeted;25 illicit IPTV services referred to the participating crypto service providers for disruption;Investigations on 44 additional sites.The combined traffic for the 69 targeted sites is estimated at approximately 11 821 006 annual visitors. Investigators traced cryptocurrency valued at around USD 55 million (over EUR 47 million) through various accounts associated with these services. Several of the services remain under continued investigation by both public and private entities.Criminals shift to using cryptocurrency for paymentsThe Cyber-Patrol Week focused on the growing trend of criminals moving away from traditional payment systems and rather relying on cryptocurrency payments - a method they incorrectly believe offers increased anonymity – when offering their illegal services. To counter this, the Cyber-Patrol participants relied on a novel strategy: investigators used cryptocurrencies to purchase services, which allowed them to identify illicit actors. These were then reported to partners, which includes major crypto exchanges and specialised tooling companies.This approach allows to hit ‘pirates’ - as intellectual property infringers are often referred to - where it hurts them the most: their money. By identifying, tracing, and successfully shutting down the crypto accounts of illicit services, the criminal revenue stream is disrupted. This effort is vital for protecting global economies and creators.Innovation and exchange of best practicesThis multidisciplinary and multi-agency enforcement operation aimed to map active targets, develop actionable intelligence packages, and facilitate the exchange of best practices. This initiative not only promotes innovative technological solutions but also reinforces cooperation with the private sector, consequently enhancing enforcers' ability to detect and neutralise emerging threats.More than 15 countries and private sector organisations joined Europol in this collaborative effort, with a particular emphasis this year on tackling illegal streaming services and various types of online intellectual property infringement. Their combined expertise and resources yielded high-value intelligence, supporting the fight against intellectual property crime.This approach exemplifies the European Union's commitment to an integrated, cross-border strategy where international collaboration and technological innovation are key pillars. By working together, intellectual property crime in a global digital landscape can be better anticipated and addressed.Events such as this Cyber-Patrol Week provide a unique platform for EU authorities responsible for combating intellectual property crime to collaborate and strengthen operational cooperation in pursuit of a safer Europe.

Catherine De BolleEuropol Executive DirectorChildren and young people deserve to be safe and supported both online and offline. Help4U gives them - and those who protect them - clear, reliable information and access to help when it is most needed. This platform is a tangible example of how European cooperation can make a real difference for victims.Professor Babak AkhgarDirector of CENTRICWe are proud to work with Europol and our European law enforcement agency partners to build Help4U — a platform that places young people’s safety, privacy, and trust at its core. By combining digital innovation with the voices and experiences of young people themselves, Help4U offers a safe, accessible way for them to find help and be heard. This initiative represents how research, technology, and co-creation can come together to protect children and strengthen Europe’s collective response on harm against children.Built with young people in mindWhat sets Help4U apart is its strong focus on accessibility. The platform lets young people choose how they want to receive support — whether by reading, chatting, or locating a nearby service. All content is written in clear, age-appropriate language so it is easy to understand and use.Finding the right help, however, is not always straightforward, as navigating the range of available services can be challenging. For young people who have been victimised, the search can feel overwhelming, especially when they are distressed, feeling vulnerable, or unsure where to turn. Many may not feel ready to speak to someone directly and will first look for information online. Providing accessible, accurate resources at that moment is crucial: it empowers them to take the next step towards getting the support they need.Help4U also connects young people to professionals who can listen, advise, and guide them towards safety and recovery.A Europe-wide effortHelp4U began as a pilot project between Belgium, Germany, Ireland, the Netherlands and Slovenia, has since expanded to also include Bulgaria, Cyprus, Croatia, Greece, Hungary, Italy, Portugal, Spain and Romania, with more countries expected in 2026 and beyond.Help4U was developed in close collaboration with experts from psychology, education, IT, data protection, law enforcement, and academia. By uniting national efforts under one platform, Help4U strengthens Europe’s response to online sexual abuse and ensures that support reaches those who need it most.Because everyone deserves to be safe - and heardIf someone is making you feel uncomfortable online, sharing your photos without permission, or asking for things that don’t feel right - Help4U is here for you.Help4U is a safe place to start - to find answers, reach out, and take back control.Visit the Help4U website to learn more, get advice, or ask for help.Participating authoritiesBelgium: Federal Judicial Police (Belgische federale gerechtelijke politie / Police judiciaire fédérale belge)Bulgaria: General Directorate for Combating Organized Crime (?????? ???????? „????? ? ?????????????? ???????????“)Croatia: Ministry of the Interior (Ministarstvo unutarnjih poslova)Cyprus: Cyprus Police (????????? ??????)Greece: Hellenic Police (???????? ?????????)Germany: Federal Criminal Police Office (Bundeskriminalamt)Hungary: National Bureau of Investigation (Nemzeti Nyomozó Iroda)Ireland: An Garda SíochánaItaly: Italian National Police (Polizia di Stato)The Netherlands: National Police (Politie)Portugal: Public Security Police (Polícia de Segurança Pública), Judicial Police (Polícia Judiciária)Romania: General Inspectorate of Romanian Police (Inspectoratul General al Poli?iei Române)Slovenia: Police (Policija)Spain: Guardia Civil (Guardia Civil), National Police (Policía Nacional)

Conducted on 13 November 2025, this operational action by the European Union Internet Referral Unit (EU IRU) involved the referral of thousands of URLs leading to dangerous and illicit online material. This includes around 5 408 links to jihadist content, 1 070 links to violent right-wing extremist and terrorist content, and 105 links to racist and xenophobic content.This joint action highlights the complexity of tackling terrorist, racist and xenophobic content online on gaming and gaming-adjacent platforms. Creation and dissemination processes are layered and often affect several platforms. For instance, content may be recorded within an online game (or its chat function), altered with violent extremist jargon, suggestive emojis, chants, or music, and then disseminated on a mainstream social media platform.‘Gamification’ of highly dangerous content across platformsIn the weeks leading up to the action day, participating experts combed through a variety of platforms widely used by youngsters and adults alike. Users of such gaming and streaming platforms can encounter a variety of dangerous and violent content.For example, perpetrators re-enact terrorist attacks, school shootings, or execution scenes in 3D gameplay, edit the video with chants or suggestive emojis, and disseminate it on various commonly used social media platforms for even wider reach. Other gaming-related platforms intended for streaming gameplay are misused to recruit minors into various violent extremist and terrorist groups or to livestream real attacks and even suicides.The content targeted during the Referral Action Day was found across several kinds of platforms. Some allow players to broadcast their gameplay in real-time and interact with their community via live chat, while others host video-on-demand. Illicit content was also identified on community platforms intended to facilitate the exchange of tips, news, and discussions about video games. Lastly, there are hybrid or specialised platforms that combine streaming, community features, and gaming purchase options. Many accounts on these platforms may not immediately be recognisable as being linked to problematic content, while some even feature usernames and profile pictures with references to infamous terrorists.Publication of EU IRU Transparency ReportThe EU Internet Referral Unit (EU IRU) prevention activities are focused on three key areas: monitoring and analysis of terrorist content online, referrals, and public-private partnerships. The forthcoming Transparency Report highlights the activities undertaken in these areas in 2024 and summarises the Unit’s efforts to reduce public access to terrorist content online. Additionally, the report outlines the EU IRU’s activities in support of the implementation of the Regulation on addressing the dissemination of terrorist content online.Several investigations as a starting pointThis Referral Action Day stems from law enforcement authorities across Europe noticing a variety of gaming and gaming-adjacent platforms being misused as venues to radicalise and spread terrorist content online. This abuse is also reflected in several investigations supported by Europol's European Counter Terrorism Centre. Leading up to this action day, Europol’s experts organised several operational meetings, and facilitated the exchange of operational information and best practices among participating countries. 

The action day led to the following results:6 arrests (2 in Germany and 4 in France)11 property searches (4 in Germany and 7 in France)Seizure of firearms, electronic devices and cashFreezing of bank accounts The network is suspected of facilitating migration on an ongoing basis from Türkiye via Serbia, Austria, Germany and France. Investigators believe that the criminal organisation earned more than EUR 4 million through these illicit activities. Irregular migrants were transported in disregard for their safety, with smugglers using dangerous concealment methods and engaging in reckless driving to ensure escape and avoid detection.Lives at riskThe criminal network had a hierarchical structure, with specific roles assigned to the members, to ensure the success of the illicit activities. Investigators believe that the gang had hired more than 20 drivers to carry out the transfers. It is also a plausible suspicion that these suspects are linked to a smuggling incident that resulted in the death of a migrant on 13 July 2023 in Germany. That day, a driver caused an accident while smuggling people into Europe. When the police ordered him to stop the bus, he tried to escape. One woman, a migrant, died in the accident, and several others were seriously injured. The driver was convicted of murder. The criminal network under investigation is suspected of having taken the woman back to Serbia by car, the country from which she had begun her journey to Germany.The joint operation on 13 November 2025 was the result of months of coordinated intelligence-sharing and investigative work. Europol supported the national authorities by facilitating the coordination among the affected countries and the exchange of operational information, and by delivering operational analysis reports. Additionally, on the day of the operation, a specialist was deployed to Germany with a mobile office to deliver on-the-spot support to investigators.A priority for EuropolEuropol’s contribution to this case serves as an example of how migrant smuggling remains a priority for Europol. The crime is increasingly marked by violence and brutality, leading to significant loss of life and occasionally targeting rival criminals, law enforcement, and the migrants themselves.In addition, migrant smuggling continues to be an attractive and highly profitable criminal activity on a large scale. It does not only involve facilitating the movement of irregular migrants but also assisting them in fraudulently regularising their stay. The following authorities participated in the investigation:Germany: Federal Police Office for Crime Control (Bundespolizeiinspektion Kriminalitätsbekämpfung Halle)France: National Directorate of the Border Police (Direction Nationale de la Police aux Frontières, OLTIM)

Criminal network busted in Central and Eastern EuropeOn 11 November 2025, law enforcement targeted an international criminal network supplying key precursors used to produce methamphetamine and operating across Europe. Authorities from Bulgaria, Czechia, Hungary, Romania and Moldova, supported by Europol, participated in the investigation. Eurojust set up and funded the joint investigation team between Czech, Romanian and Moldovan authorities allowing them to track the flow of illicit substances and communications and collect evidence for the prosecution of the criminal group. The action day led to:16 arrests (1 in Bulgaria, 11 in Czechia, 2 in Hungary and 2 in Moldova)18 searches (3 in Czechia, 2 in Hungary, 1 in Romania and 12 in Moldova)3 clandestine drugs laboratory dismantled in Hungary and MoldovaSeizure of synthetic drugs and chemical materials to produce methamphetamine, including over 5 kilos of methamphetamine, 40 kg of ephedrine-containing pills, 50 litres of toluene, 0.5 kg of phosphorus, 280 kg of caustic soda, 70 kg of chemical residues from methamphetamine production, and specialized production equipmentSeizure of two vehicles used for transporting drugsSeizure of electronic devices and cashThe suspects were involved in every stage of the drug production chain: they imported chemicals, produced synthetic drugs and smuggled them in luggage on airplanes and in hidden compartments of vehicles to avoid detection by authorities. Drugs found in investigation.   Property of the precursor network.  The following authorities took part in the investigation: Bulgaria: General Directorate Combating Organized Crime (?????? ???????? "????? ? ?????????????? ???????????)Czechia: National Police (Policie ?eské republiky), National Drug HQHungary: National Bureau of Investigation, Drug Enforcement Office (Készenléti Rend?rség Nemzeti Nyomozó Iroda, Kábítószer B?nözés Elleni Hivatal)Romania: National Police (Poli?ia Român?)   Moldova: Directorate of cross-border crime investigation of General Inspectorate of Border Police (Inspectoratul General al Poli?iei de Frontier?), Prosecutor’s Office for Combatting Organized Crime and for Special Cases (Procuratura pentru Combaterea Criminalit??ii Organizate ?i Cauze Speciale)Precursors made in China, distributed across EuropeIn an unprecedented operation in the EU, authorities seized over 40 tonnes of precursors intended for the production of MDMA, amphetamine and methamphetamine in Hungary and Germany. The investigation spanned over two years, with the most recent action taking place on 4 and 5 November 2025, resulting in:4 arrests8 property searchesSynthetic drugs seizedPrecursors and chemicals seizedVehicles, jewellery and electronic devices seizedEUR 67 000 in cash seized Seizure taking place in Hungary. The investigation revealed that the precursors were shipped from China to the ports of Hamburg and Rotterdam. There, they were collected by members of the criminal network and sent to Hungary for further distribution. The perpetrators operated across many European countries and had the capacity to supply large quantities of products and chemicals, enabling drug production on a massive scale. The criminal network targeted in this operation was linked to several shipments of precursor chemicals seized between 2023 and 2025. During this period, authorities intercepted almost 32 tonnes of precursors in Hungary and more than 10 tonnes in Germany.The following authorities took part in the investigation:Hungary: National Police (Rend?rség)Germany: Joint Precursor Monitoring Unit (Customs/Police) at the BKA, Customs (Zoll)Netherlands: Netherlands Police (Politie), FIODSynthetic drugs: a growing threatEuropol played a key role in both operations by providing operational and analytical support to national investigators. Additionally, on 6 and 7 November 2025, a Europol expert was deployed to assist Hungarian authorities in the field, providing real-time analysis of the data as it was gathered.The production and trafficking of synthetic drugs have increased over the past years, as both the demand and supply of synthetic drugs are high. This threat is expected to further escalate. 

Today marks ten years since one of the deadliest terrorist attacks in recent European history was carried out in Paris - at the Stade de France, in the streets and inside the Bataclan concert hall. On 13 November 2015, 132 people lost their lives and many more were injured during what became a night of profound tragedy for France and for Europe as a whole. We honour the victims, their families, and all those whose lives were forever changed. We also acknowledge the efforts and commitment of the law enforcement officers who worked side by side across borders and agencies to identify the perpetrators and ensure they were brought to justice.The months that followed witnessed an unprecedent wave of terrorist attacks across Europe. Today, we also remember all those who lost their lives in these acts of violence: the victims of the attacks in Brussels, Nice and Berlin, as well as those who felt victims to subsequent attacks in Austria, Belgium, France, Germany, Spain and Sweden. From Charlie Hebdo to Brussels, Nice, Berlin, and Stockholm, each attack serves as a stark reminder that terrorism remains a persistent and evolving threat. Terrorism is a threat that no country can confront alone.On the occasion of today’s day of remembrance, Europol’s Executive Director Catherine De Bolle, stated: Ten years later, we have not forgotten anything. The victims, the dignity of the families, the relatives and our bruised communities. Today, our thoughts are with them. We pay tribute to them and to the many acts of solidarity and courage of citizens, and first-responders. The fight continues, and we're more committed than ever to fighting terrorism.In response to the terror wave of 2015 and 2016, Europol and EU Member States strengthened their collective preparedness to prevent, disrupt, and mitigate terrorist plots. Counterterrorism and the prevention of violent extremism are not only about stopping attacks, they are about protecting communities, building resilience and addressing the drivers of radicalisation before they turn into violence.These events marked the beginning of a new phase in Europe’s security landscape. Organised terrorist networks, returning foreign terrorist fighters and online radicalisation demonstrated that the threat had become increasingly transnational and complex. In response, the European Counter Terrorism Centre was established in January 2016 within Europol to reinforce coordination, strengthen investigative links, support operational activities and assess emerging risks. In addition, the EU Internal Referral Unit was also established within Europol to monitor and address terrorist propaganda online.Today, as we commemorate the victims of the Bataclan attack and all other victims of terrorism across Europe, we reaffirm our shared commitment to safeguarding our societies and upholding the values that terrorism and violent extremism seek to undermine. Then, now and always, European authorities remain united in their determination to safeguarding citizens and protecting our societies from those who seek to undermine them. 

