Crime News

Europol supported the French National Police (Police Nationale/OLTIM Perpignan) and the Spanish National Police (Policía Nacional/UCRIF Central) in dismantling an organised criminal network smuggling migrants of Algerian and Moroccan origin from Spain to France as well as in the opposite direction, from the United Kingdom to Spain. In addition to the arrests made in Spain and France, during action days, French law enforcement intercepted a British national connected to the wider criminal network. The suspect was caught in the act while transporting 12 irregular migrants from the United Kingdom to France across the Channel.The investigation, initiated in August 2024, has revealed the extensive operations of a criminal network involved in large-scale migrant smuggling across the European Union and beyond. Law enforcement authorities have so far uncovered 38 migrant smuggling instances directly linked to this network since the beginning of the investigation. Further intelligence and forensic analyses have enabled investigators to link an additional 100 smuggling incidents, which occurred since 2021, to the same criminal organisation. The network is believed to have facilitated the illegal entry of approximately 1 000 migrants into the EU. The smuggling activities were characterised by well-coordinated logistics and planning, indicative of a highly organised criminal network active across multiple jurisdictions in and out of the EU.The action days 13 to 16 June 2025 in France and Spain led to:7 arrests (3 in France and 4 in Spain)4 house searches (2 in France and 2 in Spain)Seizures included 4 vehicles, over EUR 50 000 cash in different currencies (euros, pounds and dirhams) and electronic devices From Spain to the UK and backThe migrant smuggling network, based in Barcelona, was operating under the coordination of its leader, based in Paris. Through close international cooperation, authorities were able to uncover the structure of the network, which facilitated the movement of irregular migrants via an established smuggling route from Murcia, Spain, towards France. However, since January 2025, investigators have also established that the network’s leader maintained regular contact with UK-based smugglers. These accomplices were responsible for transporting migrants from the UK back to Calais, concealed in cargo vans crossing the Channel by ferry. Members of the criminal network based in France would then drive the migrants to Spain, effectively creating a two-way smuggling operation and generating profits from both directions on the same migrant smuggling route.Wide net for smugglers with shifting tacticsThis criminal network had operational reach across two distinct migratory routes: the secondary movement of migrants from Spain across Western Europe and the English Channel route. The criminal facilitation of secondary movements across the EU consists of inland transfer of irregular migrants who initially entered the EU by sea via the Western Mediterranean and later moved from Spain to France. A feature of the business models used by the network was the use of vans rather than boats, to move migrants across the Channel. During the smuggling operations, migrants were transported from the UK to France in concealed compartments within commercial vehicles, often under extremely dangerous conditions. In many cases, they were found crowded in vans without proper ventilation or safety measures, or hidden among commercial goods loaded onto large cargo vehicles. In addition to the serious risks posed to the lives of the migrants, this method also illustrates the adaptability and cross-border coordination of the criminal organisation.Europol enabled the exchange of information and provided operational coordination, and analytical support. During the action days, Europol facilitated the deployment of one French investigator to Spain, and that of a Spanish investigator to France. Europol also deployed an expert to Spain to facilitate the real-time exchange of information and cross-check operational information against Europol’s databases, providing immediate leads to investigators in the field.

The action day led to:5 arrests (3 on the Canary Islands and 2 in Madrid)5 searches (3 on the Canary Islands and 2 in Madrid)Europol started supporting the investigation in 2023. Since then, Europol’s financial crime experts have assisted Spanish authorities by coordinating the investigation, providing operational support, and delivering strategic analysis. On the action day, a crypto specialist was deployed to Spain to assist national investigators, contributing to the successful completion of the operation.A network of criminal sales representatives around the worldTo carry out their fraudulent activities, the leaders of the criminal network allegedly used a net of associates spread around the world to raise funds through cash withdrawals, bank transfers and crypto-transfers. Investigators suspect the criminal organisation of having set up a corporate and banking network based in Hong Kong, allegedly using payment gateways and user accounts in the names of different people and in different exchanges to receive, store and transfer criminal funds. The investigation is ongoing.The following authorities took part in the investigation:Estonia: Police and Border Guard Board (Politsei- ja Piirivalveamet)France: New Caledonia National Gendarmerie (Gendarmerie Nationale)Spain: Guardia CivilUSA: Homeland Security Investigations (HSI)Online fraud: an epidemic threatening the EU’s internal securityOnline fraud is one of the main key threats to the EU’s internal security identified in Europol’s Serious and Organised Criminal Threat Assessment (EU SOCTA), published in March 2025. Online fraud is an epidemic affecting EU citizens, businesses and public institutions alike. The scale, variety, sophistication and reach of online fraud schemes is unprecedented. Europol expects online fraud to outpace other types of serious and organised crime as it is being accelerated by AI, aiding social engineering and access to data.

AI is a strong asset for law enforcement to strengthen its capacities to combat emerging threats amplified by digitalisation through the integration of new technical solutions in its tools box against crime. AI can help law enforcement to analyse large and complex datasets, automate repetitive tasks, and to support better informed decision-making. Deployed responsibly, it offers considerable potential to enhance operational capabilities and improve public safety. However, these benefits must be carefully weighed against the possible risks posed by bias, which may appear at various stages of AI system development and deployment. Such bias must be checked to ensure fair outcomes, maintain public trust, and protect fundamental rights. This report provides law enforcement authorities with the insights and guidance needed to identify, mitigate, and prevent bias in AI systems. This knowledge can play a crucial role in supporting the safe and ethical adoption of AI to ensure that the technology is used effectively, fairly and transparently in the service of public safety.Key recommendations for law enforcement:Document: Maintain detailed documentation of all AI lifecycle stages. This ensures traceability, accountability, and aids in identifying where biases may occur.Evaluate: Develop a comprehensive socio-technical framework, engaging a diverse group of stakeholders, to assesses technical accuracy and thoroughly considers historical, social and demographic contexts.Train all law enforcement personnel involved with AI tools to deepen their understanding of AI technologies to emphasise the value of human evaluation in reviewing AI-generated outputs to prevent bias.Test performance, impact and review indicators of potential bias before deployment.Perform case-by-case analysis and train to understanding different AI-biases, their relation with fairness metrics and implement bias mitigation methods.Continuously asses through the implementation of regular testing and re-evaluation of AI models throughout their lifecycle to detect and mitigate biases.Apply fairness testing and post-processing bias mitigation techniques on both AI system output and the final decisions made by human experts who rely on those outputs.Evaluate the context and objectives of each AI application, aligning fairness measures with operational goals to ensure both ethical and effective outcomes.Ensure contextual and statistical consistency when implementing AI models.Standardise fairness metrics and mitigation strategies across the organisation to ensure consistent practices in bias assessment. About Europol’s Innovation LabThe Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. This helps investigators and analysts to make the most of opportunities offered by new technologies to avoid the duplication of work, create synergies and pool resources.The activities of the Lab are directly linked to the strategic priorities as laid out in the Europol Strategy Delivering Security in Partnership, which states that Europol shall be at the forefront of law enforcement innovation and research.The work of the Europol Innovation Lab is organised around four pillars: managing projects to serve operational needs of the EU law enforcement community; monitoring technological developments that are relevant for law enforcement; maintaining networks of experts; acting as the secretariat of the EU Innovation Hub for Internal Security.