Between 10 and 13 November 2025, the latest phase of Operation Endgame was coordinated from Europol’s headquarters in The Hague. The actions targeted one of the biggest infostealers Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all of which played a key role in international cybercrime. Authorities took down these three large cybercrime enablers. The main suspect for VenomRAT was also arrested in Greece on 3 November 2025.The infrastructure dismantled during the action days was responsible for infecting hundreds of thousands of victims worldwide with malware. Operation Endgame, coordinated by Europol and Eurojust, is a joint effort between law enforcement and judicial authorities of Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom and the United States to tackle ransomware enablers. More than 30 national and international public and private parties are supporting the actions. Important contributions were made by the following private partners: Cryptolaemus, Shadowserver and RoLR, Spycloud, Cymru, Proofpoint, Crowdstrike, Lumen, Abuse.ch, HaveIBeenPwned, Spamhaus, DIVD, Trellix and Bitdefender.The coordinated actions led to:1 arrest in Greece11 locations searched (1 in Germany, 1 in Greece, and 9 in the Netherlands)Over 1 025 servers taken down or disrupted worldwide20 domains seizedEndgame doesn’t end here – think about (y)our next moveThe dismantled malware infrastructure consisted of hundreds of thousands of infected computers containing several million stolen credentials. Many of the victims were not aware of the infection of their systems. The main suspect behind the infostealer had access to over 100 000 crypto wallets belonging to these victims, potentially worth millions of euros. Check if your computer has been infected and what to do if so at politie.nl/checkyourhack and haveibeenpwned.comThere were actions aimed at criminal services and their criminal users. These users were directly contacted by the police and asked to share relevant information regarding infostealers via the Operation Endgame Telegram channel. In addition, the failing criminal services are exposed via the Operation Endgame website.Command post at Europol to coordinate the operational actionsEuropol facilitated the information exchange and provided analytical, crypto-tracing and forensic support to the investigation. To support the coordination of the operation, Europol organised and coordinated calls with all the countries as well as an operational sprint at its headquarters.Over 100 law enforcement officers from Australia, Canada, Denmark, France, Germany, Greece, the Netherlands and the United States supported the coordination of the operational actions from the command post at Europol. The command post facilitated the exchange of intelligence on seized servers, suspects, and the transfer of seized data. Eurojust also assisted with the execution of a European Arrest Warrant and European Investigation Orders.Participating authoritiesEU Member States:Denmark: Danish Police (Politi)France: National Police (Police Nationale); Public Prosecutor Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Paris Police Prefecture (Préfecture De Police de Paris)Germany: Federal Criminal Police Office (Bundeskriminalamt), Public Prosecutor General's Office Frankfurt am Main – Cybercrime Office;Greece: Hellenic Police (???????? ?????????)Lithuania - Lithuanian Criminal Police Bureau (Lietuvos Policijos Departamentas)Netherlands: National Police (Politie), Public Prosecution Office (Openbaar Ministerie)Non-EU Member States:Australia: Australian Federal PoliceCanada: Royal Canadian Mounted Police; Sûreté du QuébecThe United States: Federal Bureau of Investigation, The Defense Criminal Investigative Service, United States Department of JusticeThe press release was updated following publication to correct the involved partners in the operation.

On 12 November 2025, Europol supported a German-led investigation targeting a group of mercenaries hired by a criminal network to kidnap the leader of a rival drug trafficking gang. The operation involved law enforcement authorities from Denmark, France, Latvia and the United Kingdom.The coordinated action focused on Latvian nationals, some of them with a background in the French Foreign Legion. These highly trained individuals were equipped with professional gear and were active on behalf of an organised crime group. They were contracted to abduct the leader of an Albanian drug trafficking network, who is suspected of orchestrating the theft of several tonnes of cannabis worth millions of euros.On the action day, four individuals were arrested in Denmark, France, Latvia and the United Kingdom, while other two, who had been arrested in October 2024 in Germany, have already been convicted by court. Europol played a crucial role by facilitating information exchange, ensuring operational coordination and providing analytical support. On the action day, Europol deployed an expert to Nice, France, to facilitate the real-time exchange of information and cross-check operational information against Europol’ s databases, providing immediate leads to investigators in the field.Mercenaries for hireThis operation is linked to the 'Violence-as-a-Service' phenomenon, in which perpetrators offer their services to commit violent acts on behalf of other criminal syndicates. In this particular case, highly trained specialists are hired by organised crime groups to carry out violent acts. This modus operandi is increasingly detected in various operations linked to serious and organised crime. Investigating the perpetrators' activities underscores the elevated level of this service, as it often involves the use of former special forces members.A few of the suspects in this case are former French Foreign Legion soldiers. This represents an alarming trend emerging from the war in Ukraine. Former combat-trained soldiers, returning from the front, might make use of their skills for organised crime, posing a potential threat. As the war in Ukraine continues and potentially intensifies in its aftermath, Europe may face an increased number of these highly trained individuals engaging in criminal activities. It is crucial to monitor this development and prepare for the potential security challenges it presents.Participating authorities:Denmark: Copenhagen Police/ Københavns Vestegns PolitiGermany: State Criminal Police North Rhine-Westphalia (Landeskriminalamt)France: National Police (Police Nationale) / Service Interdépartemental de la Police Judiciaire des Alpes-Maritimes, Nimes, Office central de lutte contre le crime organisé /OCLOLatvia: State Police of Latvia (Latvijas Valsts policija)United Kingdom: Metropolitan PoliceThis press release was updated following publication to implement last-minute text changes.

Overall, the results of the action include:22 296 officers from law enforcement and labour and tax authorities participating in the action;194 995 entities checked (including 73 218 persons, 11 815 locations, 26 412 vehicles and 83 958 documents)93 persons suspected of trafficking human beings identified (of which 92 for labour exploitation)54 persons arrested for various crimes (of which 44 for labour exploitation)404 potential victims of human trafficking identified (of which 393 potential victims of labour exploitation)341 new investigations in various crimes launched (of which 43 in labour exploitation)The objective of this recurrent action is for authorities to focus on the forms of labour exploitation most pertinent or widespread in their respective countries. Inspections were conducted across a wide array of sectors, including catering, gastronomy, food delivery, food and meat processing, beauty services, domestic healthcare, logistics and distribution, agriculture, construction, and mining.Several countries have confirmed various modus operandi in trafficking in human beings for agricultural and labour exploitation. These include discrepancies between payments and employees' working hours, violations of minimum wage laws, undeclared work, illegal schemes operated by temporary work agencies, breaches of maximum working hours, poor housing conditions provided by employers, the employment of minors, debt bondage, working without permits, and the retention of ID and travel documents. Additionally, non-EU nationals may use look-alike documents, falsified passports, and forged residence permits. In general, cases of labour exploitation and forced labour are significantly underreported and do not reflect the true extent of the issue.Standout cases from across EuropeSpainDuring a joint action on an agricultural property in Seville, a Nepalese victim of trafficking in human beings for labour exploitation was identified following an inspection at a kebab restaurant. The victim was found living in inhumane, unsanitary, and overcrowded conditions. An investigation has been launched, and the victim has been transferred to a police station for assistance and placed in a shelter. Additionally, labour authorities initiated three investigations involving five workers found working without labour contracts, two of whom were illegal immigrants in Spain. Opening to living quarters Conditions found in Spanish case HungaryFollowing a notification from the victim assistance network, an investigation into suspected forced labour led to the discovery of seven Hungarian citizens, including a 15-year-old, working in inhumane conditions on local pig farms. The victims were forced to perform physically demanding tasks without contracts, pay, or proper accommodation. The farm owner was arrested and detained, and the victims were rescued. The investigation was conducted jointly by law enforcement and labour authorities.In another ongoing investigation into a human trafficking ring recruiting vulnerable individuals from Romania to work in a paper/waste selection factory in Hungary, two additional suspects were arrested in Budapest. They are accused of accommodating victims and forcing them to work in poor conditions. A victim was found and interviewed during a search of the suspects' residences, which revealed isolated sheds with poor living conditions. This case involves a joint investigation team between Hungary and Romania, with a total of 13 suspects arrested to date. Victims were promised better working conditions but were instead subjected to poor conditions, document confiscation, constant surveillance, and withheld salaries.UkraineUkrainian authorities have halted the illegal labour exploitation of 13 Uzbek citizens at an agricultural enterprise in the Kyiv Oblast. Four members of a criminal group (two Chinese citizens, one Ukrainian, and one Uzbek citizen) have been arrested and charged with trafficking in human beings.Multidisciplinary approach and Europol’s supportIn line with previous editions, the operation emphasised a multidisciplinary approach. The efforts of national and regional police forces, border guards, tax authorities, labour authorities, and labour inspectorates were coordinated and supported by Europol and the European Labour Authority. Several joint inspections involving enforcement authorities from different countries were facilitated. Consequently, the operation benefited from improved information flow and enhanced awareness of human trafficking indicators. This close collaboration among various authorities and law enforcement agencies significantly contributed to the success of the action week in combating labour exploitation.Trafficking in human beings: look beyondTrafficking in human beings (THB) involves forcing or duping vulnerable individuals into another country, for the sole purpose of criminal profit. It can happen anywhere, in many different forms, and affects people of all ages, backgrounds, and genders.Learn to spot the signs of THBParticipating countries:Albania, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Kosovo*, Latvia, Lithuania, Luxembourg, Netherlands, North Macedonia, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland, Ukraine, United Kingdom* This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.Participating agencies:Europol, European Labour Authority

Today, 5 November 2025, Europol and UEFA have renewed and extended their Memorandum of Understanding, focused on preventing and combating crime while protecting the integrity of European football. The memorandum was signed at UEFA headquarters in Nyon by the Executive Director of Europol, Catherine De Bolle, and by the President of UEFA, Aleksander ?eferin. Europol and UEFA committed to cooperate in joint activities and projects. The partnership will enhance joint investigations, information sharing, and expert support for UEFA’s 55 member associations. During her visit to UEFA, Europol’s Executive Director also joined the meetings of the UEFA Governance and Compliance Committee and the UEFA Stadium and Security Committee which were taking place on the same morning. She exchanged views with the members of the committees dealing with many of the topics covered in the new Memorandum of Understanding.Wider scope of cooperation between the organisationsThe agreement builds on the past cooperation between the institutions, especially in the fight against match-fixing, while broadening the scope of cooperation into other organised crime-related threats. The cooperation focuses on information exchange and knowledge sharing in the areas of major football events, sports corruption, match-fixing and money laundering, racism, xenophobia and violent extremism as well as illegal activities around the unlawful streaming or transmission of audiovisual content. Cooperation extends to the detection of suspicious transactions and activities in the areas of transfers of football players, investment in football clubs, trading of football-related financial assets, and sports betting. Awarding and organising of sports competitions can also be abused by criminals to launder illicit proceeds or for corruption purposes and are therefore also among the possible areas of cooperation.Catherine De BolleEuropol Executive DirectorFootball provides a universal language that transcends borders, fostering a shared passion among diverse groups of people. At the same time, we have to note the criminal abuse of this wonderful sport: as with every major societal movement, football is vulnerable to criminal exploitation. Europol stands ready to support UEFA and all competent national authorities in safeguarding the integrity of this beautiful game.Aleksander ?eferinUEFA PresidentAs the governing authority for European football, we collaborate closely with European institutions and agencies, including Europol, to safeguard the integrity, credibility, and long-term sustainability of the game at every level. Through our partnership with Europol, we remain committed to enhancing our coordinated actions to prevent and tackle the criminal exploitation of our sportAbout UEFAUEFA is the governing body of European football and a not-for-profit organisation which supports and ensures the world’s most popular sport continues to thrive at all levels across its 55 member associations. As part of its commitment, UEFA invests 97.5% of its revenue in football-related activities, projects and initiatives that ensure the continued development of the men's and women's professional game as well as youth, grassroots and futsal.About EuropolEuropol is the European Union’s law enforcement agency. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. With over 1 600 staff members, Europol uses state-of-the-art tools to support some 3 000 international investigations each year, serving as a centre for law enforcement cooperation, analytical expertise and criminal intelligence.

Europol supported this investigation, which targeted 44 suspects from Germany and other countries. Among the suspects are individuals allegedly involved in the fraud networks, executives from German payment service providers, intermediaries, crime-as-a-service providers who supplied shell companies, and an independent risk manager. In Germany alone, investigators searched 29 premises across several Federal States and executed five arrest warrants. Over 250 officers from the Federal Criminal Police Office, the Public Prosecutor General's Office in Koblenz, the Federal Financial Supervisory Authority (BaFin), and the tax investigation unit were involved. As part of the investigation, assets worth over EUR 35 million were secured in Luxembourg and Germany.Modus operandi in this alleged fraud schemeBetween 2016 and 2021, the suspects allegedly used stolen credit card data to create around 19 million fake online subscriptions on professionally operated websites, primarily offering pornography, dating, and streaming services. These websites were designed to evade search engine indexing, making them accessible only through direct URLs or links. The charges on credit cards were kept low, around EUR 50 per month, with obscure descriptions, making it difficult for cardholders to identify unauthorised transactions.Involvement of payment service providersThe suspects allegedly exploited the infrastructure of four major German payment service providers to process and launder the illicit transactions. Six suspects, including executives and compliance officers, are accused of colluding with the fraud networks, enabling them to access the payment infrastructure in exchange for fees.Money laundering and shell companiesTo conceal their activities, the suspects used numerous shell companies, primarily registered in the UK and Cyprus. These companies were used to distribute the fraudulent transactions, minimising the risk of chargebacks and detection. The shell companies were obtained through crime-as-a-service providers, who supplied complete corporate structures, including fake directors and Know-Your-Customer (KYC) documents.International cooperationOn the action day on 4 November 2025, coordinated measures were taken in Germany, the USA, Canada, Singapore, Luxembourg, Cyprus, Spain, Italy, and the Netherlands, with support from Europol and Eurojust. Numerous search warrants were executed, leading to the seizure of documents, data carriers and communication devices. Arrest warrants were also served, and significant assets were frozen.The action day followed extensive investigations, both nationally and internationally, involving over 90 legal assistance requests to 30 countries. The success of the operation is attributed to the close cooperation with authorities in the USA, Canada, Singapore, the UK, Luxembourg, the Netherlands, Cyprus, and Spain, as well as the coordination efforts of Eurojust and Europol.Catherine De BolleEuropol Executive DirectorOperation Chargeback is a testament to the power of international cooperation in dismantling complex criminal networks. It underscores the critical role Europol plays in supporting law enforcement agencies across the globe. By leveraging our analytical capabilities and facilitating cross-border coordination, we have been able to bring down the networks defrauding millions of credit card users worldwide. This success demonstrates our commitment to staying ahead of evolving criminal threats. Together, we are making significant strides in the fight against serious and organised crime.Magnus BrunnerEU Commissioner for Internal Affairs and MigrationThe cross-border cooperation within the EU and with partners, coordinated by Europol, leads to meaningful global results. This is why we are working to update Europol's mandate - to better support our law enforcement in protecting our citizens. We must boost our efforts against serious and organised crime by ensuring law enforcement has access to the data it needs. Today, over 85% of investigations rely on online evidence, and without this data, the fight against crime cannot be effective.Europol’s supportEuropol supported this investigation since May 2023, providing analytical support, organising several operational meetings and supporting the localisation of suspects. Law enforcement cooperation across all concerned countries was facilitated by the network of Liaison Bureaux situated at the Europol Headquarters in The Hague. On the action day, a crypto expert was deployed in Luxembourg, while another Europol expert took part in the coordination centre set up at Eurojust to support the joint action day in all countries concerned.Eurojust also enabled the cross-border judicial cooperation with the United Kingdom and United States via their Liaison Prosecutors at Eurojust and with the authorities in Canada and Singapore via its network of Contact Points. The seized evidence is currently being analysed, and further legal actions are expected to follow. For now, the suspects face charges of organised computer fraud, membership in a criminal organisation and money laundering.

Europol supported the second phase of an investigation by the Moldovan Police and Ukrainian Police against Russian mercenaries. Europol’s Core International Crimes Team assisted national authorities in identifying suspects allegedly involved in war crimes. Europol’s EU Internet Referral Unit also supported the action day, which focused individuals involved in war crimes committed during Russia’s war of aggression against Ukraine.Overall, the investigation led to the identification of a total of 654 members of the Russian private military companies Wagner and Redut involved in combat operations against Ukraine. These suspects include citizens of Ukraine, Moldova, Kazakhstan, Uzbekistan, Tajikistan, Turkmenistan, Azerbaijan, Armenia, and Bosnia and Herzegovina.  These individuals are believed to have committed war crimes such as acts of sexual violence, executions of prisoners of war and executions of civilians.The action day on 29 October 2025 resulted in:70 house searches in Moldova and UkraineSeizures including firearms and cold weapons, ammunition, uniforms, chevrons with the symbols of the Wagner paramilitary company, as well as electronic equipmentCollection of video material and photographic evidence suggesting the participation of citizens of Ukraine and Moldova in hostilities in the territory of Ukraine and the Democratic Republic of the Congo while being part of this Russian private military companyDuring the investigation, Ukrainian authorities shared with concerned countries, via Europol’s secure channels, 280 names of foreign nationals suspected of involvement in combat operations. Since the beginning of the investigation, national authorities uncovered recruitment and training sites, mapped command structures, and documented war crimes including the executions of civilians, the use of banned weapons, and attacks on Ukrainian cities. To date, 11 Ukrainian citizens have been indicted for high treason for joining the Wagner and Redut formations.See footage from the action day in this video from the Ukrainian police:Europol's supportEuropol supported the investigation by facilitating information exchange and providing specialised analytical support focused on the potential involvement of these individuals in war crimes committed in Ukraine. During the action days, Europol set up a virtual command post to facilitate communication among the involved authorities. It also strengthened intelligence gathering by comparing real-time operational data with its databases, including OSINT research.Europol supports joint efforts to disrupt serious and organised crime and criminal networks that threaten the security of the EU and its neighbourhood. To do so, Europol has established robust operational and strategic cooperation frameworks with Ukraine and Moldova as part of the EU’s eastern neighbourhood. Europol signed an operational agreement with Ukraine, which was signed in December 2016 and entered into force in August 2017. Europol and Moldova signed an operational agreement in late 2014, which was then updated in 2020. These partnerships enable Europol to facilitate information exchange and alignment of operational activities and to coordinate law-enforcement responses across borders.