These numbers are sourced from Europol’s European Union Terrorism Situation and Trend Report 2025 (TE-SAT), published today. This flagship report – the only one of its kind in Europe - describes the major developments and trends in the terrorism landscape in the EU in 2024, based on qualitative and quantitative information provided by EU Member States and other Europol partners.Catherine De BolleEuropol Executive DirectorAs the TE-SAT report shows, terrorism and violent extremism are high priorities for EU Member States. The tense geopolitical context has continued to amplify violent extremist narratives, driving radicalisation within the EU. We’ve also seen a worrying rise in the number of minors and young people getting involved in terrorist and violent extremist activities across the EU. Terrorist groups target vulnerable individuals, especially those struggling with mental health issues, social isolation or digital dependency. These threats are becoming increasingly complex, reminding us that the threat of terrorism within the EU is neither static nor distant.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationThe TE-SAT clearly shows that terrorism and violent extremism remain serious threats. We must be particularly vigilant about the radicalisation of young people and the exploitation of online platforms by terrorists and extremists. Our Terrorist Content Online Regulation is already making a difference, helping us swiftly remove terrorist and extremist content. In ProtectEU, we have outlined further plans to counter these and other threats more effectively. Later this year, we will present a new Counter-Terrorism Agenda, adapted to today’s challenges, and we will strengthen our cooperation with the EU neighbourhood to better protect people in the EU. We will also continue working with online platforms to safeguard EU citizens from hatred and radicalisation—this is especially important for the most vulnerable, such as children.The threat of online communities inciting violenceAlmost 1 out of 3 suspects arrested for terrorism-related offences in 2024 was a minor or a young adult. The youngest offender was 12 years old, arrested for planning to commit an attack. Some recent cases of murder and attacks have been linked to online cult communities leveraging digital platforms to share and normalise extreme cruelty, extort victims and radicalise young individuals into performing acts of violence. The members of these groups specifically target vulnerable minors, on average aged between 8 and 17. Many of these violent groups have ideological connections with jihadist terrorism and violent right-wing extremism, occultism and satanism.Geopolitical developments impacting EU securityThe conflict in Gaza continued to have a major impact on the terrorist threat in the EU. There were numerous attacks and calls to violence across the entire ideological spectrum. Online terrorist and violent extremist propaganda instrumentalised the conflict and ignited hatred, with anti-Semitism being a common denominator in both. The Russian war of aggression against Ukraine was another driving factor for the spread of violent extremist narratives, radicalisation and mobilisation. In Syria, the collapse of Bashar al-Assad’s regime in early December 2024 and the formation of a government led by the leader of Hay’at Tahrir al-Sham (HTS) marked a significant shift with potential greater regional geopolitical implications in the medium and long term. Concerns are growing around the new leadership’s ability to fight terrorism, reports of radicalised violent extremists expressing their willingness to travel to the region, as well as the uncertain future for thousands of captives held in the prisons and camps now controlled by the Syrian Democratic Forces (SDF). These factors are collectively a growing cause for concern about future threats to the EU security.Abuse of emerging technologiesThe use of generative AI to create and disseminate propaganda and hate speech has reached unprecedented levels, especially in the right-wing scene. End-to-end encrypted communication platforms also continued to provide secure channels for communication, coordination, recruitment, dissemination of propaganda and incitement to mobilisation and violence.

The arrests follow multiple investigations into attempted murders ordered via encrypted platforms, including a recent attack on 7 May 2025 in Kokkedal. A total of seven individuals aged between 14 and 26 have now been arrested or surrendered to Danish authorities from abroad, notably Sweden and Morocco. Among those arrested are two 18-year-old men apprehended in Western Sweden and suspected of actively recruiting youngsters to commit targeted killings in Denmark and Sweden. Several suspects are also believed to have facilitated the attacks by providing weapons, ammunition and safe houses for the hitmen. These cases are part of a growing trend observed across Europe, where youngsters are recruited online to carry out violent crimes, often across borders. The criminal networks exploit social media to post contract offers for shootings, a modus operandi known as ‘violence-as-a-service’, that increasingly puts minors at the heart of cross-border organised crime.Torben SvarrerChief Police Inspector at the Danish National Special Crime UnitWe are stepping up our cooperation across the Nordic countries and through OTF GRIMM. We know what these criminal networks are doing, and we are determined to prevent these attacks. Let this serve as a warning to young people approached on social media with promises of easy money: our investigations show the reality is far less lucrative than promised, and the consequences can be severe.Theodor SmediusSuperintendent at the Swedish Police’s National Operations DepartmentThrough international police cooperation, we will continue the hunt for those fuelling violence from behind the veil of anonymity on digital platforms – wherever in the world they may be. At the same time, we must again stress the urgent need for platform owners to step up their self-monitoring and remove violent content. They have the technology to do this. When it comes to the safety of our children, both public authorities and private companies – including tech firms – must play on the same team.OTF GRIMM delivers resultsThese actions were supported by Europol through OTF GRIMM, an operational taskforce launched in April 2025 to tackle the growing use of encrypted services to coordinate contract killings across Europe. The taskforce currently brings together Belgium, Denmark, Finland, France, Germany, Iceland, the Netherlands, Norway, Sweden and Europol. Iceland is the most recent country to join, further strengthening the collective effort against violence-as-a-service. More countries are expected to follow in the coming months. Thanks to the intelligence shared within the taskforce, a number of important targets have already been arrested, with investigations continuing across Europe. Joint efforts with online service providers are also underway to help dismantle the criminal infrastructure enabling these attacks. Andy KraagHead of Europol’s European Serious Organised Crime CentreTeenagers being paid to pull the trigger — this is what organised crime looks like in 2025. We are not dealing with petty street crime. This is calculated outsourcing of murder by criminal networks that treat human lives as disposable assets. Through Europol’s OTF GRIMM, law enforcement is tracking down the masterminds and dismantling the infrastructure they hide behind. There is no safe haven — online or offline — for those who trade in violence.Parents and communities are encouraged to remain vigilant and look for early signs of criminal recruitment, such as sudden behaviour changes or unexplained possession of money or expensive items. Europol has developed an awareness guide offering practical advice to help protect young people from falling prey to these manipulative criminal schemes.Further updates on investigations and operational progress will be shared on the OTF’s dedicated landing page as law enforcement advances in tackling this urgent challenge.

The action day led to the following results:8 arrests, including the leaders of the criminal organisation (4 in Algeciras, 3 in Ceuta and 1 in Ibiza)7 property searches in Algeciras, Ceuta and IbizaSeizure of 22 kilos of cannabis and 10 800 tablets of a type of medication used by criminals to prepare a dangerous hallucinogenic mix known as “poor man’s drug”Seizure of almost EUR 50 000 in cashSeizure of 5 vehicles, 2 boats, weapons, electronic devices and navigation equipmentDuring the investigation, Europol provided expertise to the Spanish authorities and performed analysis of information that became crucial for the success of the operation. On the action day, an analyst was deployed on the ground to carry out checks against Europol’s databases, and facilitate the coordination of the operation.A “full package” costing over EUR 14 000 per personThe criminal organisation housed migrants in Morocco and smuggled them to Algeciras via Ceuta, in recreational boats. Each migrant paid up to EUR 14 600 for the journey from Morocco to Spain. There, the smugglers arranged accommodation for the migrants, where they lived in precarious conditions, with little access to food and often under constant threat. Along with migrants, the members of the criminal group simultaneously trafficked big amounts of cannabis resin to Spain, using the same vessels. On the way back to Morocco, the gang smuggled Clonazepam in order to maximise their benefits. The Spanish branch of the network operated from Ceuta and Algeciras, whereas the head of the Moroccan branch had his residence in Ibiza.  The criminal group, comprised of Spanish and Moroccan nationals, operated through a three-tiered hierarchical structure: leadership and coordination, maritime execution, and ground-level logistics.Minors lured to perform smuggling operationsThe network used minors as skippers in maritime smuggling operations, often recruited and trained by the organisation itself. This fact not only highlights and amplifies the risk of accidents and fatalities but also exposes vulnerable youngsters to exploitation and coercion. This practice illustrates the ruthless and dehumanising nature of criminal networks, which prioritise profits over human life.As mentioned in Europol’s EU Serious and Organised Crime Threat Assessment (EU-SOCTA) 2025, migrant smuggling has a high impact on the EU and its Member States, as it is a complex challenge that combines security threats with social implications. Fighting organised crime behind facilitation of irregular migrants to the EU requires concerted efforts and significant investment from law enforcement and other authorities. See footage from the operation here:

Between 11 and 13 June, a series of coordinated actions took place across Germany, the Netherlands, Romania, Spain, Sweden, targeting the platform’s administrator, moderators, key vendors, and technical infrastructure. Around 300 officers were deployed to carry out enforcement actions and secure critical evidence.Archetyp Market operated as a drug marketplace for over five years, amassing more than 600 000 users worldwide with a total transaction volume of at least EUR 250 million. With over 17 000 listings, it is one of the few darknet markets that allowed the sale of fentanyl and other highly potent synthetic opioids, contributing to the growing threat posed by these substances in Europe and beyond.As a result of the action, the platform’s infrastructure in the Netherlands was taken offline and its administrator – a 30-year-old German national – was arrested in Barcelona, Spain. In parallel, measures were taken in Germany and Sweden against one moderator and six of the marketplace’s highest vendors, and assets worth EUR 7.8 million seized.This operation led by the German authorities marks the end of a criminal service that enabled the anonymous trade in high volumes of illicit drugs, including cocaine, MDMA, amphetamines, and synthetic opioids. The platform’s endurance, scale and reputation within the criminal community place it alongside now-defunct darknet markets such as Dream Market and Silk Road, both notorious for their role in facilitating online drug trafficking.Europol’s Deputy Executive Director of Operations Jean-Philippe Lecouffe commented: With this takedown, law enforcement has taken out one of the dark web’s longest-running drug markets, cutting off a major supply line for some of the world’s most dangerous substances. By dismantling its infrastructure and arresting its key players, we are sending a clear message: there is no safe haven for those who profit from harm.The takedown follows years of intensive investigative work to map the platform’s technical architecture and identify the individuals behind it. By tracing financial flows, analysing digital forensic evidence, and working closely with partners on the ground, authorities were able to deliver a decisive blow to one of the most prolific drug markets on the dark web.Europol contributed to the efficiency and effectiveness of the international investigations. The agency organised multiple coordination meetings that made it possible for authorities to exchange critical information for the investigation. During the action days and the preliminary investigations, Eurojust coordinated the execution of mutual legal assistance and European Investigation Orders.A seizure banner has been published on the now-defunct marketplace. Further information, as well as a video aimed at the underground economy, is available online at www.operation-deepsentinel.comThe following authorities took part in or assisted with the investigation:Germany: Prosecutor General’s Office Frankfurt am Main – Cyber Crime Centre (Generalstaatsanwaltschaft Frankfurt am Main – ZIT), Federal Criminal Police Office (Bundeskriminalamt)Netherlands: National Police of the Netherlands (Politie)Romania: National Police (Poliția Română)Spain: National Police (Policía Nacional)Sweden: Swedish Police Authority (Polismyndigheten)United States: Homeland Security Investigations (HSI), IRS-Criminal Investigation (IRS-CI), U.S. Department of Justice (USDOJ)EuropolEurojust 

SIRIUS is an EU-funded project that helps law enforcement and judicial authorities access cross-border electronic evidence in the context of criminal investigations and proceedings. Co-implemented by Europol and Eurojust, the SIRIUS project is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence.The meeting in Warsaw focused on the impact of the recently adopted e-Evidence legislative framework, Digital Services Act, and the Second Additional Protocol to the Budapest Convention, which together mark a major shift in how electronic evidence is exchanged and cooperation is structured. The event provided an important forum to discuss how this legislative advancement can be operationalised at national and international levels, in synergy with ongoing EU policy developments.A key focus of this year’s gathering was how SPoCs and law enforcement authorities can respond to emergency situations, such as imminent threats to life or public safety. Dedicated sessions explored current processes and legal procedures, identifying challenges and outlining best practices for timely response. Participants also discussed emerging threats, the need to establish robust verification mechanisms and enhancing the SPoCs role.Furthermore, in line with its mission to support international cooperation, SIRIUS announced its plans to expand the SPoC concept beyond the EU, engaging with third countries and building new partnerships. These initiatives aim to create a more inclusive and effective global network for cross-border electronic evidence access. The discussion between the Project, LEAs and SPs focused on acquiring knowledge and ideas how to export the SPOC concept to the countries outside Europe, and consequently to improve cross-border cooperation in this topic. Upcoming pilot initiatives will involve capacity-building activities in non-EU countries.A strong emphasis was placed on the importance of a trusted and transparent public-private partnership, recognising that private companies—particularly major social media and fintech platforms—play a pivotal role in providing access to electronic evidence. Representatives shared updates on their evolving internal policies, increasingly aligned with new legal obligations. These exchanges helped build mutual understanding of legal frameworks, technical constraints, and user safety concerns. SIRIUS reaffirmed its commitment to strengthening this cooperation through capacity building, sharing knowledge and exchanging experiences as well as the development of tailored tools and training.For more information about SIRIUS activities, membership, or resources, please contact the SIRIUS team at sirius@europol.europa.eu.The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy (FPI) under contribution agreement No PI/2020/417-500.

The investigation targeted a criminal network that used companies in Costa Rica to receive cocaine from Colombia and conceal it in shipments of frozen yucca powder destined for Europe. The group relied on legitimate logistics chains to disguise their criminal activities and move cocaine by sea and air in small quantities to avoid detection.Shifting logistical routes in response to law enforcement pressureDue to intensified police pressure on other well-known ports such as Guayaquil in Ecuador, criminal organisations have increasingly sought alternative, what they believed to be more secure locations for their operations. This drug trafficking organisation has turned to Costa Rica in recent years as a logistical base to receive cocaine shipments from Colombia, store them, and prepare them for shipment to Europe.The criminal network’s most common modus operandi involved concealing cocaine in thin sheets hidden within frozen yucca powder. Due to the density and colour of the product, the cocaine went undetected by scanner systems during customs inspections. The use of frozen cargo also rendered the shipments undetectable to drug-sniffing dogs.This concealment technique allowed the organisation to repeatedly traffic cocaine to Europe.Two-phase takedown across Spain, Portugal and Costa RicaThe first phase of the operation took place on the European continent last year. In the summer of 2024, the Portuguese authorities carried out controlled deliveries and arrested the alleged recipients of these shipments. A total of 7 individuals were arrested then.Later that year, the Spanish authorities followed with the arrest of an additional 13 individuals, including one high-value target.The suspects had established logistics companies to give the shipments a legal appearance and played key roles in transport and distribution. Among those arrested was a Dominican national based in Barcelona who had purchased the cocaine and intended to distribute it across Europe.The second phase took place in Costa Rica on 11 June 2025, targeting the core of the criminal organisation. Costa Rican authorities carried out 12 arrests, including the leader of the organisation, and conducted 20 home searches.To date, the operation has led to 21 seizures across Costa Rica, Belgium, Spain, Portugal, Germany, and the Netherlands, with authorities seizing a total of 5.4 tonnes of cocaine. The series of arrests have led to the dismantling of the entire criminal organisation, both the supplier side operating in Costa Rica and the receiving side in Europe.International coordinationEuropol supported the EU Member States involved in the operation by facilitating the secure exchange of intelligence, providing analytical expertise, and coordinating joint operational activities. Europol also hosted several strategic and operational meetings to ensure seamless collaboration between the national authorities.The investigation was carried out on the European side under the umbrella of an Operational Task Force (OTF) at Europol, which provided a robust platform for multi-agency collaboration and ensured the smooth progress of the case across jurisdictions.The coordination between European partners and Costa Rica was effectively strengthened through the GDIN Project — a framework designed to enhance cooperation and information sharing between EU law enforcement agencies and third countries like Costa Rica. The GDIN Project is financed by the European Union’s ISF and led by the Spanish Guardia Civil.The following authorities took part in the investigation:Costa Rica: Drug Control Police (Policía de Control de Drogas)Portugal: Judicial Police (Polícia Judiciária)Spain: Guardia CivilFootage from the operation:

Europol’s 2025 Internet Organised Crime Threat Assessment (IOCTA), published today, reveals how stolen data fuels the digital underworld, powering a criminal ecosystem that spans from online fraud and ransomware to child exploitation and extortion. The report paints a stark picture of a cybercrime economy built on access—access to your systems, your identity, and your most sensitive information.The Head of Europol’s European Cybercrime Centre, Edvardas Šileris, commented: “You can’t defend what you don’t understand. Europol’s IOCTA 2025 report sheds light on the hidden economy of stolen data that powers today’s most dangerous cyber threat, giving law enforcement, policymakers, and industry the intelligence needed to act decisively.”From phishing to phone scams, and from malware to AI-generated deepfakes, cybercriminals use a constantly evolving toolkit to compromise systems and steal personal information. These stolen credentials and data sets are then sold, resold, and repackaged by data and access brokers operating across dark web forums, encrypted channels, and subscription-based criminal marketplaces.Social engineering, reimaginedThe report highlights a rise in the use of generative AI, including Large Language Models, to supercharge social engineering attacks. Criminals now tailor scam messages to victims’ cultural context and personal details with alarming precision. Child sexual exploitation perpetrators are also using AI to scale up grooming attempts and make coercion attempts more effective.Data is no longer just the target—it’s a commodityCybercriminals no longer need technical skills to succeed. Crime-as-a-service platforms now offer everything from stolen data to step-by-step fraud tutorials. Access credentials to remote services, compromised corporate networks, and even personal logins are sold in bulk.Stolen data is also weaponised for extortion, identity theft and abuse—including against children.New threats, old vulnerabilitiesInitial access brokers and ransomware groups continue to exploit known system weaknesses and manipulate human behaviour.Even popular error messages and CAPTCHA boxes are being mimicked in a tactic known as "ClickFix" to trick users into installing malware themselves.While encryption protects users’ privacy, the criminal abuse of end-to-end encrypted (E2EE) apps is increasingly hampering investigations. Cybercriminals hide behind anonymity while coordinating sales of stolen data, often with no visibility for investigators.Recommendations for actionTo counter these threats, the report calls for coordinated policy responses at EU level, including lawful access solutions for E2EE, harmonised rules on data retention, and urgent efforts to boost digital literacy—especially among young people.The IOCTA 2025 draws on operational insights from the thousands of investigations Europol supports each year, particularly through its European Cybercrime Centre (EC3) and its Economic and Financial Crime Centre (EFECC), with contributions from Member States, and private sector partners. It builds on the EU Serious and Organised Crime Threat Assessment (SOCTA) and sheds light on a criminal landscape where data is power—and everyone’s data is at risk.