Criminal use of crypto becomes more professionalParticipants at the event in Vienna – jointly organised by Europol, UNODC and the Basel Institute on Governance – gained fresh insights into the evolving ways that cryptoassets and blockchain technology are being misused for crime. The conference on 28 and 29 October 2025 brought together more than 250 in-person participants and more than 1 000 online attendees from a wide range of fields, including law enforcement, prosecutors, regulators, researchers and leading blockchain intelligence firms.The growing sophistication of criminal tactics poses risks, not only to the crypto sector and to scam victims, but to society at large. These risks include serious crimes such as drug trafficking, terrorism financing and sanctions evasion.Burkhard MühlHead of Europol's European Financial and Economic Crime Centre (EFECC)The misuse of crypto and blockchain technology for criminal purposes is becoming increasingly sophisticated, complex and organised. Investigating these crimes places a significant burden on the law enforcement agencies of EU Member States. Europol will therefore continue to invest in innovation, technology and cooperation with private partners, to fulfil its mandate of supporting Member States in complex and international investigations.Professionalising the responseLaw enforcement, private sector partners and academia are rapidly advancing their ability to counter the threats posed by sophisticated crypto-related crimes and money laundering. Advanced tools are reducing reliance on manual tracing, while a host of successful cross-border operations show the power of collaboration. Research and reliable data on crypto’s use for criminal purposes are also crucial for governments to assess risks and respond appropriately.John Brandolino, UNODC Director, Division of Treaty Affairs, gave one example referencing a panel on transnational scams, illicit marketplaces and money laundering networks:Our research into scam centres in Southeast Asia is giving governments and law enforcement the insights they need to disrupt these fast-growing transnational threats.However, gaps remain: in legislation, in implementation, in capacity. Addressing these will require, chiefly, harmonised and evidence-based standards for blockchain investigations and intelligence – the topic of one of this year’s breakout sessions.Cooperation across borders and sectorsThe borderless nature of blockchains means criminal proceeds can cross the globe in seconds, while formal cooperation between authorities can still take days or weeks. Faster inter-agency channels are vital, said participants, as well as closer coordination between investigators and prosecutors. Public-private partnerships have been critical to disrupting illicit activity on blockchain, but they must be enhanced and scaled. This was a key theme on the first day, dedicated to cross-sector collaboration.A side event led by the Wolfsberg Group also highlighted the importance of private-to-private cooperation.Ned ConwayExecutive Secretary of the Wolfsberg GroupAs traditional and decentralised finance merge, clearer channels for information-sharing between banks and virtual asset service providers will greatly strengthen efforts to detect and disrupt illicit finance.Building capacity through training and peer learningCrypto is now a common feature of financial crime investigations, yet many agencies still lack the skills and resources to pursue leads or recover assets. Developing specialist teams and upskilling frontline officers is essential.Elizabeth AndersenExecutive Director of the Basel Institute on GovernanceThere’s a huge opportunity here. Through hands-on training and peer learning, countries can build the capacity to detect and trace cryptoassets linked to crime, and to recover them for the benefit of victims and wider society.A global platform and communityAs crypto use expands and evolves, the joint Global Conference remains a unique platform for dialogue and practical cooperation.By developing clear standards, enhancing cooperation and building capacity, we can collectively ensure financial innovations are harnessed for the public good while preventing their abuse by criminals.Learn more about the conference and find links to any recordings on the 9th Global Conference on Criminal Finances and Cryptoassets event page.

Phone calls and text messages remain the primary entry point for these scams, representing roughly 64% of reported cases. By hiding their true identities and locations, criminals trick victims into revealing personal information, transferring funds, or granting access to devices and accounts, making it extremely difficult for law enforcement to trace and prosecute them.A borderless threatCaller ID spoofing is increasingly exploited by organised criminal networks operating across multiple jurisdictions. Fraudsters impersonate banks, government agencies, or even family members to gain trust. Some use it for so-called swatting incidents, making false emergency calls from a victim’s address, triggering large-scale emergency responses.Investigations show the emergence of a “spoofing-as-a-service” business model, providing ready-made tools for impersonating trusted entities such as law enforcement or financial institutions. Operating from abroad, these networks exploit jurisdictional gaps to evade detection and prosecution.Europol’s call for actionThe current imbalance, where spoofing is easy to commit but hard to investigate, is unsustainable. Europol is urging measures that make it more costly and technically complex for criminals to hide behind spoofed identities, while enabling investigators to act swiftly across borders.A Europol survey conducted across 23 countries revealed significant challenges in implementing anti-caller-ID spoofing measures. This means that the combined population of approximately 400 million people remain susceptible to these types of attacks.Law enforcement highlighted major obstacles, including limited cooperation with telecom operators, fragmented regulations, and a lack of technical tools to identify and block spoofed calls.Towards a coordinated European responseEuropol and its partners have identified three priorities:Harmonised technical standards: develop EU-wide mechanisms to trace fraudulent calls, verify legitimate caller IDs, and block deceptive traffic.Enhanced cross-border collaboration: strengthen cooperation between law enforcement, regulators, and industry to share intelligence and evidence efficiently.Regulatory convergence: align national rules to enable lawful traceback, clarify legitimate uses of caller ID masking, and promote proven anti-fraud tools.While anti-spoofing measures are essential, law enforcement expects criminals to adapt. Emerging threats such as SIM-based scams, anonymous prepaid services, and smishing schemes will require continued vigilance and cross-sector cooperation.Europol’s proposed measures support the ProtectEU strategy, strengthening Europe’s collective capacity to combat organised crime and protect citizens from online and offline threats. Through sustained multi-stakeholder collaboration, Europe can restore integrity to its communication networks and reduce the growing harm caused by caller ID spoofing.

Preparing to fight terrorism on land and seaThe exercise scenario focused on the deployment of special intervention units and naval assets during day- and night-time, simulating terrorist and hostage incidents on board of cruise liners and ferries. Day after day, the participants faced new challenges on the water and on some of the archipelago’s many islands, slowly preparing them for the final exercise under real-life conditions. The attending units brought along their equipment, such as speed boats, sniper rifles, combat diving gear, and helicopters. The exercise was supported with helicopters and naval vessels provided by various Swedish authorities.The attending operators undertook tactical and technical preparations with every new scenario, weighing operational options under time pressure. Teams paired up with colleagues from neighbouring countries, challenging them to work using a common language and allowing them to exchange experience on tactics and equipment. ATLAS exercises, such as TRIDENT, are invaluable for building trust and exchanging experiences, which ultimately enables special intervention units to enhance tactical skills and technical capabilities.Final exercise under watchful eyesThis TRIDENT naval exercise culminated in a large-scale scenario across the archipelago with teams facing several challenges at once. The operational challenges included intercepting a ship transporting weapons for a terrorist cell, as well as securing terrorist-controlled locations with hostages, including some requiring first-response medical attention. This multi-threat scenario tested the participants’ response agility and adaptability throughout the exercise.The Nationella Insatsstyrkan under the leadership of Mårten Langer invited official representatives to observe the final assault. Sweden was represented by the Minister of Justice Gunnar Strömmer, the Head of Swedish Police Petra Lundh, Head of Swedish Coast Guard Lena Lindgren Schelin, representatives from the Swedish Armed Forces, as well as civil servants from other Swedish Authorities. Europol was represented by Jean-Philippe Lecouffe, Deputy Executive Director of Europol, and Anna Sjöberg, Head of the European Counter Terrorism Centre.Mårten LangerCommander, Nationella insatsstyrkan and ATLAS ChairmanIn a time of increasing global conflict, organised crime and terrorism, ATLAS remain united under our motto “All Together to Protect You". Safeguarding Europe’s values of democracy and freedom requires strong cooperation built on mutual trust. Trust is best forged through shared experiences, particularly in high-risk operations and demanding training environments. For almost twenty-five years, the ATLAS network has conducted around fifty joint activities annually, continuously enhancing Europe’s collective security and operational capability. ATLAS special intervention units, thank you for your commitment.Petra LundhSwedish National Police CommissionerExercises of this type are becoming increasingly important given the global situation we are in. We have witnessed the strength we have when we work together, and the joint strength is impressive.Jean-Philippe LecouffeDeputy Executive Director of Europol, Operations DirectorateSpecial intervention units are our critical shield in moments of greatest risk. Their effectiveness depends not only on individual skill but also on seamless cooperation with each other. Through joint, cross-border training exercises such as TRIDENT, we add an element of mutual learning, which allows for the exchange of experiences, builds trust, and increases readiness. Ultimately, in a crisis affecting any Member State, each unit can move swiftly, confidently, and in coordination to protect our common European security.ATLAS NetworkThe ATLAS Network consists of law enforcement special intervention units of the EU Member States and associated countries, maintaining 24/7 readiness to respond to crisis situations affecting European security. Since November 2018, the ATLAS Support Office has been hosted at Europol’s ‘European Counter Terrorism Centre’. This ensures that the ATLAS network is both continuously supported internally and directly connected to other relevant law enforcement networks and EU agencies.Europol provides financial and material support to the dozens of exercises conducted annually by the network. TRIDENT was helmed by the ATLAS Expert Group Naval.Participating countries:Belgium - Directie van de Speciale Eenheden, DSUEstonia – Counter Terrorism Unit, K-KomandoFinland - Helsingin poliisilaitos Valmiusyksikkö, KARHUGermany - GSG 9 der Bundespolizei, GSG9Iceland - Sérsveit ríkislögreglustjóra, VIKINGLatvia - Pretterorisma Vien?ba, OMEGALithuania - Antiteroristiniu Operaciju Rinktine, ARASNetherlands - Dienst Speciale Interventies, DSINorway - Politiet Beredskapstroppen, DELTASweden - Nationella Insatsstyrkan, NIObserving countries:Austria – Direktion Spezialeinheiten/Einsatzkommando Cobra, EKO CobraDenmark - Politiets Aktionsstyrke, AKSIreland - Garda Emergency Response Unit, ERU

A new wave of online crime is putting consumers, businesses, and the wider economy at risk - from fake medicines and forged wine to illegal streaming platforms. The increase in counterfeit goods and the criminal abuse of intellectual property affect our daily lives more than many realise, with consequences that go far beyond lost revenue.The conference “From CLICK to CRIME: Investigating Intellectual Property Crime in the Digital Age” was held on 22 and 23 October 2025 in Sofia, Bulgaria. Jointly organised by Europol, the European Union Intellectual Property Office (EUIPO) and Bulgaria’s General Directorate Combating Organised Crime (GDBOP), the event highlighted the vital importance of collaboration in tackling online crime. The participants reaffirmed the importance of strong collective efforts in tackling online-enabled intellectual property crime to protect consumers, safeguard creativity and uphold trust in the digital economy.Consider a few key examples of the major threats posed by intellectual property crime:Illegal streaming and sharing platforms not only drain the cinema, publishing, musical and software industries but also expose viewers, especially children, to unregulated and potentially harmful content.Fake pharmaceuticals, supplements and illicit doping substances, promoted on social media and websites, are produced in clandestine labs without testing or quality control. Dangerous products, circulating in gyms and among amateur athletes, can cause severe or even fatal health effects.Counterfeit toys, perfumes, and cosmetics are also trafficked online and carry hidden dangers, trading low prices for high risks to health and safety.Behind many of these schemes are well-structured organised criminal networks that view intellectual property crime not as a secondary activity, but as a lucrative business model. These criminal networks exploit global supply chains, digital platforms and shell companies to maximise their reach and profits. The vast revenues generated through counterfeiting and piracy sustain a broader criminal market, underscoring the importance of financial investigations and asset recovery in dismantling these networks and eliminating their economic incentives.This conference brought together law enforcement agencies, policymakers, and industry experts to expose current threats and strengthen international cooperation in the fight against online intellectual property crime. Participants highlighted successful anti-piracy operations, analysed new criminal tactics, from evolving distribution methods and payment systems to the use of malware, and presented Europe’s latest tools, training, and operational actions to protect consumers and creativity in the digital age.Criminal networks continue to exploit the high demand for low-cost goods, fuelled by the ongoing cost-of-living crisis and consumers’ limited awareness of the economic, health, and environmental risks posed by counterfeit products. According to the EU Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA), published earlier this year, the rapid pace of digital transformation has shifted the trade in counterfeit goods online, leading to a sharp decline in the number of physical retail outlets. The report also highlights that social commerce, the integration of e-commerce with social media, has become a key channel through which counterfeiters reach and entice consumersTo strengthen the fight against counterfeiting and piracy both online and offline, Europol and the European Union Intellectual Property Office (EUIPO) joined forces in 2016 to establish the Intellectual Property Crime Coordinated Coalition (IPC3). “From CLICK to CRIME: Investigating Intellectual Property Crime in the Digital Age” is the sixth conference co-organised by the two agencies, together with a national authority, aimed at enhancing knowledge and fostering a coordinated public-private sector response to intellectual property crime.

This year’s conference title, ‘Red Light, Green Light! Reduce Complexity, Increase Speed, Defend EU Values’, drew inspiration from a term used in data protection and cybersecurity to signify compliance or non-compliance. This phrase also echoes the children's game popularised by the Netflix series Squid Game, where the stakes are extremely high – life or death. Similarly, data protection and cybersecurity in law enforcement can have severe, real-world implications for individuals.High-level speakers and keynotesThe opening session featured speakers including:Jürgen Ebner, Deputy Executive Director of Europol, Governance Directorate, who discussed the balance between ensuring security and upholding privacy within Europol's operations. He highlighted the agency’s commitment to adhering to high standards of data protection while protecting European citizens.Angelo Gafà, Maltese Police Commissioner, who welcomed the audience as Maltese representative and introduced his take on the importance of data protection in law enforcement. Keynote by Angelo Gafà Michael O’Flaherty, Commissioner for Human Rights of the Council of Europe, who provided a broader human rights-focused perspective on the EDEN conference.Wojciech Wiewiorowski, European Data Protection Supervisor (EDPS), who issued a video statement addressing the crucial role of the EDPS in overseeing compliance and managing the challenges posed by digital transformation and data-driven policing. He advocated for innovative solutions that maintain the balance between privacy and effective law enforcement.Joe Cannataci, Head of the Department of Information Policy and Governance at the University of Malta. He contributed with an academic perspective while building on his experience as first UN Special Rapporteur on the right to privacy.Conference highlightsOver the course of two days, the 180 attendees participated in a variety of panels and discussions that delved into crucial subjects. These included data retention in law enforcement, the intersection of privacy and human rights in the era of artificial intelligence, and the role of data protection officers in ethical policing. Additionally, the programme explored the future of facial recognition technology and AI in law enforcement, as well as the tension between disinformation, digital sovereignty and free speech. The conference also examined the use of surveillance technologies in the fight against atrocities. frameborder="0"Defending fundamental rights in the digital eraWith participation from key European institutions, national authorities and academia, the 15th EDEN conference once again aimed to strengthen cooperation between data protection experts and law enforcement agencies. Discussions focused on how to streamline processes, increase operational speed and maintain the highest standards of data protection, which is crucial in defending the values of the European Union.About EDENThe Europol Data Protection Experts Network (EDEN) provides a platform for dialogue between law enforcement, data protection authorities, academia, NGOs and industry, promoting the exchange of knowledge, best practices and research on privacy and cybersecurity in policing.About ERAThe Academy of European Law (ERA) is a leading provider of training and knowledge exchange for legal professionals throughout Europe, fostering understanding and implementation of EU law.The photo of Maltese Police Commissioner, Angelo Gafà, was updated following publication.