Results of the operation:48 suspects arrested3.8 tonnes of cocaine seized29 house searches in Fuerteventura (2), Gran Canaria (13) and Lanzarote (14)69 vehicles seized (19 boats and speedboats)6 properties seizedEUR 100 000 in cash seizedEuropol played a key role in the investigation by providing crucial analytical and financial support that contributed to the success of the operation. On the action day, a Europol specialist was deployed to Spain to support authorities in the field.Speedboats and satellite terminalsFollowing months of investigation, authorities arrested some 50 members of a criminal network on 3 June. The network introduced cocaine from South America to the European Union by using a sophisticated maritime infrastructure.The gang owned 11 speedboats that were used repeatedly, departing from strategic points in the Atlantic Ocean to a mother ship transporting the cocaine. After loading the drugs onto the speedboats, the suspects dropped them off in the Canary Islands, ready for distribution.Additionally, the criminal network used a complex encrypted communications system to evade law enforcement, including the use of satellite terminals, hard-to-trace phones and a coded language.Crucial police cooperationThis successful joint investigation involved the following authorities from both sides of the Atlantic Ocean: Portugal: Judiciary Police (Polícia Judiciária)Spain: National Police (Policía Nacional)Colombia: National Police (Policía Nacional)UK: National Crime Agency (NCA)USA: Drug Enforcement Administration (DEA)Maritime Analysis and Operations Centre (MAOC, Narcotics)

On 3 June, law enforcement carried out raids in five major cities across Bulgaria under the supervision of the Burgas Prosecutor’s Office. Officers from Greece, Romania and Moldova joined Bulgarian investigators on the ground, with Europol also deployed to support the action. In total, 18 people were arrested, including a high-value target.The criminal network used a variety of vehicles to smuggle migrants across borders, including vans, trucks, tourist caravans and even car assistance platforms. Many of these were fitted with custom-built hiding compartments that the members of the smuggling network patched together in Türkiye, Bulgaria and Romania. These modifications allowed the vehicles to travel directly to destination countries without stopping in shelters or transfer points along the way.This action was part of a wider investigation under a Europol-coordinated Regional Operational Task Force based in Sofia, targeting organised crime groups smuggling migrants through Bulgaria and into Western Europe.Up to EUR 8 500 to reach the EU from SyriaThe criminal network – composed of Bulgarian, Romanian and Syrian nationals – smuggled mostly Syrian nationals from Türkiye through Greece and Bulgaria, using the Balkans as a key transit route. Migrants typically paid EUR 2 000 to 2 500 to cross from Syria into Türkiye. After several months in Türkiye, they were charged an additional EUR 5 000 to 6 000 to be smuggled into the EU.Smugglers recruited drivers directly in Bulgaria, while others – including Moldovans – were recruited online. In a separate case, Bulgarian intelligence led to the discovery of eight migrants hiding in floor compartments of a caravan in Türkiye.Use of false documents and parallel financial systemsThe organised crime group used falsified documents to support their operations. These included fake driving licences issued in Romania, Greece and the United Kingdom, as well as fraudulent vehicle registration documents. Since June 2024, 14 smuggling attempts linked to this criminal network have been detected – 8 in Bulgaria, 2 in Greece, 1 in France and 3 in Türkiye. Five of the drivers were found with fake licences, and in ten other cases, fraudulent vehicle documents were used.The network relied on the underground Hawala system to move money between Türkiye and Bulgaria, with additional transfers made through Western Union by an intermediary.Europol supportEuropol has supported the investigation since the outset, providing analytical and operational support through the Sofia-based taskforce. The agency also facilitated multiple coordination meetings and the exchange of operational intelligence between involved countries.On the action day, Europol deployed an expert with specialised equipment to Bulgaria, enabling the real-time cross-checking of data and enhancing the flow of intelligence on the ground.The following authorities took part in the investigation:Bulgaria: Prosecutor’s Office – Burgas City; General Directorate Border Police; General Directorate for Combating Organised Crime.Greece: Thessaloniki Alien Division.Moldova: General Police Inspectorate.Romania: General Inspectorate Border Police; General Directorate Combating Organised Crime.

On the action day, 50 handguns of one specific make, 13 further handguns, 4 machine guns, 4 rifles, 1 revolver, 2 alarm pistols, 4 large-capacity magazines for automatic weapons, 16 other magazines and 2 homemade clubs were seized. In one location, law enforcement officers found a drug laboratory and over 450 kilos of a novel synthetic drug. Furthermore, the site was used as a storage facility for illegal cigarettes.Months-long investigation into firearms traffickers' networkBelgian law enforcement had been investigating this criminal network for months, gaining insight into the organisers, their helpers and various buyers. The firearms traffickers based in Belgium allegedly had contacts with weapon traffickers based all over Europe, including Austria. The Austrian suspects, of which two were arrested in Belgium, are believed to have supplied a large number of weapons to the criminal network. They were already known to law enforcement for obtaining large amounts of weapon parts in Austria and illegally exporting them.Certain weapon parts can be obtained without a license in Austria. This legal situation is often misused by criminals to assemble weapons with parts obtained from various sources. After the arrest of the two individuals residing in Austria and the seizure of 50 handguns by the Belgian police, the Austrian Directorate State Protection and Intelligence Service was able to determine that the grips of these weapons were purchased in Austria. Subsequently, house searches were carried out at the residences of those arrested, as a result of which several data storage devices were seized.Europol supported the national investigations with operational analysis and coordinated the international cooperation by organising operational meetings. On the action day conducted in Belgium, a Europol expert was deployed with a mobile office to provide cross-checks of new evidence against Europol’s databases.

The referral day took place only a few weeks after Europol launched a new Operational Taskforce to tackle the rising trend of recruiting young perpetrators into serious and organised crime. Recent data provided to Europol reveals that minors are now involved in over 70% of criminal markets. Protecting children from being recruited and exploited by criminal networks is one of Europol’s key priorities.Catherine De BolleEuropol’s Executive DirectorTerrorist groups are increasingly targeting young people, exploiting their vulnerabilities but also their abilities to manage online capabilities to advance violent and extremist agendas. Strong collaboration between public authorities and private sector partners is essential to prevent the radicalisation of minors into harming themselves and our society.New wave of propaganda using broader manipulation tacticsTerrorist organisations and their online supporters have developed new tactics to recruit and gain followers, tailoring their message and investing in new technologies and platforms to manipulate and reach out to minors. The propaganda identified during the operational action included content combining images and videos of children with extremist messaging, as well as materials offering guidance to radicalised parents on raising future jihadists.One of the key observations that led to this coordinated action is the use of AI, particularly in the creation of images, text and videos designed to resonate with younger audiences. Propagandists invest in content, short videos, memes, and other visual formats, carefully stylised to appeal to minors and families that may be susceptible to extremist manipulation, as well as content incorporating gaming elements with terrorist audio and visual material. Another type of targeted content is the glorification of minors involved in terrorist attacks. In this regard, terrorist propaganda predominantly targets male minors, manipulating them into joining extremist groups by promoting heroic narratives that portray them as “warriors” and the “hope” of society. Female minors are referenced less frequently, with their roles largely confined to raising and indoctrinating future “fighters” for the cause. Another manipulation technique that has been worrying for the past years is the increased use of victimhood narratives, particularly imagery of wounded or killed children in conflict zones. This manipulation serves a dual purpose: it fosters emotional identification with the victims while simultaneously inciting a desire for retaliation and further violence.In 2024, EU Member States law enforcement authorities contributed to a large number of terrorism related cases involving minors. Europol’s European Counter Terrorism Centre keeps on supporting Member States in preventing and investigating dissemination of terrorist content online to ensure a safer cyberspace for European citizens.The following countries participated in the Referral Action Day (RAD): Albania, Austria, Belgium, Bosnia-Herzegovina, Czech Republic, Denmark, Germany, Hungary, Ireland, Malta, Portugal, Serbia, Slovenia, Spain, Ukraine and the United Kingdom.

Two main organisers identifiedIn June 2024, the French authorities seized 216 kilograms of crystal methamphetamine and arrested two French nationals in connection with the case. The subsequent criminal investigation revealed a criminal network involved in the production and trafficking of synthetic drugs with strong ties to the Mexican Sinaloa cartel as well as to criminal gangs active in Belgium, Spain, the Netherlands and New Zealand.The two main organisers of the network relied heavily on the logistical support, expertise and preparation provided by the Mexican cartels. In turn, these cartels depended on local intermediaries to anchor their operations and expand their influence. This interdependence underscores the transnational nature of the network and the cooperation between criminal actors across continents.Investigators established that the chemicals used in the production of the synthetic drugs had been sourced from China. The pieces of evidence collected during the probe led to the identification of the main organisers, one Algerian and one French national. The two suspects are allegedly responsible for the whole production and dissemination chain including the smuggling of pre-precursors, setting up the lab, “cooking” of the drugs and their subsequent trafficking. They used cryptocurrency to facilitate the illegal financial transactions.The action day on 19 May led to:16 arrests (1 Belgian, 13 French, 1 Serbian and 1 Mexican/American), 15 in France and 1 in Belgium;16 house searches;Seizures including 3 vehicles and luxury goods valued at about EUR 100 000, almost EUR 80 000 in bank accounts, phones and other electronics, and about EUR 10 000 in cash.In addition, some EUR 30 000 in cryptocurrency has been frozen. That part of the investigation is still ongoing with further seizures expected down the line.Synthetic drug production on the rise across the EUDuring the action day, officers searched a former drugs lab site, where they found traces of methamphetamine production. They also discovered evidence of chemical dumping, including discarded containers, chemical residues, and signs of illicit waste disposal such as burying and dumping in the surrounding area, indicating attempts to conceal the scale of the synthetic drug manufacturing activities.Such illegal production labs are not new to the EU. However, production and trafficking of synthetic drugs in the EU are rising sharply, as highlighted in the EU Serious and Organised Crime Threat Assessment 2025 (EU SOCTA). Once limited to a few regions, production now spans more EU Member States, supplying both domestic and global markets. Driven by high profits, the trade is marked by violent competition, corruption, and the infiltration of legal business structures. Already in 2022, a joint Europol-DEA report revealed the increasing collaboration between Mexican cartels and EU-based criminal networks. These alliances have been seen to support the trafficking and local production of methamphetamine and cocaine in Europe. Specifically, successful operations have revealed that Mexican groups provide their EU criminal associates with technical know-how such as skilled methamphetamine “cooks” and help establish cocaine conversion labs.  Europol facilitated the exchange of information and provided continuous analytical support to the investigation. Europol also contributed to the overall case coordination among various agencies. On the day, the agency deployed an expert to Marseille to cross-check operational information in real time and support the investigators in the field.

The group composed of up to 20 Dutch nationals was based mostly in the greater Utrecht area, with some individuals based in Amsterdam. As a highly specialised criminal group, they are believed to have targeted cash machines across several Federal States in Germany. Investigations have shown an increasingly sophisticated approach by the criminals, who take measures such as counter-surveillance, collaborate with other groups and rely on infrastructure such as garages when performing the robberies. Dutch and German law enforcement, supported and coordinated by Europol, dealt a series of strikes against the suspected ATM robbers.On 17 April 2024, seven were arrested.On 21 August 2024, one was arrested.On 27 November 2024, four were arrested.On 3 May 2025, one was arrested in Spain.On 13 May 2025, three were arrested.On 27 May 2025, two were arrested.All actions except for the arrest in Spain took place across the Netherlands. Law enforcement authorities performed dozens of house searches, seizing over EUR 360 000 in cash, including bills stained by dye packs. Further, a crypto wallet allegedly used for money laundering worth over EUR 600 000 was seized, along with a large amount of gear used in ATM attacks. This includes explosives, jerrycans with gasoline, license plates, SIM cards, cash counting machines and vehicles, including four linked to several robberies.Cold-blooded robberies and ruthless getawaysThe perpetrators apprehended in this operation followed an established criminal modus operandi: first, they scout for suitable attack sites across several countries, both online and on-site. Easily accessible cash machines with comparatively modest security measures and convenient getaway options are preferred targets. After identifying and scoping out potential attack locations, the robbers return during the night and rig the cash machines with solid explosives. Activated from a short distance, the detonations typically not only destroy the ATMs but also devastate the surrounding area.As these attacks are often performed in residential areas, they can cause serious harm to buildings and their residents. Upon grabbing the accessible cash, the criminals use high-powered vehicles for their hasty getaways. This criminal phenomenon stands out for its unscrupulous nature and the extreme risks taken by the perpetrators, both at the crime scene and during the escape.Europol’s support to the affected countriesIn recent years, this criminal phenomenon has spread and moved across several EU countries. With law enforcement and financial institutions teaming up to increase ATM safety features in heavily affected areas, the criminals shift their focus to easier targets, often travelling long distances to perform the attacks.To tackle this, law enforcement agencies from across the EU are continuously expanding cross-border collaboration. An Operational Taskforce was set up at Europol, bringing together investigators from several affected Member States. Following a cohesive and effective strategy, they jointly developed an intelligence picture and planned a series of coordinated actions against the perpetrators.For this series of hits against this internationally active criminal group, a Joint Investigation Team (JIT) was formed between Europol and law enforcement and judicial authorities from the Netherlands and Germany. Europol experts with mobile offices were deployed to several action days, performing cross-checks of the operational results against Europol’s databases.The EU project ISF Lumen has provided financial support to the police authorities in the fight against this criminal phenomenon. Among other things, the funds were used to purchase special observation technology.Participating countries:Germany: Federal Criminal Police Office (Bundeskriminalamt); State Criminal Police Office Nordrhein-Westfalen (Landeskriminalamt Nordrhein-Westfalen); Public Prosecutor’s Offices Osnabrück and Düsseldorf (Staatsanwaltschaft Osnabrück, Staatsanwaltschaft Düsseldorf – ZeOS NRW)Netherlands: Politie Midden-Nederland; Public Prosecutor’s Office Utrecht (Midden-Nederland) 

The operation took place in April 2025 and led to:14 arrests (11 in Belgium, 2 in Germany, 1 in Italy)11 house searches in Belgium and ItalyThe seizure of over 780 kg of cocaineThe dismantlement of an underground laboratoryCocaine paste shipped from Colombia to the EUIn the framework of intelligence activities underway with its operational counterparts in the framework of the SKY ECC investigation, Europol developed reliable intelligence concerning the international drug trafficking activities of this organised crime group operating in several countries in Europe.The gang was led by an Italian family in contact with suppliers in Colombia and chemists in Belgium. They imported huge amounts of cocaine paste, shipped from Colombia to European ports. Once in the European Union, they stored the product in warehouses in Belgium, which were used as laboratories for the synthesis process. The criminal organisation was also engaged in heroin trafficking and money laundering. Underground lab dismantled during the operation Crucial cooperation led by EuropolInternational cooperation was key in this case against organised crime and drug trafficking. Europol coordinated the different law enforcement authorities involved in the operation and provided the key intelligence to the Belgian authorities to kick off the investigation. Europol’s analysts played a central role, facilitating the exchange of information and providing analytical support to national investigators, which helped identify the key targets and map the full spectrum of their criminal activities.Eurojust set up a joint investigation team between the Belgian and Italian authorities to ensure critical information for the Belgian investigation was shared by their Italian counterparts.Authorities involved in the investigation:Belgium: Federal Judicial Police (Police Judiciaire Fedérale du Brabant Wallon)Italy: Carabinieri (Carabinieri – Borgo San Lorenzo Unit)Germany: BKASwitzerland: Federal Police (fedpol)EuropolEurojustThe investigation and the Action Day itself have been supported by the @ON Network funded by the EU (Project ISF4@ON) led by the Italian Antimafia Investigation Directorate (DIA).Drug trafficking networks destabilise societyAs Europol already flagged in the 2025 EU Serious and Organised Crime Threat Assessment (EU-SOCTA), the threat posed by drug trafficking networks has increased over the past years and will continue to do so in the future. By using tools like money laundering, like in this case, drug trafficking networks destabilise society and undermine legal economies and trust in institutions.That’s why Europol identified drug trafficking as one of the fastest-growing threats, where criminals are becoming more sophisticated and dangerous, and will tackle it strategically in the upcoming years.  