The criminal network and its infrastructure were technically highly sophisticated and enabled perpetrators around the world to use this SIM-box service to conduct a wide range of telecommunications-related cybercrimes, as well as other crimes. The online service created by the criminal network offered telephone numbers registered to people from over 80 countries for use in criminal activities. It allowed perpetrators to set up fake accounts for social media and communication platforms, which were subsequently used in cybercrimes while obscuring the perpetrators’ true identity and location.Results of the action day:26 searches carried out;5 individuals arrested;approximately 1200 SIM-box devices seized which operated 40 000 SIM cards;hundreds of thousands of further SIM cards seized;5 servers with infrastructure of the illegal service seized;2 websites (gogetsms.com and apisim.com) offering the illegal service taken over by law enforcement and “splash pages” displayed;EUR 431 000 in suspects’ bank accounts frozen;USD 333 000 in suspects’ crypto accounts frozen;4 luxury vehicles seized.The true scale of this network is still being uncovered. Measured by volume, more than 49 million online accounts were created on basis of the illegal service provided by suspects. The damage caused by the renters of the telephone numbers to their victims amounts to several million euros.Enabling a multitude of serious crimesThe criminal network offering this service enabled its clients to commit a multitude of serious crimes that would not have been possible at all without masking the perpetrators’ identities. ‘Phishing’ and ‘smishing’ are methods applied by criminals to gain access to victims’ e-mail and banking accounts. Phishing is a cybercrime where attackers pose as trusted sources through emails, calls, texts, or websites to steal sensitive data like passwords, bank details or credit card numbers, often leading to identity theft, financial loss or malware infections. Smishing is a subtype of phishing carried out via text messages, typically disguised as urgent notices from legitimate sources to trick victims into clicking malicious links or sharing personal information.Other offences facilitated by this criminal service include fraud, extortion, migrant smuggling and the distribution of child sexual abuse material. Some examples-by no means an exhaustive list-of the criminal activities enabled by the network’s offerings are:Fraud on online second-hand marketplacesSome perpetrators specialised in fraud on second-hand marketplaces. They used the SIM card service to create a vast number of fake accounts, which then served as starting points for fraud enabled by phishing and smishing.Daughter–son scamThis type of perpetrators contacts victims via WhatsApp, posing as a daughter or son and claiming to have a new phone number. Citing alleged spontaneous accidents or emergencies and evoking panic with the victim, they demand urgent payments usually in the four-figure range.Investment fraudVictims are usually contacted by telephone and encouraged to deposit larger sums and “invest.” The perpetrators often use remote-access software to gain access to the victim’s device.Fake shops and fake bank websitesRented telephone numbers of the perpetrators were also used in the legal notice and alleged responsible-party details of fake shops and in calls connected to fake bank pages.Fake police officersIn this further large-scale phenomenon, the perpetrators used the telephone numbers to convince their mostly Russian-speaking victims of their legitimacy. This crime had an additional  concerning element, as perpetrators posed as police officers with forged IDs and personally collected funds from the victims.Criminal sophistication and technical ingenuityThe now-dismantled criminal network undertook great efforts to provide its criminal clients with the requested service. This included the professional design and appearance of its website, which was taken offline by law enforcement during the action day. There was also the massive organisational effort of multiple accomplices acquiring thousands of SIM cards in almost 80 countries worldwide to be rented to other criminal organisations. As a side note: one of the main suspects behind this now-dismantled criminal structure had already been under investigation in Estonia for arson and extortion.Joint investigative effortTo prepare for the action day in Latvia, Eurojust and Europol leveraged their strengths to enhance the international law enforcement effort. They assisted in planning and administering the action day, with support from Joint Investigation Team partners Austria, Estonia and Latvia, as well as Finland. Europol deployed specialists to Riga to aid Latvian authorities, and both agencies provided financial support for technical equipment, travel and translation costs.During the operation, the technical infrastructure of the organised criminal network was dismantled in collaboration between Europol and the Shadowserver Foundation. A splash page was displayed on the landing page of the criminal service, which had been offering crime-as-a-service using foreign phone numbers for smishing and phishing. Europol provided analytical support, OSINT analysis for mapping the online criminal service and organised weekly meetings between law enforcement authorities, prosecutors and Eurojust desks. Europol also offered on-the-spot forensic support to secure digital evidence, took down the digital infrastructure and provided large file exchange services for transmitting data evidence.Participating countries: Austria: Federal Criminal Intelligence Service (Bundeskriminalamt), Criminal Investigation Department Salzburg (Landeskriminalamt Salzburg); Vienna Public Prosecutor's Office (Staatsanwaltschaft Wien)Estonia: Estonian Police (Politsei); Northern District Prosecutor’s Office (Põhja ringkonnaprokuratuur)Finland: Finnish Police (Poliisi); National Cyber-enabled Crimes Unit (NCCU Finland); National Bureau of Investigation (Keskusrikospoliisi)Latvia: Latvian State Police (Valsts policija); R?ga Judicial Region Prosecution Office (R?gas tiesas apgabala prokurat?ra); R?ga Northern Prosecution Office (R?gas Zieme?u prokurat?ra)The video in this press release was updated at 12.25 PM CET on 17 October.

Over the course of the week, experts investigated social media platforms, marketplaces, dating apps, job searching portals, escort agency sites and instant messaging platforms in search of actors facilitating sexual or labour exploitation online. Their efforts uncovered indications of human trafficking across 44 online platforms and resulted in the below outcome:33 potential victims of human trafficking identified31 potential perpetrators identified53 platforms checked302 URLs related to THB detected137 social networks related to THB detected The operation revealed that escort agencies dominate the market for sexual services and operate across multiple EU countries, although these services appear to be coordinated by a few organised criminal groups. Authorities also observed that possible victims of trafficking for sexual exploitation were always accompanied by a man who appeared to act as their controller.Additionally, experts detected an increase in advertisements generated by artificial intelligence to lure victims, as well as a shift towards sophisticated payment methods, where only cryptocurrencies are accepted. Analysts also found platforms with indicators of organ trafficking and child sexual abuse material (CSAM) sites on the dark web, along with pages claiming to rent, buy and sell minors, including new born babies. Teaming up since 2022Europol participated in the operation by providing coordinated support on site. Its experts also contributed with cross-checking and operational analysis from Europol’s headquarters in The Hague. Eurojust provided analytical support and ensured the swift involvement of judicial authorities besides the Dutch judicial authority.The first EMPACT THB Hackathon was organised in 2022 and has now taken place for four consecutive years. The initiative has become a crucial tool for investigators to pool expertise, coordinate cross-border online monitoring, identify potential victims at an early stage, enhance the detection of trafficking networks and generate new investigations.A phenomenon with global interconnectionsTrafficking in human beings is increasingly nurtured by the online domain. Criminal networks misuse it to circulate fake job offers, build manipulative online relationships and post live-streamed sexual exploitation content, recruiting victims all across the world. A stronger and more visible presence of law enforcement online is crucial to prevent the phenomenon from escalating beyond control, hidden behind encrypted apps, social media platforms and the dark web. The following authorities took part in the investigation: EU countries: Austria, Belgium, Cyprus, Czechia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, the Netherlands, Poland, Portugal, Romania, Slovenia, Spain, Sweden.Third countries: Brazil, Georgia, *Kosovo, Moldova, Serbia, Ukraine, United Kingdom.EU Agencies: Europol, Eurojust.(* This designation is without prejudice to positions on status, and is in line with UNSCR 1244/99 and the ICJ opinion on the Kosovo declaration of independence.)The list of participating countries was updated on 13 October 2025.

This development builds on the signing of a Working Arrangement between both sides in 2021.SIENA is Europol’s flagship platform for the swift and secure exchange of sensitive and restricted information among European law enforcement authorities, European agencies and bodies such as Eurojust, EPPO and OLAF, as well as trusted partners outside the EU. By joining the network, the EIB will be able to rely on such platform to exchange information with relevant authorities in a secure and timely way.Catherine De BolleEuropol Executive DirectorToday’s signature demonstrates our shared commitment to ensuring the solid protection of EU funds and the financial integrity of the Union. Reinforcing our cooperation with the EIB adds another key actor to the EU’s collective efforts to fight fraud, corruption and money laundering. Connecting to SIENA means having access to a secure and compliant channel linking a wide community of European and international law enforcement agencies, with state-of-the-art security and data protection features.Monique KoningEuropean Investment Bank InspectorFor the EIB, participation in SIENA is a strategic move that enhances our ability to collaborate with law enforcement on fraud, corruption and other financial crimes, as well as to exchange information and intelligence swiftly and securely, enabling us to react timely. This connection will allow the EIB’s Inspectorate General’s Investigations Division to exchange intelligence securely and efficiently, reinforcing the Bank’s role in safeguarding EU and EIB financial interests and supporting broader anti-crime efforts.Over the past year, Europol has expanded its SIENA network from 3 000 to 3 500 connections, adding on average two new partners every day. This expansion reflects Europol's commitment to strengthening cooperation between law enforcement authorities and institutional partners through tools that enable them to tackle increasingly complex criminal threats.The recent entry into force of the Information Exchange Directive (2023/977) designates SIENA as the default channel for cooperation among European law enforcement authorities, further consolidating its role in connecting key actors committed to delivering security for the EU and beyond.

Between 1 and 2 October, the Colombian Police (Policia Nacional de Colombia) and the Spanish Guardia Civil, supported by Europol, targeted four key suspects, linked to the so-called Clan del Golfo, allegedly responsible for whole-sale cocaine trafficking operations from South America to Europe. In particular, the criminal network oversaw first-hand the production, transportation and distribution of cocaine throughout the entire logistics chains. To support field activities on the action day, Europol deployed two experts to Colombia and Spain.This investigation is based on information retrieved from the Sky ECC encrypted communications platform. For a first time Colombia has used Sky ECC data in a judicial proceeding. As a result, data obtained from Sky ECC led to the launch of a judicial case, judicial cooperation, and ultimately the issuing of arrests warrants and seizures. International cooperation has been essential in this case. Europol developed criminal data from Sky ECC and provided operational analysis, facilitated the exchange of information and supported the case coordination.The joint action days in Colombia and Spain led to:5 arrests (2 in Colombia and 3 in Spain), 2 of which High Value Targets7 location searches in ColombiaSeizures in Colombia include: 25 properties, 9 companies and 17 vehicles with an estimated value of EUR 12 millionCatherine de BolleEuropol Executive DirectorCocaine trafficking affects the health of European citizens, the stability of our economies, and especially the safety of our neighbourhoods, where gang violence and organised crime are leaving visible scars. The joint operation between Colombia and Spain, supported by Europol, is a striking demonstration of what can be achieved when law enforcement agencies unite not only across borders, but across continents.Crypto transactions of over 700 million illegal proceeds detectedThe investigation targeted prominent High Value Targets linked to a Colombian drug cartel, who coordinated global drug trafficking activities from Colombia and other Central American countries to Europe. The suspects arrested on the action day played different roles within the network. Some maintained direct contacts with the so-called Clan del Golfo to secure large-scale cocaine supplies. Others managed connections with multiple European criminal groups to facilitate distribution across the continent. A third group focused on laundering criminal assets through complex schemes involving offshore companies and large transfers via cryptocurrencies. The investigation identified active cryptocurrency transactions with an estimated total of 700 million dollars. All targets are Colombian nationals, some base in Colombia and others – in Spain. During the action day, authorities in Colombia and Spain searched the suspects’ luxurious properties located in Pereira, Medellin and Bogota (Colombia) and Madrid (Spain).See footage from an arrest during the action day here:This criminal network was responsible for large-scale international drug trafficking, organised through direct contact with the suppliers from the so-called Clan del Golfo and the distribution channels run by criminal groups in Europe. Cocaine was transported from Colombia to other countries in the region by speedboats and stockpiled in stash houses. The drugs were then shipped concealed in freight cargos to European ports. To sustain these operations, the suspects collaborated with other criminal actors based across several South American countries such as Panama, Costa Rica and Dominican Republic. Over the course of the investigation, significant quantities of cocaine were seized through a series of container inspections carried out both in South American and European Ports. Images in this press release were updated on 9 October 2025.

The Russian-speaking criminal network, composed mainly of Moldovan nationals, targeted high-end hybrid vehicles across northern Italy and Spain’s Marbella region. The stolen cars and their components (bodywork, battery packs, mechanical parts) were shipped through the European port of Antwerp to international illegal markets.Action dayThe action day on 7 October 2025 resulted in 9 arrests in the regions of Reggio Emilia and Lombardy in Italy. In addition, EUR 35 000 in cash and EUR 150 000 in cryptocurrencies were also seized.Around 100 officers took part in the coordinated action, supported by Spanish Guardia Civil officers deployed to Belgium and Italy, and Italian Carabinieri teams sent to Spain and Belgium. Crypto-experts from Belgium, Italy and Spain joined the searches to secure and recover illicit digital assets.A coordination centre was set up at Eurojust, while Europol deployed experts and a mobile office to Italy and Belgium.Sophisticated modus operandiThe criminals operated with military-style precision. Investigators uncovered:Dedicated teams for car thefts, storage and counterfeitingUse of GPS trackers to monitor targeted vehiclesElectronic tools to bypass security systemsAlteration of VINs and licence plates from decommissioned cars to disguise stolen vehiclesLinks with shipping companies and criminal associates to move cars via AntwerpThe investigation also exposed a complex payment system involving multiple crypto platforms and wallets. Transfers worth around EUR 1 million in cryptocurrency were identified.European coordinationEuropol coordinated the international phase of the investigation, bringing together investigators from all involved countries and hosting operational meetings at its headquarters. Europol also supported national authorities with analysis and intelligence sharing, and will continue to provide on-the-spot support during follow-up actions.Eurojust supported a joint investigation team of the Italian and Spanish authorities set up in 2024 to dismantle the organised crime network.The following authorities took part in the investigation:Belgium: Federal Judicial Police of Antwerp (Federale Gerechtelijke Politie Antwerpen)Italy: Carabinieri of Reggio Emilia (Carabinieri di Reggio Emilia)Spain: Guardia Civil The investigation has been supported by the @ON Network funded by the EU Commission, led by the Italian Antimafia Investigation Directorate (DIA).

Overall, Operation OPSON XIV saw:631 individuals reported to judicial authorities;101 arrest warrants issued;13 organised crime groups disrupted;goods worth around EUR 95 million seized;31 165 checks and inspections performed. Expired goods reinserted into supply chainOne of the main trends identified this year was organised crime groups infiltrating waste disposal companies with the intent to get access to expired food awaiting destruction. The criminals then remove the original "best before" or expiration dates using solvents and print new, falsified dates on the packages. These relabelled products are then reintroduced into the supply chain. In terms of quality, they may not only be poor but often also pose a health risk, as seen in cases involving canned fish. As a criminal modus operandi, the practice of relabelling expired food is not entirely new, but its current scale is unprecedented.However, the range of fraud in the food and beverage sector is not only limited to reprinting false expiration dates. Counterfeiting of food and beverages and the abuse of geographical indications are amongst the most common fraudulent tactics. As far as counterfeit and wrongly designated foods are concerned, olive oil and wines featuring a protected designation of origin remain strongly affected types of products.In addition, authorities saw several instances of meat or meat products sold to restaurants or consumers despite having been stored in subpar conditions, or with slaughterers not respecting legal and necessary hygienic standards. Similar modi operandi were seen with seafood (e.g., bivalve molluscs), which was no longer suitable for consumer consumption but nevertheless sold.See a video below from the operation of an illegal slaughterhouse in PortugalChecks from raw material to final productFood and beverage fraud constitutes a significant and serious crime area in need of being tackled on a national as well as on an international level. Operation OPSON was established with the goal to protect public health and safety across the EU.The list of food and beverage items taken off market spans a wide range. Authorities seized staples such fruits, vegetables, poultry, meat, meat products and seafood. The list of food items also covers confectionary, fats and oils, with a special focus on olive oil. In addition, food supplements and additives were covered over the course of OPSON XIV.OPSON XIV operational highlights Europol coordinated OPSON XIV and supported many individual cases by deploying experts with a mobile office to action days. During these checks and raids, the experts on the spot could provide analytical and intelligence support to the national authorities. Moreover, Europol organised operational meetings for the spin-off cases. With hundreds of individual investigations and checks performed by police, customs and national food regulatory authorities in collaboration with private sector partners, more than a few stood out as examples to be highlighted in detail.ItalyAn investigation by the Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri, NAS) led to the issue of an arrest warrant for seven horse breeders and truck drivers. They were part of a criminal organisation operating in Umbria and Puglia, which clandestinely slaughtered horses treated with pharmaceuticals, posing a significant public health risk. Additionally, authorities discovered and seized a clandestine slaughter facility on a farm, along with a truck containing parts of illegally slaughtered animals.PortugalThe Economic and Food Safety Authority (Autoridade de Segurança Alimentar e Económica- ASAE) conducted an inspection in the northern part of the country, leading to the discovery and dismantling of an illegal slaughter operation. The site lacked proper technical, functional and hygienic conditions, while the meat from various animal species was distributed to restaurants and butchers without mandatory health inspections. This practice posed a significant risk to public health. As a result, criminal proceedings were initiated, and a suspect was arrested. Authorities seized 33 slaughtered animals, 159 sheep and goats, approximately 200 kg of offal, slaughtering instruments and two laptops. To ensure public safety, the slaughtered animals were sent to a legally approved subproduct processing unit to prevent their entry into the human food chain.SpainIn an operation published this summer, the Guardia Civil’s Nature Protection Service, the Portuguese Economic and Food Safety Authority as well as the Maritime Police, supported by Europol’s experts on environmental crime, dismantled a criminal network profiting from illegally harvested and contaminated clams. The operation resulted in 11 arrests and the seizure of over 7 tonnes of clams. Harvested from the River Tajo, the clams were distributed across Portugal, Spain, France, and Italy, posing significant health risks to consumers. Investigators estimate the criminal modus operandi generated up to EUR 2.5 million weekly profits. Apart from crimes such as environmental crime, money laundering, document fraud and health fraud, there are also elements of human trafficking and labour exploitation within the illegal fishing operation.In another operation, the Guardia Civil investigated a company that mislabelled bananas from Madeira as Canary Islands bananas with protected geographic indication. As this company used counterfeit customs documents for imports, this operation led to the investigation of an individual for alleged offenses related to geographical indications, market deception and document forgery. It was determined that approximately 2 000 tons of bananas were irregularly marketed as Canary Islands bananas.GeorgiaThe Investigation Service of the Ministry of Finance of Georgia uncovered a smuggling operation involving non-excised goods. Two non-Georgian citizens were detained for transporting large quantities of undeclared, non-excised alcoholic beverages, tobacco products and other goods across Georgia's customs border. They used false customs declarations and transferred the goods to another vehicle for further transportation and sale. The seized goods are valued at over EUR 73 000 (GEL 230 000).

Opening the conference at Europol’s headquarters, Executive Director Catherine De Bolle told some 500 participants from around the world:Catherine de BolleEuropol Executive DirectorAt this year’s Cybercrime Conference, we are confronting one of the defining dilemmas of our time: data as both a driver of innovation and the lifeblood of modern criminality. When digital evidence remains out of reach, children go unidentified, terrorist plots advance undetected, and organised crime thrives in the shadows. Lawful access is not a legal abstraction — it is about ensuring that people are protected in their everyday lives.A keynote address was delivered by the Commissioner for Internal Affairs and Migration, Magnus Brunner, who said:Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationCybercrime knows no borders. Drones threaten our critical infrastructure, cybercriminals exploit encryption and new technologies, and data has become a decisive battleground. To protect people and businesses in the EU, we must mainstream security into all our policies, strengthen Europol’s mandate, and ensure lawful access to data. This is not about new powers – it is about restoring balance in a changing world.Under the theme ‘Dissecting data challenges on the digital frontlines’, the two-day event focused on the fast-growing challenge of data in cybercrime investigations.Delegates discussed five pressing issues:Balancing access and privacy: how data is used in everyday life, from personal decisions to geopolitical strategy.Data in operations: the need for cross-border data availability and stronger public-private partnerships to track and disrupt cybercriminals.Data-driven legislation: the urgency of updating regulatory frameworks as technology evolves.Cyber diplomacy: ensuring collaboration between governments and industry to create resilient systems.Prevention: showcasing innovative approaches that are changing how cybercrime is tackled.Case studies presented during the conference included Europol-supported Operation Eastwood, which disrupted pro-Russian hacktivist activity targeting European infrastructure, and Operation Ratatouille, which saw the arrest of the alleged administrator of one of the world’s most influential Russian-speaking cybercrime platforms.The Cybercrime Conference was preceded by an annual workshop with national Computer Security Incident Response Teams (CSIRTs), organised jointly between Europol and the European Union Agency for Cybersecurity (ENISA), underlining the importance of technical expertise and operational collaboration in building digital resilience. Together with other events on prevention, forensics and global cooperation, the week marked the launch of Europol’s Cyber Week – bringing together communities from across Europe and beyond to strengthen collective defences.Now in its fourth year, Europol’s Cybercrime Conference has become a key annual platform for operational, policy and industry experts to share insights and prepare the next steps in the fight against cybercrime.Europol also publishes the Internet Organised Crime Threat Assessment, outlining the emerging threats and key developments in the field of cybercrime over the last year. 

The actions led to:16 house searches (7 in Albania and 9 in Colombia);17 arrests (7 in Albania and 10 in Colombia);54 victims originating from South America were identified (44 in Albania, 5 in Croatia and 5 in Colombia);Seizures include evidence and equipment; further seizures are ongoing.International cooperation exposes mobile human trafficking networkA criminal network, composed mainly of Colombian nationals, recruited and transported vulnerable women from Colombia to Europe. Once under the network’s control, the victims were subjected to sexual exploitation in several European countries, including Albania and Croatia. The suspects operated with a high level of mobility, which complicated national investigations. International cooperation between Albania, Croatia and Colombia, facilitated through Europol, was essential in linking the main organisers with local associates who acted on their behalf in transit countries and countries of exploitation. The main suspect, identified as a High-Value Target within a Europol taskforce, coordinated the group’s activities while also distancing himself from the direct exploitation.Call centre to manage the exploitation activitiesThe investigation revealed a highly organised structure within the network, with members assigned to specific roles ranging from recruitment and transport to the direct control and exploitation of victims. Sexual services were advertised on adult websites, with negotiations on pricing and services handled by call centre operators, leaving victims with no control over their own lives. The so-called “agencies” oversaw every detail, from recruitment to money collection, often subjecting victims to psychological and physical violence, as well as threats against family members in Colombia. At least half of the illicit proceeds were channelled to the main organiser, who relied on sophisticated money laundering methods to whitewash the criminal profits.Europol supported the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed an expert to Colombia to cross-check operational information in real time, support investigators on the ground and coordinate cross-border cooperation.This investigation was supported by Italy’s Ministry of Interior through the EU4FAST multi-donor project addressing migrant smuggling and human trafficking in the Western Balkans.

The latest iteration of Operation LAKE, which ran from October 2024 to June 2025, uncovered large-scale trafficking networks and disrupted the flow of live eels destined for illegal farms in Asia.The operation led to:16,131 inspections carried out across Europe26 arrests22 tonnes of glass eels seizedOrganised crime at the heart of traffickingInvestigations revealed that several organised crime groups were driving the trade. EU nationals sourced the eels through fisheries, while Asian nationals managed smuggling routes out of Europe.Once outside the EU, the eels were raised in farms and sold on the global market as legitimate fish products. Europol intelligence estimates that up to 100 tonnes of glass eels are smuggled each year, generating EUR 2.5–3 billion annually in peak years.This black market not only threatens an endangered species but also fuels a range of criminality, from tax evasion and food fraud to document forgery and money laundering.Traffickers relied heavily on forged paperwork to disguise their activities, falsifying catch records and inventing recipients for shipments to evade checks and move tonnes of live eels out of Europe every year.A long-term commitmentOperation LAKE is Europol’s flagship action against glass eel trafficking and one of the longest-running international operations tackling environmental crime. Since its launch, it has resulted in:Over 850 arrests109 tonnes of glass eels seized or prevented from being smuggledEuropol coordinated operational activities and provided intelligence and analysis support throughout the season. Europol experts worked closely with participating authorities, organised operational meetings, and deployed on the ground to support live investigations.Participating partnersFor this year’s edition, Europol brought together more than 20 partners, including law enforcement from EU Member States and third countries, as well as EU institutions:EU Member States: Belgium, Croatia, Czechia, Denmark, Estonia, Finland, France, the Netherlands, Portugal, Slovakia, SpainPartner countries: Albania, Canada, Georgia, Switzerland, United Kingdom, United StatesEU institutions and agencies: Eurojust, European Commission (DG SANTE), European Fisheries Control Agency (EFCA), European Anti-Fraud Office (OLAF)

The annual event brought together the heads of national police organisations, customs administrations, representatives from the European Commission, and international partners to discuss the most pressing threats to security in Europe.Catherine De Bolle, Europol’s Executive Director, and Lene Steen, Deputy National Commissioner of the Danish Police, opened the conference. Keynote addresses were delivered by EU Commissioner for Internal Affairs and Migration Magnus Brunner,  Beate Gminder, Director General for Migration and Home Affairs at the European Commission, and Gerassimos Thomas, Director General for Taxation and Customs Union at the European Commission.Two panels, building on expert-level workshops held prior, highlighted how criminals are exploiting digital technologies in both violent and financial crime, and how to address these threats internationally.Catherine De BolleEuropol Executive DirectorThe social and economic costs of organised crime are simply too high, so politically, economically, and socially damaging that no single country or organisation, however powerful, can confront them alone. That is why the law enforcement community must redouble its efforts to modernise, strengthen, and deepen international police cooperation.Crime-as-a-Service: minors increasingly digitally drawn into criminal networksThe panel on Crime-as-a-Service explored how organised crime networks are offering specialised services, from cyberattacks to acts of violence to clients around the world.Law enforcement experts warned that minors are increasingly targeted and lured through online gaming, social media, and encrypted channels. The phenomenon includes Violence-as-a-Service, where acts of intimidation or assault can be contracted online.Police chiefs emphasised the need for:Centralised, specialised investigative structures to track recruiters, brokers, and enablers across borders;Stronger preventive measures to protect vulnerable youths online, including awareness campaigns, school engagement, and ethical guidance in digital spaces;Enhanced international cooperation and data sharing, supported by AI and data science, to identify criminal networks faster;Regulatory obligation for gaming platforms and social media to prevent harmful content involving minors, and to impose a minimum age for admission to risk-associated platforms and to cooperate with law enforcement when necessary.Follow the Money: digital finance exploited by criminalsThe panel on Follow the Money examined how organised crime, cybercrime, and terrorist financing are exploiting digital financial services, including virtual IBANs, decentralised finance platforms, crypto assets, and fintech tools.Key challenges identified include:Rapidly evolving criminal techniques outpacing law enforcement’s capacity to investigate;Shortage of specialists and high-cost investigative tools for blockchain and crypto tracing;Obstacles in cross-border investigations, especially involving safe-haven jurisdictions with weaker AML standards.Police chiefs discussed practical solutions, such as:Expanding joint investigative “sprints” to trace and seize criminal assets across borders;Pooling resources for specialised investigative tools for crypto and blockchain analysis, as well as boosting investment in training;Treating money laundering as a stand-alone criminal offence to speed prosecutions, accepting reasonably suspicion of the provenance of the funds;Strengthening public–private partnerships to improve information sharing and early warning systems.Strengthening Europe’s security architectureThe 14th edition of the EPCC once again provided a platform for hundreds of bilateral meetings and strategic discussions on the future of Europol and European security cooperation.The European Police Chiefs Convention is Europol’s flagship annual event, bringing together Europe’s law enforcement leadership to address shared security challenges and strengthen operational cooperation.The EPCC also hosted the Meeting of the Directors General of Customs Administrations, providing a dedicated platform for customs leadership to exchange best practices, coordinate on cross-border threats, and enhance cooperation with other law enforcement partners.Recognising innovation in law enforcementThe EPCC also celebrated excellence in innovation in policing. The annual Europol Excellence in Innovation Awards were presented to initiatives that demonstrate outstanding creativity and effectiveness in tackling emerging threats, including digital crime, financial crime, and the protection of vulnerable populations.This year, law enforcement agencies from Portugal, Germany and Norway were honoured for their initiatives in three categories: Ethics, Diversity & Inclusion, Innovative Operation and Technical Innovation.Read more about the winning initiatives. 

The experts participating in the task force analysed over 300 datasets depicting victims of child sexual exploitation (CSE). The analysts saw victims of both genders, from toddlers to teenagers, with a variety of ethnic backgrounds and of many different nationalities. Following the operation, national authorities were sent 213 leads for further investigation.Catherine De BolleEuropol Executive DirectorChild sexual abuse material may be created in a single room, yet spread instantly across the world, inflicting lifelong trauma on children. Through advanced analysis, digital forensics and close international cooperation, Europol can sometimes locate the very room where abuse has taken place. But too often, we stand outside that door, knowing what happened inside yet lacking the key to rescue the child. The 17th edition of Europol’s Victim Identification Taskforce was a remarkable success. Yet we must ask ourselves: How many more children could we have safeguarded if we had the right digital tools and the right keys? That is why we must not confine ourselves to old ways of thinking. We must take bold and innovative steps to protect every child we canGrowing CSAM and sophisticated tools: A race against the clockThe Victim Identification Task Force (VIDTF) was first organised in 2014. Since then, the number of analysed datasets has increased exponentially, alongside Europol’s database, which was created in 2006 and now holds over 111 million unique photos and videos of child sexual exploitation.In addition to the growing volume of images, the exchange of child sexual abuse material (CSAM) now appears to be much more frequent than in the past, likely due to the accessibility and large storage capacity of mobile phones. In parallel, AI-generated CSAM has become one of the main ways offenders produce, acquire and store such material.Over the years, offenders have also gained access to more sophisticated tools and resources. Today, they even share tutorials on dark web forums explaining how to create hyper-realistic AI-generated CSAM.Over 1 000 victims safeguarded by bringing partners together National authorities often lack the tools and human resources to cope with the amount of CSAM being created and disseminated. This is why the Victim Identification Task Force is so valuable in the fight against child sexual exploitation: It brings together experts of multiple nationalities, facilitates communication and strengthens cooperation between law enforcement agencies worldwide.Over the previous sixteen VIDTF editions, authorities safeguarded a total of 1 010 victims, arrested 301 offenders, analysed 8 005 datasets and disseminated 2 266 intelligence packages to Europol’s partners. One of the most memorable success stories took place in September 2024, during the 15th VIDTF held at Europol’s headquarters. One of the investigators analysed a video depicting brutal sexual abuse of a five-year-old, committed by an adult male. As the details in the video were insufficient to identify the subjects or the country where it was produced, further checks were made against Europol’s databases. This led to the discovery of a second video depicting the same subjects engaged in similar acts. When the cross-checks performed pointed to France, French specialists participating in the VIDTF took over the analysis, while their colleagues in France initiated an investigation. The victim depicted in both videos was identified and safeguarded, and the offender was arrested.Further investigations revealed that the suspect had sexually abused and tortured two other victims, aged two years and six months, alongside four other men. The five offenders had met in groups hosted on end-to-end encrypted platforms. They had also recorded themselves abusing the three children and shared the files online. All the victims were rescued and safeguarded.Europol’s call: Trace an ObjectEuropol has recently released new pictures to the platform “Stop Child Abuse – Trace an Object”, which calls on all citizens to examine objects from child sexual abuse cold cases and see if they recognise any of them. No clue is too small: Even the smallest detail could help identify and safeguard a sexually abused child.The main goal is to trace the origin of the depicted objects. Anyone who recognises one can provide information to Europol anonymously. Once the country or location is identified, Europol will inform the competent law enforcement authority to investigate further. The aim is to speed up the identification of both the victim and the offender.The following partners took part in the Victim Identification Task Force 17: Australia: Australian Federal Police (AFP)Belgium: Federal Police BelgiumBulgaria: Cybercrime Directorate (GDCOC)Canada: Royal Canadian Mounted Police (RCMP)Croatia: Criminal Police Directorate, National Cybercrime DepartmentDenmark: Danish National Police - National Cyber Crime CenterEstonia: Police and Border Guard BoardFrance: Police nationale (Office Mineurs - Protection des mineurs), Gendarmerie nationale (Centre de lutte contre les criminalités numériques)Germany: Federal Criminal Police OfficeIreland: An Garda SíochánaItaly: State Police (Polizia di Stato- Servizio Polizia Postale- C.N.C.P.O.)Malta: Malta Police Force (Il-Korp tal- Pulizija ta’ Malta)Netherlands: National Police (Politie)Norway: KRIPOS (NCIS)Poland: Central Cybercrime BureauRomania: Police Directorate for Countering Organised CriminalitySerbia: Service for Combating High-Tech Crime, Directorate of PoliceSlovakia: Cybercrime Unit, National Center for Specific Crimes, Presidium of the Police ForceSpain: National Police (Policía Nacional), Guardia CivilSweden: Police AuthorityUK: National Crime Agency (NCA)USA: Federal Bureau of Investigation, Homeland Security InvestigationsINTERPOLNote to mediaEuropol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting.The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.