Between 12 and 23 May 2025, victim identification experts from over 30 countries and Europol analysed hundreds of images and videos depicting unidentified victims of child sexual abuse during the 16th edition of the Victim Identification Task Force (VIDTF). This two-week operation at Europol’s headquarters is dedicated to tracking down perpetrators and identifying victims across 100 million images and videos of child sexual abuse material, seized by law enforcement agencies worldwide and contributed to Europol’s databases.The collaborative nature of the task force is one of its greatest strengths. Investigators brought with them specific professional expertise as well as a rich variety of cultural perspectives and language skills, which are crucial in navigating the global scope of these crimes. The diverse backgrounds often prove crucial in interpreting subtle clues perceived on the imagery that can lead to identifying a location or a victim.More than 50 cases referred to national authorities for further investigationDuring the two-week operation, participants examined about 250 datasets, each depicting an unidentified child victim. Thanks to their meticulous analysis and shared knowledge, the likely country of offence was determined in about 190 datasets. Europol has already shared more than 50 of these cases with national authorities, with further dissemination ongoing. So far, three of the victims have been identified and safeguarded by the relevant national authorities.The analysed datasets varied from recordings of direct sexual exploitation committed by unknown offenders against child victims, to recordings of livestreamed sexual exposure committed by minors due to enticement and coercion by various offenders. The victims shown span all ages and come from various regions around the world, from toddlers to adolescents, highlighting the horrific reach and indiscriminate nature of these crimes.Identifying victims in such a large volume of materials is made even more complex by the ever-growing digital landscape. Since 2014, VIDTF operations have helped safeguard over 940 children and contributed to the arrest of more than 283 offenders. These figures reflect the real-world impact of coordinated, cross-border efforts in the fight to protect the most vulnerable.Check the new uploads – no clue is too small!Help us identify the origin of certain objects visible in child abuse material. Just one lead can save a child. Read about Europol’s Trace an Object initiative and see if you recognise any of the objects in the images. Europol has just released a new series of pictures containing non-confrontational details of images extracted from child sexual abuse cold cases. Just as investigators from across the globe contribute through their diverse cultural insights, language skills, and local knowledge, members of the public are encouraged to bring their own unique perspectives to this collective effort. Whether it's recognising a regional brand, a household item common in a specific country, or a language cue, your input could be pivotal. No detail is too small—and your engagement could help safeguard a child or assist in bringing an abuser to justice.Note to media:Europol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting.The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.The following countries took part of the VIDTF 16:EU Member States: Belgium, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, the Netherlands, Poland, Romania, Slovenia, Spain, SwedenNon-EU Member States: Albania, Australia, Bosnia and Herzegovina, Canada, Georgia, Moldova, New Zealand, North Macedonia, Norway, Serbia, Switzerland, United Kingdom, United StatesEU agencies and international organisations: Europol, INTERPOL, The Council of Europe, through its CyberSEE project, and the project “Fighting against Organised Crime in the Eastern Partnership region” also supported the VIDTF 16.

In addition, EUR 3.5 million in cryptocurrency was seized during the action week, bringing the total amount seized during the Operation Endgame to more than EUR 21.2 million.This latest phase of Operation ENDGAME follows on from the largest-ever international action against botnets in May 2024. It targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise.The operation focused on initial access malware – the tools cybercriminals use to infiltrate systems unnoticed before deploying ransomware. By disabling these entry points, investigators have struck at the very start of the cyberattack chain, damaging the entire cybercrime-as-a-service ecosystem.The following malware strains were neutralised during the action:BumblebeeLactrodectusQakbotHijackloaderDanaBotTrickbotWarmcookieThese variants are commonly offered as a service to other cybercriminals and are used to pave the way for large-scale ransomware attacks. In addition, international arrest warrants were issued against 20 key actors believed to be providing or operating initial access services to ransomware operators.Catherine De BolleEuropol Executive Director"This new phase demonstrates law enforcement’s ability to adapt and strike again, even as cybercriminals retool and reorganise. By disrupting the services criminals rely on to deploy ransomware, we are breaking the kill chain at its source."Operation Endgame is an ongoing, long-term oriented, large-scale operation conducted jointly by several law enforcement agencies around the world against services and infrastructures assisting in or directly providing initial or consolidating access for ransomware.European coordinationEuropol supported the operation from the very beginning, providing coordination, operational and analytical support, cryptocurrency tracing, and facilitating real-time information exchange between the different partners involved.A Command Post was set up at Europol headquarters in The Hague during the action week, with investigators from Canada, Denmark, France, Germany, the Netherlands,  the United Kingdom and the United States working with Europol’s European Cybercrime Centre and its Joint Cybercrime Action Taskforce. The Command Post coordinated law enforcement actions, managed intelligence on seized servers, and oversaw the implementation of the operational action plan.Eurojust has provided essential support to make judicial cooperation effective since the beginning of the investigation in 2024. Coordination by Eurojust ensured that authorities were able to exchange information and align their investigative efforts.Suspects to be added to EU Most Wanted listSeveral key suspects behind the malware operations are now subject to international and public appeals. The German authorities will publish 18 of them on the EU Most Wanted list as of 23 May.The suspects are believed to have provided or operated the tools that enabled criminal groups to access victim networks and launch large-scale ransomware attacks.Looking ahead: IOCTA 2025 to spotlight access brokersAs cybercriminals continue to innovate, law enforcement is adapting its strategy to stay ahead. The upcoming Europol Internet Organised Crime Threat Assessment (IOCTA) 2025, to be published on 11 June, will place a strong focus on initial access brokers, reinforcing the importance of tackling the early stages of cyberattacks.Operation Endgame will now continue with follow up actions announced on the dedicated website of the international law enforcement partners.Participating countriesCanada: Royal Canadian Mounted Police (RCMP)Denmark: Danish Police (Politi)France: National Police (Police Nationale), National Gendarmerie (Gendarmerie Nationale), Public Prosecutor Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit, Paris Judicial Police (Préfecture De Police de Paris)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General's Office Frankfurt am Main – Cyber Crime CenterThe Netherlands: National Police (Politie), Public Prosecution Office (Openbaar Ministerie)The United Kingdom: National Crime AgencyThe United States: Federal Bureau of Investigation, United States Secret Service, The Defense Criminal Investigative Service, United States Department of Justice