A large investigation, involving law enforcement and judicial authorities from Bosnia and Herzegovina, Croatia and Slovenia, has led to the dismantling of criminal network smuggling migrants from Bosnia and Herzegovina to Croatia and towards other EU countries. The investigation into this network active across the Western Balkans route was conducted under Europol’s dedicated Operational Task Force (OTF). Further arrests already took place in previous operational actions.Results of the action day in Croatia on 17 September 2025:The leader of the network (High Value Target) arrested3 other suspects arrested9 locations searchedSeizures include electronic equipment and small amounts of drugsEncrypted communications to secure migrant smuggling operationsThe border section between Bosnia and Herzegovina, Croatia, and Slovenia has now emerged as a key route used to smuggle migrants from the Balkans into Western Europe. This investigation took place under the umbrella of a dedicated Europol Operational Taskforce, established to strengthen the coordinated response to this criminal phenomenon.To date, authorities have linked the network to more than 100 smuggling incidents involving over 600 migrants. Highly organised, the group carefully structured its operations, focusing heavily on secrecy to avoid police detection. The criminals relied on secure communication channels, including encrypted mobile messaging platforms, to coordinate their activities.The network was predominantly composed of Croatian organisers, who recruited drivers from Czechia, Slovakia and other Central and Eastern European countries. In most cases, migrants entered Bosnia and Herzegovina legally, travelling by air from Istanbul to Sarajevo. After a short stay, they contacted members of the network, who then transported them to the Bosnian-Croatian border. The migrants then crossed the border on foot, assisted by guides working for the organisation.Once inside Croatia, other members of the network arranged temporary accommodation, particularly in the Split area. From there, drivers, mainly from Czechia, Slovakia and neighbouring countries, transported the migrants onward in rented vehicles supplied by the organisers.Regional OTF at Europol to tackle shifting migrant smuggling activitiesThe Western Balkans remain a key transit region for secondary movements, where criminal networks actively offer their services to irregular migrants. In response to this criminal phenomenon, Europol set up a dedicated Operational Taskforce (OTF) in March 2023, bringing together authorities from Bosnia and Herzegovina, Croatia, Germany and Slovenia. The OTF’s main objective is to target criminal groups engaged in migrant smuggling along the Western Balkans route.To strengthen these efforts, Europol established a dedicated financial instrument to support complex, high-profile investigations. During this latest operation, Europol coordinated the overall investigative activities, facilitated information exchange and provided tailored analytical support to the involved authorities. The agency also organised operational meetings to ensure effective cooperation among the OTF members.During the action day, Europol deployed an expert to the field in Croatia to cross-check operational information in real time against Europol’s databases. This ensured investigators had immediate access to possible new leads, strengthening the operational impact of the joint actions.

Cocaine production in Latin America has reached unprecedented levels while wholesale prices in Europe have dropped and are currently at the lowest level ever. Although joint law enforcement investigations and efforts to strengthen port security across European seaports have led to positive results in recent years, criminal networks have quickly adapted by exploiting new methods of trafficking. Their activities have become increasingly global, interconnected and fluid, posing a major challenge for law enforcement authorities. Cocaine shipments entering the EU are now concealed in highly sophisticated ways, including chemical modifications or incorporation into carrier materials, making detection at ports extremely difficult. In the Iberian Peninsula, for example, traffickers often tranship cocaine on the high seas, using go-fast boats or other vessels to bypass port controls.The two distinct investigations conducted between November 2024 and September 2025 led to the disruption of two wholesale cocaine trafficking networks linked to the smuggling of tonnes of cocaine into the EU.Found in Spain and Portugal: cocaine hidden inside cowhidesA first action day led by Portuguese Judiciary Police and Spanish Guardia Civil, with the support of US DEA and Dominican Republic authorities, illustrates how criminal networks are using more elaborate tactics in carrying out their illegal activities. On 3 September 2025, the Europol-supported operation resulted in the arrest of 12 suspects for allegedly smuggling cocaine inside cowhides.  Hidden drugs in cowhide Seized drugs during OP Olimpia This unusual method enabled the perpetrators to prevent the drugs from being detected by both port scanners and drug-detecting dogs. The only way to locate the cocaine was by completely dismantling the shipment. Investigators believe that the suspects had sent dozens of containers of cocaine from the Dominican Republic to various locations in Europe by using this concealment method.  The action day on 3 September was the second phase of the operation. The first one took place between June and July 2025 and led to the arrest of seven suspects nationals from Colombia, Dominican Republic, Portugal and Spain.Overall, the operation led to:19 arrests32 property searches2,232 kg of cocaine seizedEUR 150,000 in cash seizedSeizure of several electronic devices, luxury vehicles, and documentationSecond hit against cocaine traffickingA few days after, on 10 September 2025, Europol supported SVA-Spanish Customs and Guardia Civil in another operation that led to the dismantling of a criminal network smuggling cocaine from South America to Europe using multiple types of vessels. The suspects, Colombian, Cuban, Romanian and Spanish nationals, were involved in extortion, kidnapping and extreme violence due to its rivalry with other criminal organisations. US DEA and Judiciary Police from Cape Verde also participated in the investigation. Law enforcement in action Seized cocaine during operation Seized weapons during operation Results from the action day on 10 September 2025:37 arrests (including a HVT)39 property searchesCocaine cutting laboratory dismantledEUR 600,000 in cash seized200 bank accounts frozen26 vehicles, 56 real estate and 5 vessels seizedSeizure of 3 firearms (1 shotgun and 2 pistols)Fake weapons and knives found in the house of the target responsible for the kidnappings and extortionThe gang was led by a high value target, who was also arrested during the action day. This Spanish citizen offered his criminal services and logistical infrastructure to other criminal organisations in South America and Europe to traffic cocaine. He also established a network of companies related to fishing activities to launder profits and give the criminal activities the appearance of legality.  In November 2024, the first iteration of the operation resulted in the arrest of six suspects who were aboard a fishing vessel, bound for Spain and seized over 1.5 tonnes of cocaine. All in all, authorities have seized over 2 200 kilos of cocaine.A combined strategy to disrupt large-scale cocaine traffickingDrug trafficking remains a key threat to the EU’s internal security. To address this challenge, Europol played a central role in ensuring the success of these two major investigations by coordinating agencies, fostering cross-border police cooperation, providing analytical and financial support, and deploying experts on the ground during action days.Europe has emerged as the primary market for cocaine, with production at record levels and prices falling. While intercepting drug shipments is crucial, it is no longer sufficient on its own.Europol is therefore pursuing a combined strategy that targets both shipments and the criminal networks behind them. As demonstrated by both operations, this approach has enabled authorities to uncover new routes, detect sophisticated concealment methods, and achieve stronger results in the fight against cocaine trafficking.

The fugitive is wanted by several countries and is considered a top priority target for international law enforcement. The U.S. Department of Justice (DOJ) has announced a reward of up to USD 10 million for information leading to his arrest.The identification of the suspect follows a complex international investigation, supported by Europol, into this ransomware network causing global damages worth billions. The case has involved close cooperation between investigators in France, Germany, the Netherlands, Norway, Switzerland, Ukraine, the United Kingdom and the United States together with Europol and Eurojust.As part of this investigation, several members of the criminal network have already been arrested in Ukraine. Law enforcement has mapped the structure of the group, identifying actors at every level – from malware developers and intrusion specialists to money launderers responsible for handling the illicit proceeds.The wanted fugitive deployed the LockerGoga ransomware to carry out his attacks.Europol will continue to support the international search for the fugitive and calls on the public to check the EU Most Wanted website and share any information that could help law enforcement bring this individual to justice.The profile of the newly added cybercriminal on EU Most Wanted is live now.

 The targeted criminal network used private security companies as fronts to recruit individuals already linked to their criminal structure. This allowed them to place trusted personnel in Ecuador’s key ports, which remain critical nodes for cocaine trafficking operations. In addition, the network used these private security companies to acquire armoured vehicles and firearms, which were subsequently diverted to local criminal groups across Ecuador. These groups are perpetuating widespread violence and violent deaths, driven by territorial disputes over drug trafficking routes.Waves of arrests and seizure after seizureEuropol supported an investigation launched by Belgian authorities already in 2020. During the first operational phase on 22 April 2020 in Belgium, 14 suspects were arrested and 4.6 tonnes of cocaine as well as 10 firearms seized by the Belgian Federal Police.The most recent operational phase took place this week on 3 September 2025 in the area of Guayaquil, Ecuador. 12 targeted suspects (11 Ecuadorians and 1 Serbian) were taken into custody and over 21 home searches conducted. Law enforcement officers seized 3 armoured vehicles, USD 27 000 in cash, 5 firearms and 7 electronic devices during the raids.This years-long investigation is based on information retrieved from the Sky ECC encrypted communications platform. Over the past years, law enforcement authorities dealt a series of heavy blows to the criminal network, with over 9 344 kilograms of cocaine seized in 11 instances. This includes seven raids with a total seizure of 4 125 kilograms in Ecuador, one large seizure of 4 600 kilograms in Belgium and three seizures of a total of 619 kilograms in the Netherlands.Less than a year ago, Europol supported a hit against a Western Balkans-based criminal group, in line with its strategy to strategically disrupt drug trafficking networks and their supply chains affecting the European Union. The network taken down in Ecuador this week is believed to have supplied cocaine to the suspects arrested in this prior action, which underlines law enforcement’s interconnected approach.Close cooperation across oceansThis success would not have been achievable without the close and trusted cooperation between EU and Latin American law enforcement. Europol provided analytical support and facilitated the exchange of information between Belgium and Ecuador. Europol’s dedicated Operational Taskforce funded the deployment of Ecuadorian colleagues to Europol’s headquarters in The Hague, the Netherlands. Participating countries: Belgium: Federal Police (Federale Politie)Ecuador: National Police (Policía Nacional de Ecuador)

Europol coordinated a joint action day between the Brazilian Federal Police (Polícia Federal) and the Irish National Police and Security Service (An Garda Síochána) against a criminal network involved in human trafficking for sexual exploitation of victims originating from South America. Active in Ireland and across several EU Member States, the criminal network, composed mainly of Brazilian nationals, is suspected of having exploited several hundreds of victims.  The criminal network is also investigated for forgery of documents, money laundering and other financial and economic crimes. The investigation was carried out within the framework of a Europol Operational Taskforce.The investigation and operational actions led to:Europol coordinated a joint action day between the Brazilian Federal Police (Polícia Federal) and the Irish National Police and Security Service (An Garda Síochána) against a criminal network involved in human trafficking for sexual exploitation of victims originating from South America. Active in Ireland and across several EU Member States, the criminal network, composed mainly of Brazilian nationals, is suspected of having exploited several hundreds of victims.  The criminal network is also investigated for forgery of documents, money laundering and other financial and economic crimes. The investigation was carried out within the framework of a Europol Operational Taskforce.33 house searches (29 in Brazil and 4 in Ireland)8 arrests (4 in Brazil and 4 in Ireland including the main organiser)28 victims originating from South America already identified prior to the actions, with work ongoing to identify the othersSeizures include at least 6 high-end vehicles, multiple bank accounts, luxury watches, one crypto wallet with at least EUR 50 0000, digital equipment and documents.A probe into an individual suspected of being involved in sexual exploitation led to the uncovering of a larger well-structured criminal network spread across borders. Active since 2017, this network operated from Brazil and Ireland, is believed to have been involved in the recruitment, transportation, accommodation, advertisement and overall control of female victims from South America. The women, often threatened with violence, were exploited sexually in multiple countries around the world including Ireland. Investigators estimate that the criminal activities have generated several million euros in illegal profits. Investigative activities are still on-going.Europol coordinated the operational activities, facilitated the exchange of information and provided analytical support. Europol deployed two experts, one in Brazil and one in Ireland, to cross-check operational information in real time and support investigators on the ground with technical expertise.

The Spanish Guardia Civil, supported by Europol, dismantled a criminal network smuggling migrants by boats from Algeria to Spain and onwards to other EU countries. The network, led by a Moroccan national, was comprised of both Algerian and Moroccan suspects based in Spain. Their operations relied on significant financial and logistical resources, misusing legitimate businesses such as maritime trading companies, to procure the means of transport for the smuggling activities. Hawaladars were also used to move criminal funds.The action days between 17 and 19 June in Spain led to:Actions in Almería, Nijar, Tabernas, Espartinas (Seville) and Alicante8 locations (6 houses and 2 industrial premises)14 arrestsSeizures included 15 speedboats between 7.5 and 8 meters, partly equipped with powerful engines (between 200 and 425 hp), boat hull moulds (8 and 14 meters long), maritime and electronic equipment, more than 100 full gasoline canisters, 2 firearms and more than EUR 68 000 in cash.More than EUR 1 million pumped into putting boats together for smuggling runsThe migrant smuggling network was highly structured, with separate branches responsible for different tasks and members playing distinct roles, including investors, intermediaries connecting the various cells, skippers and those preparing the boats.The criminal organisation is believed to have spent more than EUR 1 million on acquiring and manufacturing high-speed boats to support its operations. A complex web of companies in France and Spain was used to arrange the logistics and supply nautical equipment. Migrants were charged up to EUR 7 000 each for a dangerous one-way journey from Algeria to Spain on the often-overcrowded self-made boats.The network was composed of several cells. One cell was responsible for acquiring and managing vessels and maritime equipment, while another coordinated the navigation of boats towards landing spots along the Spanish coast. Other branches provided essential resources for the smuggling operations, including fuel, food, and communication systems, or handled security tasks during crossings.Europol facilitated the exchange of information and provided operational coordination and analytical support. Europol deployed an expert to Spain to facilitate the real-time exchange of information and cross-check operational information against Europol’s databases, providing immediate leads to investigators in the field.