The suspects were identified through coordinated investigations based on intelligence from the takedowns of the dark web marketplaces Nemesis, Tor2Door, Bohemia and Kingdom Markets. Many had conducted thousands of sales on illicit marketplaces, using encryption tools and cryptocurrencies to cover their tracks — but law enforcement closed in.This international action follows Operation SpecTor in 2023, which led to 288 arrests. Together, these operations show the increasing ability of law enforcement to penetrate the dark web’s cloak of secrecy.Dark web vendors unmaskedThe 270 arrests took place in the following countries:United States of America: 130Germany: 42United Kingdom: 37France: 29South Korea: 19Austria: 4The Netherlands: 4Brazil: 3Switzerland: 1Spain: 1Investigations are ongoing to trace and apprehend more individuals involved in dark web crime.Millions seized, weapons recoveredIn parallel with the arrests, officers seized:Over EUR 184 million in cash and cryptocurrenciesOver 2 tonnes of drugs, including amphetamines, cocaine, ketamine, opioids and cannabisOver 180 firearms, along with imitation weapons, tasers and knives12 500 counterfeit productsMore than 4 tonnes of illegal tobaccoThese seizures represent a major disruption to the criminal supply chains that feed the dark web economy.Europol's roleEuropol supported the action by compiling and analysing intelligence packages based on data from the three seized marketplaces. These packages were then shared with national authorities in the framework of the Joint Cybercrime Action Taskforce, hosted at Europol’s headquarters, to enable targeted investigations.This operational model, also used in 2023’s Operation SpecTor, demonstrates that the takedown of a criminal platform is not the end of the story — it is the beginning of follow-up investigations aimed at identifying and arresting high-value vendors.Edvardas ŠilerisHead of Europol’s European Cybercrime CentreOperation RapTor shows that the dark web is not beyond the reach of law enforcement. Through close cooperation and intelligence sharing, officers across four continents identified and arrested suspects, sending a clear message to those who think they can hide in the shadows. Europol will continue working with our partners to make the internet safer for everyone.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationThis operation is proof of how criminal gangs operate today: offline and online, internationally and locally, using technology to their full advantage. To counter this, coordinated action is essential. And that is exactly the added value Europol provides. Thank you and congratulations to all the authorities involved. To stay effective in a rapidly changing world, we also need to better support our law enforcement agencies to make them future proof. And that is exactly what we aim to do with ProtectEU, our Internal Security Strategy. We also need to strengthen Europol — with more funding and with an updated mandate.Changing tactics, same threatRecent operations are reshaping the dark web landscape. With traditional marketplaces under increasing pressure, criminal actors are shifting to smaller, single-vendor shops — sites run by individual sellers to avoid marketplace fees and minimise exposure.Illegal drugs remain the top commodity sold on the dark web, but 2023 also saw a surge in prescription drug trafficking and a rise in fraudulent services, including fake hitmen and bogus listings designed to scam buyers. Despite these shifts, the message is clear: no platform is beyond the reach of coordinated, international law enforcement efforts.This global action was made possible thanks to the close cooperation between the following authorities:Austria: Criminal Intelligence Service Austria with various Provincial Criminal Police Departments (Bundeskriminalamt und Landeskriminalämter)Brazil: Civil Police of the State of Pará (Polícia Civil do Estado do Pará) and Civil Police of the State of São Paulo (Polícia Civil do Estado do São Paulo)France: French Customs (Douane), National Gendarmerie (Gendarmerie Nationale)Germany: Federal Criminal Police Office (Bundeskriminalamt); Prosecutor’s Office in Cologne – Central Cybercrime Contact Point (Staatsanwaltschaft Köln, Zentral- und Ansprechstelle Cybercrime); Central Criminal Investigation in Oldenburg (Zentrale Kriminalinspektion Oldenburg); various police departments (Dienststellen der Länderpolizeien); German Customs Investigation (Zollfahndungsämter)The Netherlands: Team High Tech Crime (National Investigations and Special Operations (NIS) and Post Interventie Team (PIT); National Intelligence, Expertise and Operational Support (NIEO)Spain: National Police (Policía Nacional)South Korea: Seoul Central District Prosecutors’ Office – Darknet Investigations UnitSwitzerland: Zurich Cantonal Police (Kantonspolizei Zürich) and Public Prosecutor's Office II of the Canton of Zurich (Staatsanwaltschaft II)United Kingdom: National Crime Agency (NCA); National Police Chiefs’ Council (NPCC)United States: Department of Justice (DOJ) with the JCODE partner agencies (Federal Bureau of Investigation (FBI)m Drug Enforcement Administration (DEA); Food and Drug Administration (FDA)-Office of Criminal Investigations; Homeland Security Investigations (HSI); Internal Revenue Service (IRS)–Criminal Investigation; US Postal Inspection Service (USPIS); Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF); Army Criminal Investigation Division (Army-CID); Customs and Border Protection (CBP); Department of Justice (DOJ); Department of the Treasury Financial Crimes Enforcement Network (FinCEN); Department of the Treasury Office of Foreign Assets Control (OFAC); Naval Criminal Investigative Service (NCIS)) 

Operational highlightsThe Italian Carabinieri Command for the Protection of Cultural Heritage (TPC) in coordination with the Italian Customs and Monopolies agency (ADM) seized a painting attributed to renowned artist Jannis Kounellis during a joint border operation. Upon inspection, it was determined to be inauthentic. Had it been genuine, its estimated value would have been around EUR 100 000. In a separate investigation, the Carabinieri TPC seized more than 300 items, including coins, metal and ceramic fragments such as arrowheads and spearheads dating back to the Roman and Punic periods. These artifacts were being offered for sale on e-commerce platforms and were discovered in a private apartment.The Spanish Guardia Civil dismantled a criminal group involved in archaeological looting in the province of Cáceres. Six individuals were arrested, and three others are under investigation. During the operation authorities recovered 2 500 archaeological, primarily Roman coins minted in the Celtiberian city of Tamusia. These artifacts had been looted from protected archaeological sites in the province of Caceres using metal detectors and were being sold illegally through social media platforms.Also in Spain, the Guardia Civil intercepted a passenger attempting to fly from Palma de Mallorca to Germany carrying 55 ancient coins and a ring. A subsequent investigation led to an indictment for crimes against cultural heritage and plundering underwater wrecks and archaeological sites. In total, 64 objects of historical value and 1,576 ancient coins were confiscated.In Greece, the Department of Cultural Heritage and Antiquities of Athens recovered five Byzantine icons. Acting on intelligence and using special investigative techniques, including an undercover officer, three individuals were arrested while attempting to sell the icons for EUR 70 000.Ukrainian customs authorities seized 87 cultural goods that were being illegally transported out of the country to Poland, Moldova and Romania.Cyber patrols uncover additional casesIn addition to on-the-ground actions, dedicated cyber patrols were carried out during the operation to identify potential illicit online sales of cultural property. These virtual investigations led to the opening of new cases, demonstrating how digital platforms are quickly becoming a channel of choice by traffickers to market and sell looted artefacts. A total of 4 298 cultural goods were seized as a result of the cyber patrols.Built on international cooperationOperation Pandora IX was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT). Europol facilitated the exchange of information and provided analytical and operational support to the national investigations. Furthermore, one cyber patrol week was hosted by Europol.INTERPOL coordinated cross-border actions and offered tools such as its Stolen Works of Art database and on the ground ID-Art mobile application.The WCO’s secure communication tool, CENcomm, was made available to all participants while its Regional Intelligence Liaison Office for Eastern and Central Europe compiled, refined and shared information provided by Customs administrations.Since its launch in 2016, Operation Pandora has become a key global initiative to protect cultural heritage from illicit trafficking.Participating agencies:Europol, INTERPOL, World Customs Organization 

Its origin goes back to the foundation of the European Police Office by the Europol Convention, which set the legal basis for the establishment of a “computerized information system” (Title II, Article 7), into which EU Member States could directly input data in compliance with their national procedures, and into which Europol could directly input data supplied by third parties and analysis data, directly accessible for consultation by national units, liaison officers and duly empowered Europol personnel. Launched and used operationally for the first time in 2005, the EIS was one of the pioneers of information sharing at European level for law enforcement officers, allowing users to easily check whether information on a certain person, car, phone or other object of interest in an investigation was available beyond national or organisational jurisdictions.The EIS user community has increased significantly throughout the years. In addition to the growth in the number of users, the amount of data processed in the system evolved as well, offering a more efficient possibility for every investigator in the EU to have access to the data hosted at Europol. This has led to record figures, with more than 14 million searches performed in 2023, and more than 1.7 million data entities available in 2024.With the adoption of the EU Interoperability Agenda in 2019, the EIS has entered a new era as one of the most important elements of the new architecture. This is due to the fact that the relevant data stored in the EIS will be part of a systematic verification of administrative applications from non-Schengen citizens entering the Schengen area. Expected to enter into operation in Q4 2026, the travel applications submitted through the European Travel Information and Authorisation System (ETIAS) will be automatically cross-checked against EIS data. In the future, similar processes will be applied for visa applicants (via a revised Visa Information System), asylum seekers and irregular migrants.Europol marked the EIS 20-year anniversary during the recent Product Management Forum that took place at Europol’s headquarters on 13-14 May. On this occasion, Europol’s Deputy Executive Director Capabilities, Andrei Linta, said:“All the improvements and the successes of the Europol Information System were possible because of the remarkable commitment of both Europol’s staff and Europol’s partners, from MS and beyond, who made the system faster, better, more accurate and valuable for all its users. Personally, I am grateful to each of you: you should be proud of the Europol Information System as much as we are at Europol”

The 17 individuals arrested are mostly of Chinese and Syrian nationality and are suspected of providing primarily money laundering services to criminals. This encompasses parallel banking services, illegal hawala banking, cash collection, cash courier services and the exchange of cryptocurrencies for cash. The money launderers were operational in at least two branches: one that catered largely to the Arabic-speaking criminal world and the other to criminal networks originating from China.Money laundering services offered to other criminal networksInvestigators consider the dismantled criminal network one of the most significant in this crime area. It provided money laundering and related services to other criminal networks engaged in migrant smuggling and drug trafficking. It is believed that over EUR 21 million were moved by the criminal network. Advertising on social media, they reached a varied and international clientele. Apart from arresting 17 individuals, law enforcement seized criminal assets worth over EUR 4.5 million.The seizures include:EUR 206 000 in cashEUR 421 000 in 77 bank accountsEUR 183 000 in cryptocurrency10 real estate items worth over EUR 2.5 million18 vehicles worth over EUR 207 0004 shotguns and ammunitionPhones and other devicesLuxury consumables, watches, accessories, and jewelleryEuropol’s involvementFollowing up on the successes in taking down the migrant smugglers who relied on this criminal network’s illicit banking services, national investigators and Europol’s experts in financial crime jointly picked up a new trail. Examining the migrant smugglers’ phones, leads to the criminal network laundering illicit proceeds were found, thus kicking off this new investigation.On the action day, Europol financed three Spanish investigators to travel to Belgium and Austria. Additionally, two Europol experts travelled to Austria and Belgium to provide support on the ground, while two more Europol experts were deployed to Spain. 