In total, the action day on 19 August 2025 led to the following results:Four arrests in AustriaTwo cars, explosive devices, mobile phones and further evidence seized in AustriaMobile phones and further evidence seized in GermanyTwo cars, ammunition, EUR 16 500 in cash, GPS trackers and further evidence seized in the NetherlandsAfter a series of ATM attacks in Austria earlier this year, Austrian investigators with the support of Europol collaborated with their colleagues in Germany and the Netherlands to close in on the suspected robbers. Intense investigative efforts revealed that the main suspects were Dutch nationals from the Brabant area, who were well organised and had ties to other criminal groups active in Austria earlier this year.Investigators could also determine that the latest ATM attack by the highly sophisticated group was carried out with the help of a German national, who allegedly brought in facilitators for renting cars and other logistical support. It is believed that the cross-border collaboration between Dutch and German suspects was led by the Dutch suspects.Considerable damage and dangerous getawaysThe investigation showed that some of the suspects were present in Austria weeks before the robberies, scoping out potential attack locations. Cash machine robbers typically scout for suitable attack sites online and on-site. Preferably, they target easily accessible cash machines with comparatively modest security measures and convenient getaway options. Once an attack location has been chosen, the robbers typically strike during the night and rig the cash machines with solid explosives, made of flash powder sourced from heavy pyrotechnics. Activated from a short distance, the blasts often not only destroy the ATMs but also devastate the surrounding area. Photo from Austrian press conference on the arrests As cash machines are often located in residential areas, these attacks can cause serious harm to buildings and their residents. Upon blasting open a machine, sometimes with a second charge, the robbers grab the accessible cash and use high-powered vehicles to flee the scene at high speed. This unscrupulous approach and the extreme risks taken by the perpetrators both at the crime scene and during the escape makes their takedown a priority for law enforcement.Europol’s support to national investigatorsAs reported before, this criminal phenomenon has spread and moved across several EU countries in recent years. With law enforcement and financial institutions teaming up to increase ATM safety features in heavily affected areas, highly specialised criminal groups are forced to travel long distances to perform attacks on easier targets. Some proven remedies include carefully considered ATM locations, restricting access to indoor machines at nighttime alongside elevated break-in technology, glue or dye packs in cash containers, stronger mechanical protection measures as well as smaller stored cash amounts.Another effective remedy is constant pressure from law enforcement, which is why agencies from across the EU are continuously expanding their cross-border collaboration. An Operational Taskforce was set up at Europol, bringing together investigators from several affected Member States. This allowed Europol’s experts on organised property crime to support their colleagues from Austria, Germany and the Netherlands in forming an intelligence picture and preparing the coordinated strike.Participating countries: Austria: Federal Criminal Intelligence Service (Bundeskriminalamt); Provincial Criminal Intelligence Service Lower Austria (Landeskriminalamt Niederösterreich); Provincial Criminal Intelligence Service Upper Austria (Landeskriminalamt Oberösterreich)Germany: Federal Criminal Police Office (Bundeskriminalamt); Düsseldorf Police (Polizeipräsidium Düsseldorf)Netherlands: District Investigation Department ‘s-Hertogenbosch (Districtsrecherche ‘s-Hertogenbosch)

The operation’s success was driven by the outstanding collaboration between authorities from 18 countries, which helped investigators gain a deeper understanding of criminal methods and trafficking routes. Thanks to this joint effort, the operation triggered 102 new investigations targeting criminal networks engaged in currency counterfeiting.Overall results of the operation:297 parcels containing counterfeit currency seized;More than 990 000 counterfeit items intercepted, including banknotes and coins over EUR 280 000, USD 679 000 and GBP 12 000.As a leading EU agency in the fight against currency counterfeiting, Europol provided expertise, coordinated the exchange of information and supported national authorities in detecting suspicious parcels. In addition, Europol helped refine risk indicators, enabling more effective identification of counterfeit currency distribution in the future. The European Anti-Fraud Office (OLAF) also supported the investigation by providing technical infrastructure during the operational phase.New criminal networks uncoveredThe investigation, led by Austria, Portugal and Spain, was conducted between October 2024 and March 2025 and uncovered several new criminal networks engaged in currency counterfeiting. Most of these networks operate from outside the EU, mainly from Asia, but also from America and the Middle East.This operation marked the second phase of an earlier action in which Europol had also been involved. Stronger and improved cooperation between customs and police forces allowed authorities to achieve significantly better results this time. One remarkable success came from Romania, where a single coordinated action by national authorities resulted in the seizure of USD 600 000 in counterfeit currency.As in the first iteration of the operation, the vast majority of the seized items were altered-design banknotes, often referred to as ‘movie money’. These reproductions have a similar shape and colour to real banknotes, but include a small disclaimer indicating they are fake. However, these disclaimers are often overlooked, allowing criminals to pass them off as genuine currency.

The 15 search warrants performed led to:10 arrestsSeizure of real estate such as a tourist resort, villas, apartments, land plots as well as vehicles and shares in companies valued at several million eurosSeizure of EUR 111 800, USD 4 000 (around EUR 3 434), Albanian Lek 880 000 (around EUR 9 048) in cash Example of real estate seized Seizure of Sky ECC encrypted communication platform yields results since 2021Even though the Sky ECC encrypted communication platform was taken down over four years ago, its content still brings forward operational results. In-depth and targeted data analysis at Europol allows the cooperating law enforcement authorities to collect actionable information on high-level organised criminal groups and their members. This coordinated approach allows investigators to map out the structure of the high-risk criminal networks and the role of individual High Value Targets.A data-driven successThis particular operation led by the Albanian SPAK revolved around a top-level Albanian target involved in cocaine trafficking and money laundering. Investigators from Albania, Belgium, France, and the Netherlands together with Europol experts analysed encrypted Sky ECC communication data. Among the criminal episodes reconstructed were multi-tonne deliveries of cocaine trafficked from Latin America to the main ports of the EU, including Hamburg and Rotterdam. Investigations have shown that in just one of these shipments, the main target received more than USD 40 million for his cut.The criminal organisation’s leader was in charge of arranging shipments and investing into very large quantities of cocaine. He coordinated these massive criminal undertakings also from remote locations, relying on encrypted means of communication. Prior to his arrest, he was wanted following a decision by an Albanian court recognising a 21-year prison sentence issued by an Italian court for murder, deprivation of liberty, attempted hiding of a corpse, threats, illegal possession of explosives and ammunition as well as obstruction of justice. The Albanian organised criminal network under investigation operated with a truly global scope, as it cooperated with other groups that could facilitate transports to EU harbours. It invested its massive earnings, which reached dozens of millions of euros, in properties and businesses across Albania and other European countries.Europol’s expertise at workEuropol provided broad-ranging expertise on the criminal areas under investigation, covering organised crime structures, large-scale drug trafficking and money laundering. Based on large-data analysis, numerous intelligence and analytical reports were disseminated by Europol to the cooperating partners, who also met and exchanged information in several operational meetings. During the action day, Europol deployed an organised crime expert to Tirana, Albania, who provided support with a mobile office and facilitated international law enforcement cooperation.Participating countries: Albania: Special Prosecution Office for Anticorruption and Organised Crime (SPAK); National Bureau of Investigation (Byroja Kombëtare e Hetimit); State Police (Policia e Shtetit)Belgium: Federal Judicial Police (Federale Gerechtelijke Politie)France: National Police (Police Nationale)Germany: Federal Criminal Police Office (Bundeskriminalamt); State Criminal Police Office Baden-Württemberg (Landeskriminalamt Baden-Württemberg / GER Karlsruhe)Netherlands: Police (Politie)Italy: National Police (Polizia di Stato); Servizio per la Cooperazione Internazionale di Polizia (SCIP)

Contaminated clams as major health riskIn the border region between Portugal and Spain, the so-called ‘Manila or Japanese clam’ (Ruditapes philippinarum) is harvested illegally in the river Tajo. The criminal modus operandi is simple: illicitly fished clams are gathered and kept alive in water containers to be later introduced to the legal market. To that end, criminals use fake documentation, therefore bypassing any administrative and health inspection measures. Typically, the clams are distributed in Portugal, Spain and even France and Italy, posing a serious risk for consumers. Consumption of contaminated clams may cause food poisoning, gastroenteritis or hepatitis.Several hits against illegal clam fishersInvestigators estimate that the total profits of this illegal business may average up to EUR 2.5 million per week. These proceeds are laundered in various ways, such as with the purchasing and re-selling of luxury vehicles. The suspects’ activities go well beyond environmental crime, with trafficking of human beings - often irregular migrants - for labour exploitation in the fisheries a regular occurrence. Authorities believe that those forced to work under such conditions are paid as little as one or one-and-a-half euros per harvested kilo of clams by the criminals.This Europol-supported investigation, which started in April of this year, led to two action days carried out on 23 and 24 June as well as 30 July 2025. Apart from arresting 11 suspects, law enforcement seized 7 vehicles. The suspects may face charges such as environmental crime, money laundering, document fraud, as well as food and human health fraud.Europol supported the investigation from the start, which took place when the Guardia Civil seized a shipment of 235 kilo of clams and shared this information via Europol’s secure communication channel SIENA, thus setting in motion further operational activities. Europol funded several meetings attended by lead investigators and provided an around-the-clock virtual command post. The Agency’s environmental crime experts coordinated and supported their national colleagues by providing operational and analytical support. On the action days, one Europol expert with a mobile office was deployed on the spot, and Portuguese officers were deployed to Huelva, Spain.Participating authorities:Spain: Guardia Civil Nature Protection Service (SEPRONA)Portugal: Economic and Food Safety Authority (ASAE); Maritime Police (Polícia Marítima)

During the action days, officers carried out 5 house searches and raided a travel agency used by the main suspect, dismantling a fully equipped forgery lab and seizing hundreds of counterfeit documents, passport components, biometric data sets, forgery equipment with two high-end laser printers, mobile phones, vehicles, drugs and over EUR 68 000 in cash.The criminal network was allegedly disguised as a travel agency based in Athens, which served as a distribution hub for parcels containing false or counterfeit documents. As a legitimate business, the travel agency served to veil and facilitate the distribution of illicit documents. With each member fulfilling a specific role in the criminal organisation, the suspects used aliases to send illicit documents to recipients in various EU countries and third countries. Buyers could choose between a variety of passports, ID cards, driver’s licenses or even residency permits from various EU countries. This modus operandi can seriously impact the internal security of the EU.Investigations show that France, Spain and the United Kingdom where among the countries where the most parcels were sent to.The criminal organisation also facilitated migrant smuggling from Turkey to Greece, concealed migrants in a safe house in Athens, and organised secondary movements to other European countries by air using forged documents. During the action day, two undocumented migrants — an Iranian national and an Afghan national — were found in the safe house. The network had intended to smuggle them to Portugal.Europol’s roleEuropol supported the Greek case early on, which soon showed potential links with a German investigation. To facilitate the information exchange between Greek, German and US law enforcement authorities, Europol hosted a virtual operational meeting to prepare the action day. Apart from providing analytical support to the involved authorities, Europol also deployed an expert with a mobile office to Athens to provide real-time support on the spot.Participating authorities:Germany: Federal Police (Bundespolizei)Greece: Hellenic Police (Ελληνικη Αστυνομια)United States of America: U.S. Homeland Security Investigations; U.S. Customs and Border Protection; U.S. Federal Bureau of Investigation (Athens)

The group members ostentatiously used a derogatory name against the police, which was displayed on the license plates of the cars they owned, on the T-shirts or clothes they wore, on posts on social networks, or even custom-made on the metal gate at the entrance to the courtyard of the house where one of them lived.In December 2024, law enforcement conducted an operation against the group in the United Kingdom. On 23 July 2025, a follow-up action was carried out against the gang, this time in Bacău, Romania. This operation led to:2 arrests18 house searchesSeizure of real estate, luxury cars, electronic devices and cash See footage from the operation below.Europol’s roleEuropol provided significant data analysis based on information collected by Romanian and British investigators, which proved essential to the success of the operation. During the course of the investigation, Europol also hosted several operational meetings and deployed an analyst to Romania to assist the national authorities with their enforcement actions. In addition, Europol supported the joint investigation team (JIT) signed at Eurojust by both Romania and the UK. Eurojust not only supported the setting up of the joint investigation team, but also provided cross-border judicial assistance and helped with the preparation of the action day on the ground in RomaniaThe “TRF” methodThe gang committed fraud using the Transaction Reversal Fraud (TRF) method. The suspects removed the screen of an ATM and inserted a bank card to request funds. Before the funds were dispensed, they cancelled the transaction (or reversed it). This allowed them to reach inside the machine and take the cash before it was retracted. Investigators believe the criminal group stole an estimated amount of EUR 580 000 using this method.The perpetrators were also involved in other criminal activities, including skimming, forging electronic means of payment and transport cards, and conducting bin attacks — a type of card fraud carried out using software designed to identify card numbers and generate illicit income through fraudulent payments.The following partners took part in the investigation: Romania: National Police (Poliția Română) and Prosecutor's OfficeUnited Kingdom: Crown Prosecution Service, Eastern Region Special Operations UnitEurojustEuropolThe investigation and the Action Day itself have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA).

The forum, which had more than 50 000 registered users, served as a key marketplace for stolen data, hacking tools and illicit services. It has long been a central platform for some of the most active and dangerous cybercriminal networks, used to coordinate, advertise and recruit.The arrest took place in Kyiv, Ukraine, on 22 July, as part of a series of coordinated enforcement actions aimed at gathering evidence and dismantling the criminal infrastructure.Suspect made millions facilitating cybercrimeThe forum’s administrator was not only a technical operator but is believed to have played a central role in enabling criminal activity. Acting as a trusted third party, he arbitrated disputes between criminals and guaranteed the security of transactions. He is also believed to have run thesecure.biz, a private messaging service tailored to the needs of the cybercriminal underground.Through these services, the suspect is thought to have made over EUR 7 million in advertising and facilitation fees. Investigators believe he has been active in the cybercrime ecosystem for nearly two decades, and maintained close ties to several major threat actors over the years.Operational phaseThe investigation was initiated by the French Police in 2021. In September 2024, the case moved into the operational phase in Ukraine, where French police investigators were deployed on the ground, supported by Europol through the establishment of a virtual command post.It was followed by another action this week, which saw the arrest of the main suspect in Kyiv, Ukraine.Europol supportEuropol provided essential operational and analytical support throughout the investigation, facilitating information exchange and coordination between the French Police and Ukrainian authorities.Europol also assisted in mapping the cybercriminal infrastructure and linking the suspect to other major threat actors. This collaborative approach ensured a swift, targeted response to dismantle the criminal platform and disrupt the illicit activities facilitated through the forum.During this week’s enforcement actions in Kyiv, a Europol mobile office was deployed to support French and Ukrainian teams with on-site coordination and evidence collection. The seized data will now be analysed to support ongoing investigations across Europe and beyond.IOCTA 2025 report underscores the threat from stolen data marketplacesThis operation aligns closely with findings from Europol’s 2025 Internet Organised Crime Threat Assessment (IOCTA), which highlights the booming black market for stolen data as a critical driver of the cybercrime economy.Platforms like xss.is enabled the trade and monetisation of compromised data, hacking tools, and illicit services that fuel a wide range of criminal activities - from ransomware and fraud to identity theft and extortion.The IOCTA reveals how such marketplaces empower cybercriminals by providing access, anonymity and trust mechanisms that sustain their operation.The following authorities took part in the investigation:France: Paris Prosecutor (Parquet de Paris - JUNALCO), French Police - Paris Police Prefecture (Police française - Préfecture de Police de Paris - Brigade de lutte contre la cybercriminalité)Ukraine: General Prosecutor’s Office of Ukraine (Офіс Генерального Прокурора України), Security Service of Ukraine – Cybercrime Department (Служба безпеки України - Кібердепартамент) 

Europol’s Innovation Lab and the European Clearing Board’s Strategic Group on Online Policing have authored a concept paper on ‘policing in an online world’. Based on practical experience collected from partners across the EU, paired with academic insight and the discussion of wider societal trends, this concept paper delivers not only a situational snapshot but a set of guiding principles.The new concept paper is built on these guidelines, which should be exemplary in online interactions with citizens and the fight against criminal networks spreading into virtual communities. Law enforcement practitioners from across Europe contributed to these guidelines based on best-practice examples, core legal values and a fundamental understanding of their own role in our societies.The paper, which is available on Europol’s website, offers inspiration in how police can be present wherever citizens are online, delivering safety and protection much like in the physical world. It guides law enforcement in how to be visible and transparent, and how to create trust with hard-to-reach and at-risk target groups. Some recently established examples in various countries showcase that many citizens are more comfortable contacting the police online rather than calling over the phone. These findings emphasise the importance of lowering the threshold for citizens to contact the police.Europol and its partners at the forefront of innovationEuropol was mandated in 2019 by the EU Justice and Home Affairs ministers to create an Innovation Lab to support the law enforcement community in the area of innovation. The Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. These help investigators and analysts to make the most of the opportunities offered by new technology to avoid duplication of work, create synergies and pool resources. The activities of the Lab are directly linked to the strategic priorities as laid out in the Europol Strategy, which states that Europol shall be at the forefront of law enforcement innovation and research.The European Clearing Board for Innovation (EuCB) was launched by the Heads of Europol National Units (HENUs) in November 2020. It is composed of Single Points of Contact (SPoCs) from the Europol Innovation Lab, all EU Member States and the four Schengen-associated countries. SPoCs meet regularly in plenary meetings, during which they update each other on innovative projects and tools and decide on new joint collaboration activities.

Ketamine was the most trafficked drug by the gang, although the perpetrators also smuggled cocaine, heroin, crystal meth, MDMA and precursors for drug manufacture. Law enforcement authorities seized more than 225 kg of ketamine only in Belgium.  The action day in July 2025 was the culmination of months of investigation. Investigators had untangled the criminal network months earlier, carrying out several operations against some of its members already in 2024. Overall, the operations led to:7 arrests11 house searches (9 in Belgium, 1 in the UK and 1 in the Netherlands).Seizure of more than 600 kg of drugs, including ketamine, amphetamines, cannabis, heroin and cocaine.Seizure of more than EUR 5 million.The perpetrators operated not only within Western Europe, but were spread across multiple regions around the world. They used a variety of sophisticated methods to traffic drugs through Europe without detection, including trucks with drugs hidden in deck cargo and mail packages, which were intercepted in Belgium.Close cooperation between Europol and national authoritiesEuropol started supporting the investigation in September 2024 by organising a series of operational meetings and offering financial support to the Member States involved in the case. In addition, Europol’s experts carried out cross-checks and gave operational support to national authorities throughout the investigation. On the action day, two specialists were deployed to Belgium and the UK to provide their expertise in the field and ensure close coordination.Drug trafficking is a dynamic crime with high destabilising potential, given its association with violence, corruption, infiltration in the legal economy, and worldwide interconnections. Europol identifies drug trafficking as one of the key threats to the EU’s internal security.The following police services took part in the investigation:Belgium: Federal Judicial Police of East Flanders (Federale Gerechtelijke Politie)Netherlands: IRC NetherlandsUnited Kingdom: National Crime Agency (NCA)

The actions led to the disruption of an attack-infrastructure consisting of over one hundred computer systems worldwide, while a major part of the group's central server infrastructure was taken offline. Germany issued six warrants for the arrest of offenders living in the Russian Federation. Two of these persons are accused of being the main instigators responsible for the activities of "NoName057(16)". In total, national authorities have issued seven arrest warrants, which are directed, inter alia, against six Russian nationals for their involvement in the NoName057(16) criminal activities. All of the suspects are listed as internationally wanted, and in some cases, their identities are published in media. Five profiles were also published on the EU Most Wanted website.National authorities have reached out to several hundred of individuals believed to be supporters of the cybercrime network. The messages, shared via a popular messaging application, inform the recipient of the official measures highlighting the criminal liability they bear for their actions pursuant to national legislations. Individuals acting for NoName057(16) are mainly Russian-speaking sympathisers who use automated tools to carry out distributed denial-of-service (DDoS) attacks. Operating without formal leadership or sophisticated technical skills, they are motivated by ideology and rewards.Overall results of Operation Eastwood2 arrests (1 preliminary arrest in France and 1 in Spain)7 arrest warrants issued (6 by Germany, and 1 by Spain)24 house searches (2 in Czechia, 1 in France, 3 in Germany, 5 in Italy, 12 in Spain, 1 in Poland)13 individuals questioned (2 in Germany, 1 in France 4 in Italy, 1 in Poland, 5 in Spain)Over 1 000 supporters, 15 of which administrators, notified for their legal liability via a messaging appOver 100 servers disrupted worldwideMajor part of NoName057(16) main infrastructure taken offlineNoName057(16) DDoS disruption attempts in favour of RussiaOffenders associated to the NoName057(16) cybercrime network targeted primarily Ukraine, but have shifted their focus to attacking countries that support Ukraine in the ongoing defence against the Russian war of aggression, many of which are members of NATO. National authorities have reported a number of cyberattacks linked to NoName057(16) criminal activities. In 2023 and 2024, the criminal network has taken part in attacks against Swedish authorities and bank websites. Since investigations started in November 2023, Germany saw 14 separate waves of attacks targeting more than 250 companies and institutions.In Switzerland, multiple attacks were also carried out in June 2023, during a Ukrainian video-message addressed to the Joint Parliament, and in June 2024, during the Peace Summit for Ukraine at Bürgenstock. Most recently, the Dutch authorities confirmed that an attack linked to this network had been carried out during the latest NATO summit in the Netherlands. These attacks have all been mitigated without any substantial interruptions.Central coordination to target the pro-Russian cybercrime networkEuropol facilitated the information exchange and supported the coordination of the operational activities, serving as a hub for the communication between national authorities and EU agencies. For that purpose, Europol organised over 30 online and offline meetings and two operational sprints. Europol also facilitated cooperation with private partners, who offered their assistance both ahead of and following the operation. The Agency provided extensive analytical support, as well as cryptocurrency tracing and forensic expertise over the course of the investigation. Europol coordinated the prevention campaign, released to alleged affiliates via messaging apps and social media channels.  During the action day against NoName057(16)’s affiliates, Europol set-up a coordination centre at its headquarters with representatives from France, Germany, Spain, the Netherlands and Eurojust, and made available a Virtual Command Post to connect the other participating countries with the coordination centre.The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This operational team consists of cyber liaison officers from different countries who work from the same office at Europol’s headquarters, delivering various forms of support to high-profile cybercrime investigations.Through Eurojust, authorities were able to coordinate the judicial activities and plan their respective measures during the action day. The Agency ensured the execution of Mutual Legal Assists and multiple European Investigation Orders. During the action day on 15 July, Eurojust coordinated any last-minute judicial requests required during the operation.Gamified manipulation to motivate pro-Russian cyberattacksInvestigations by national authorities identified NoName057(16) as an ideological criminal network that has been seen to profess support to the Russian Federation and, in the context of the Russian war of aggression against Ukraine, has been linked to numerous DDoS cyberattacks. During such attacks, a website or online service is flooded with traffic with the objective of overloading it and rendering it unavailable. In addition to the activities of the network, estimated at over 4 000 supporters, the group was also able to construct their own botnet made up of several hundred servers, used to increase the attack load.To share calls to action, tutorials, updates, and to recruit volunteers, the group leveraged pro-Russian channels, forums, and even niche chat groups on social media and messaging apps. Volunteers often invited friends or contacts from gaming or hacking forums, forming small recruitment circles. These actors used platforms like DDoSia to simplify technical processes and provide guidelines, enabling new recruits to become operational quickly.Participants were also paid in cryptocurrency, which incentivised sustained involvement and attracted opportunists. Mimicking game-like dynamics, regular shout-outs, leader boards, or badges provided volunteers with a sense of status. This gamified manipulation, often targeted at younger offenders, was emotionally reinforced by a narrative of defending Russia or avenging political events.Participating countriesCore countriesCzechia - Czech Republic: National Counter-Terrorism, Extremism and Cybercrime AgencyFinland - National Bureau of Investigation (NBI)France - National Cyber Unit of the Gendarmerie Nationale, Paris Public Prosecutor’s Office – National Jurisdiction against Organised Crime (JUNALCO)Germany – Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General's Office Frankfurt am Main – Cyber Crime CenterItaly – National Police (Polizia di Stato)Lithuania – Lithuanian Criminal Police BureauNetherlands – National Police (Politie), Public Prosecutor’s OfficePoland - Central Cybercrime BureauSpain – Guardia Civil, National Police (Policía Nacional)Sweden – PolisenSwitzerland – Federal Office of Police fedpol and Office of the Attorney General of Switzerland (OAG)USA - Federal Bureau of InvestigationSupporting countriesBelgiumCanadaDenmarkEstoniaLatviaRomaniaUkraineParticipating EU agenciesEuropolEurojustENISA

On 10 July, the Public Security Directorate (PSD) of the Hashemite Kingdom of Jordan and the European Union Agency for Law Enforcement Cooperation (Europol) signed a Working Arrangement in order to support the Member States of the European Union and Jordan in preventing and combating serious and organised crime and terrorism.The Working Arrangement provides for a structured legal framework for cooperation and enhanced exchange of information (non-personal data) between Europol and the relevant Jordanian law enforcement authorities. It will enable both partners to work on key areas such as migrant smuggling, drug trafficking, money laundering and firearms trafficking. The Arrangement also covers the possibility of sharing specialist knowledge, general situation reports, results of strategic analysis, the participation in training activities, as well as providing advice and support in individual criminal investigations.Based on this Working Arrangement, the PSD will designate a national contact point to facilitate cooperation between Europol and the relevant Jordanian law enforcement authorities. The Arrangement also provides grounds for the deployment of a liaison officer to Europol to join its unique community of liaison bureaux of law enforcement authorities from more than 50 countries.Once the Arrangement enters into force, the European Union and Jordan will enhance their level of cooperation in addressing serious security threats, further strengthening Europol’s cooperation with another key partner in the Middle East.Catherine De BolleEuropol Executive DirectorThe signing of this Working Arrangement represents a key milestone in our shared efforts to confront common security threats that affect the EU and its Member States and the Hashemite Kingdom of Jordan. This partnership is an expression of the trust and mutual understanding between Jordan and the European Union in the law enforcement domain. It paves the way for an even stronger collaboration in the pursuit of security in the EU and in the wider Middle East.

This year’s edition of the operation codenamed ‘Global Chain’ took place from 1 to 6 June 2025 and was led by law enforcement in Austria and Romania, with coordination and support from Europol, Frontex and INTERPOL. It aimed to detect and disrupt High-Value-Targets and organised crime groups – responsible for most human trafficking cases – as well as safeguarding victims, seizing criminal assets, and initiating follow-up investigations.The operation engaged nearly 15 000 officers from 43 different countries and involved law enforcement, border guards, labour inspectorates, tax- and customs authorities. Potential victims were reported from 64 different countries, with a majority from Romania, Ukraine, Colombia, China and Hungary. Many of the victims had been trafficked across borders, and even continents, demonstrating the global nature of human trafficking schemes. Investigations show that the vast majority of victims of sexual exploitation are female and adult, while the exploitation of underage victims is mostly connected to forced begging and forced criminal activity such as pickpocketing. In many of these cases, the safeguarding of victims can be challenging, as they are often exploited by family members.Jean-Philippe LecouffeDeputy Executive Director of Europol, Operations DirectorateClose and effective cooperation between international law enforcement and border authorities remains essential in protecting those who are most vulnerable to exploitation. The outcomes of this year’s operation ‘Global Chain’ are not just statistics, each individual safeguarded from exploitation represents an invaluable success. Human trafficking can only be tackled together, and I am thankful for all countries and partners who joined forces with Europol to support victims and pursue justice for them.Operational highlightsAustrian law enforcement arrested 7 suspected human traffickers (1 Hungarian, 6 Romanian citizens), while identifying and safeguarding 8 women. Based on the information exchange leading up to the action week, the Romanian family-based organised crime group could be identified and targeted. The criminals were active across several EU Member States in human trafficking for sexual exploitation and forced criminality. Victims were typically recruited using the ‘lover-boy method’ and then forced into prostitution. In addition, the victims were forced to defraud customers, tricking them to hand over large sums of money. In other cases, victims were forced to steal from their customers or lured them to remote places so the traffickers could rob them.Romanian police carried out house searches, summoned 11 witnesses and arrested 9 individuals for the trafficking of 8 child victims, aged 7 to 15, for the purpose of forced begging.In Italy, police raided several massage parlours with suspected links to sexual exploitation. They identified 75 potential trafficking victims from Romania, China and Colombia, and also seized drugs and firearms. An Italian suspect was arrested on trafficking charges. 5 other suspects from Italy, Tunisia, Colombia and the Philippines were arrested for other crimes. Several apartments used for forced prostitution were seized by the authorities.The Maltese Police Force arrested a suspected human trafficker and rescued 3 victims. 3 women (2 sisters and their aunt) from Colombia were offered employment as cleaners by an Italian national. Upon arrival in Malta, however, their passports were confiscated by the suspect under the guise of arranging work permits. The victims were then coerced into prostitution, with the suspect allegedly refusing to return their identification documents and demanding large sums of money in exchange for their return.Albania safeguarded 3 Chinese victims of sexual exploitation. The victims were recruited in Dubai, the United Arab Emirates, by a Chinese human trafficking organisation and then transferred to Albania, where they had to provide sexual services in a massage parlour. So far, 1 trafficker was arrested and another 1 declared as wanted.In Greece and Montenegro, law enforcement authorities arrested several individuals and identified others that were exploiting dozens their own children or close relatives for the purpose of begging. Many victims are as young as two or three years old, with others barely of teenage age. Seized firearms and drugs in Albania Picture from operation in Hungary In Hungary, the police was informed that a 15-year-old Hungarian girl was forced to perform prostitution on behalf of her own family. After a comprehensive and victim-centred interview, the minor stated that she was the only source of income for her own family and that her parents, who kept the majority of her daily income, ordered her to perform prostitution.The father of the victim was arrested during the action week and the victim, now 16-years old, was sheltered in a child-care institution.In Bosnia and Herzegovina, authorities were notified that a minor was forced into marriage by her parents and that the official “proposal” ceremony was to be held on the same day without her consent. When interviewing the victim, law enforcement officers could confirm that the victim’s parents were forcing her into marriage.There is a suspicion that the parents did this to ask for money based on a custom. The victim was placed in a safe house. In a separate case, 13 female victims of sexual exploitation were identified (9 from China and 4 from Brazil), and 3 traffickers were arrested (2 Bosnia and Herzegovina citizens and 1 Chinese citizen).Authorities in Ukraine carried out an undercover operation which exposed a criminal scheme to recruit and transport women to Berlin for the purposes of sexual exploitation. A Ukrainian woman was arrested and a search of her devices revealed evidence of online profiles advertising sexual services in Germany. Picture from operation in Ukraine Picture from operation in Brazil Federal Police in Brazil took down a trafficking ring that recruited victims under false promises of employment, then trafficked them to Myanmar for sexual exploitation.A victim being held captive in southeast Asia was added to an INTERPOL Blue Notice, allowing her to be monitored for safety and subsequently rescued.Thai police dismantled a prostitution ring involving minors, operating through a well-known social media platform.12 individuals were arrested, including seven for human trafficking crimes. 2 victims, aged 14 and 17, were rescued.Significant seizures were also made, including: EUR 277,669 in cash1 tonne of cannabis899 units of other narcotics30 firearms15 explosive components65 fraudulent documents5 real estate properties Picture from operation in Thailand An international response to an international threatEuropol, Frontex and INTERPOL supported the operation, which also led to 182 new investigations through international coordination. To assist officers in the field and support the real-time exchange of information, a coordination centre was set up at the Frontex headquarters in Warsaw, Poland, staffed by officials from 33 participating countries.Europol supported the action around the clock, with multiple experts providing analytical support, processing data and cross-checking it against the agency’s databases. One Europol expert was deployed to the coordination centre in Warsaw for the action week.INTERPOL contributed by providing access to its databases and international notices, as well as offering investigative and analytical support to cases that emerged or progressed during the operation.Throughout the operation days, countries acted on shared intelligence to raid known locations and carry out seizures. Law enforcement presence was also increased at hotspots and key transport hubs to identify both victims and suspects.During the six-day operation around 15 000 officers checked:924 392 individuals842 281 documents181 954 vehicles5 745 flights and vessels20 783 locationsOperation ‘Global Chain’ was carried out under the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT), with a high-value grant financing the deployment of Hungarian police officers to Germany and Romanian police officers to Switzerland, in order to conduct common actions. The operation also received funding from Interpol's I-FORCE Project and the German Federal Foreign Office.EU4FAST, the EU support project to strengthen the fight against migrant smuggling and trafficking in human beings in the Western Balkans, financed the deployment of officers from the region to the coordination centre in Warsaw. This year, AMERIPOL joined this international effort for the first time, financing the deployment of Brazilian and Colombian officers.Participating countries:Austria, Albania, Belgium, Bosnia and Herzegovina, Brazil, Bulgaria, Colombia, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Kosovo*, Latvia, Lithuania, Luxembourg, Malta, Moldova, Montenegro, Netherlands, Nigeria, North Macedonia, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Thailand, United Kingdom, Ukraine, Vietnam.* This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence.Participating agencies and projectsEuropol, INTERPOL, Frontex, EU4FAST, AMERIPOL

The 58-year-old suspect is accused of fatally stabbing a 26-year-old man with two knife wounds near Alexanderplatz in Berlin on the late evening of 18 March 2019. He is alleged to have waited for the victim near his workplace and to have attacked him suddenly and with intent to kill. He is believed to have entered Germany shortly before the planned act and to have left for Moldova immediately afterward. The two other suspects are believed to have either ordered the killing or passed on the order to someone else. The contract killing is believed to be linked to organised crime. The 58-year-old was arrested in Romania. The 57-year-old suspect was arrested the following day in Riga, Latvia, and the 44-year-old the day after that in Bucharest, Romania.On 27 June 2025, officers from the Berlin Police conducted searches at a total of six residential and commercial premises in Schöneberg and Mitte (Berlin), as well as in Falkensee (Brandenburg) in Germany in connection with the arrests. During the searches, various weapons – including a shotgun, several handguns and bladed weapons – as well as electronic data carriers and business documents were seized.The suspects were identified through intensive investigative work by the Berlin Police and the Berlin Public Prosecutor’s Office, with the support of Europol.The suspects are to be extradited from Romania and Latvia to Berlin. The investigation, particularly into the specific circumstances of the crime and its background, is ongoing.Support by EuropolEuropol supported the investigation led from Berlin from the outset. The agency provided analytical assistance, facilitated the exchange of information, and coordinated operational cooperation between the authorities in Germany, Moldova, Romania, and Latvia. Several operational meetings were held at Europol headquarters in The Hague in the preparation of the arrests.Involved authorities Germany: Berlin Public Prosecutor’s Office (Staatsanwaltschaft Berlin), State Criminal Police Officer Berlin (Landeskriminalamt Berlin)Latvia: State Police (Valsts policija)Moldova: General Police Inspectorate (Inspectoratul General al Poliției)Romania: Romanian Police (Poliția Română)