The German investigation began with a routine immigration check in September 2024. Due to irregularities in a driver's documentation, he was suspected of attempted illegal entry and taken in for questioning. Investigators then found evidence that the driver may have already smuggled and dropped off three non-EU nationals on the same day.Subsequent investigations gave reason to believe the person was part of an internationally operating migrant smuggling network. There are indications that the network might be responsible for facilitating the illegal entry to Germany and other EU Member States of up to 300 non-EU nationals between 2022 and 2024.Investigators found most of the suspected gang members to be residing in Belgium. These individuals seemed to be the link between the suspects based in Germany and Poland, mostly recruiting drivers and overseeing financial aspects of the criminal network.In Poland, the actions had focused on a related organised criminal network also involved in the smuggling of migrants from Middle Eastern countries to the EU. The Polish members of this network, which is also engaged in the production and trafficking of drugs (amphetamines, cocaine and marijuana), has connections to the Polish football hooligan scene.Members of this network would organise the smuggling of up to a dozen people at a time along the Balkan route, sometimes relying on a legally operating Polish transport company to mask their activities. Three action days spread out over several months saw the arrests of eight suspects and seizures of criminal assets.Europol’s roleEuropol and Eurojust supported this multi-stage operation from its planning stage to yesterday’s action day.Europol oversaw the coordination of the national investigations and organised multiple operational meetings. On the action days, Europol facilitated the deployment of investigators between the countries. Additionally, Europol experts were sent into the field to help national authorities cross check operational information in real time against Europol’s databases.Eurojust facilitated cross-border judicial cooperation by enabling information exchange and aligning investigative efforts.Participating countries:Austria: Federal Criminal Intelligence Service (Bundeskriminalamt), Provincial Criminal Intelligence Service of Styria (Landeskriminalamt Steiermark)Belgium: Federal Judicial Police West-Flanders Belgium (Federale Gerechtelijke Politie Provincie West-Vlaanderen)Germany: Freilassing Federal Police Inspectorate (Bundespolizeiinspektion Freilassing); Traunstein Public Prosecutor's Office (Staatsanwaltschaft Traunstein)Poland: Polish prosecutor’s office - Silesian Branch of the Department for Organised Crime and Corruption in Katowice (Prokuratura Krajowa - Śląski Wydział Zamiejscowy Departamentu do Spraw Przestępczości Zorganizowanej i Korupcji w Katowicach); Polish Police – Regional Police Headquarters in Katowice, Department for Combating Crime of Hooligans (Policja, Komenda Wojewódzka Policji w Katowicach, Wydzial Zwalczania Przestepczosci Pseudokibicow); Polish Border Guard – Karpacki Border Guard Regional Unit (Straż Graniczna, Karpacki Oddzial Straży Granicznej w Nowym Sączu)Participating agencies:Europol, Eurojust

The criminal network lured victims with the promise of high returns on investments through a fraudulent online trading platform. After the victims made initial smaller deposits, they were pressured to invest larger amounts of money, manipulated by fake charts showing fabricated profits. Criminals posing as brokers used psychological tactics to convince the victims to transfer substantial funds, which were never invested but directly pocketed by the group.German authorities initiated the investigation after a married couple reported falling victim to the scam. The inquiry revealed an extensive criminal network, and a first action day on 6 September 2022 led to searches in Belgium and Latvia, where two suspects were arrested, and crucial evidence was seized. This evidence helped identify seven additional members of the network, including the managers of call centres used to deceive victims.A second action day took place on 13 May 2025. A total of eight searches took place simultaneously in Albania, Cyprus and Israel. During the searches, authorities seized evidence to continue the investigation such as electronic devices and documents as well as cash. A suspect in Cyprus was arrested with the intention of either surrendering or extraditing them to Germany.Eurojust facilitated judicial cooperation ensuring smooth coordination across borders.Europol provided operational support throughout the investigation, deploying experts in Albania, Israel, and the United Kingdom. Europol also set up a virtual command post to facilitate real-time coordination and intelligence sharing.The investigation remains ongoing, with further actions expected.The following authorities carried out the operations:Germany: Public Prosecutor's Office at the Itzehoe Regional Court, Department for Combating Cybercrime; District Criminal Investigation Office KielCyprus: Attorney General’s Office; Cyprus Police; Unit for Combating Money Laundering (MOKAS)Albania: Special Prosecution Office against Corruption and Organised CrimeUnited Kingdom: National Crime AgencyIsrael: Israeli Police - National Cybercrime Unit and Coordination and Operational Division in the Intelligence Branch

The now defunct platforms – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – are thought to have facilitated widespread attacks on schools, government services, businesses, and gaming platforms between 2022 and 2025. The platforms offered slick interfaces that required no technical skills. Users simply entered a target IP address, selected the type and duration of attack, and paid the fee — automating attacks that could overwhelm even well-defended websites.Global law enforcement responseThe arrests in Poland were part of a coordinated international action involving law enforcement authorities in 4 countries, with Europol providing analytical and operational support throughout the investigation.Dutch authorities have deployed fake booter sites designed to warn users seeking out DDoS-for-hire services, reinforcing the message that those who use these tools are being watched and could face prosecution. Data from booter websites, seized by Dutch law enforcement in data centres in the Netherlands, was shared with international partners, including Poland, contributing to the arrest of the four administrators.The United States seized 9 domains associated with booter services during the coordinated week of action, continuing its broader campaign against commercialised DDoS platforms.Germany supported the Polish-led investigation by helping identify one of the suspects and sharing critical intelligence on others.What are stresser and booter services?Stresser and booter services offer on-demand cyberattacks, often disguised as tools for legitimate testing but widely used to cause deliberate disruption. These services let users flood a target server or website with enormous volumes of fake traffic, making them inaccessible to real users – a technique known as distributed denial of service.Unlike traditional botnets, which require the control of large numbers of infected devices, stresser/booter services industrialise DDoS attacks through centralised, rented infrastructure. They are often advertised on underground forums and the dark web, and transactions are typically anonymised.This coordinated action is part of Operation PowerOFF, an ongoing international law enforcement effort targeting the infrastructure behind DDoS-for-hire activity.The following authorities took part: Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Centre (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)The Netherlands: National Police (Politie)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)USA: U.S. Department of Justice (US DOJ), Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), Defense Criminal Investigative Service (DCIS)

The exploitation of young perpetrators to carry out criminal acts has emerged as a fast-evolving tactic used by organised crime. This trend was underlined in the European Union Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA), which identified the deliberate use of youngsters as a way to avoid detection and prosecution.Recruitment, manipulation, exploitationViolence-as-a-service refers to the outsourcing of violent acts to criminal service providers — often involving the use of young perpetrators to carry out threats, assaults, or killings for a fee.Investigations show that these acts are often orchestrated remotely, with young people recruited and instructed online. There is a clear demand from the criminal underworld for youngsters willing to carry out violent tasks — and a supply of vulnerable young people being groomed or coerced into doing so.Young people are being deliberately targeted and recruited to commit a wide range of crimes — from drug trafficking and cyber-attacks to online fraud and violent extortion. Recruitment is often highly strategic, exploiting vulnerabilities and glamorising a luxurious, violent lifestyle. Social media platforms and messaging apps are used to reach young people through coded language, memes and gamified tasks. In return for money, status or a sense of belonging, they are drawn into criminal schemes that are both violent and transnational.This is not random – it is calculated. By using young perpetrators, criminal networks seek to reduce their own risk and shield themselves from law enforcement.Cracking down on criminal recruitersRecognising the urgency of the threat, law enforcement agencies are stepping up their response. OTF GRIMM will:Coordinate intelligence sharing and joint investigations across borders;Map the roles, recruitment methods and monetisation strategies used by VaaS networks;Identify and dismantle the criminal service providers enabling violence-on-demand;Cooperate with the tech companies in order to detect and prevent the recruitment on social media.Europol is at the heart of this international effort. Through OTF GRIMM, it provides a platform for data analysis, operational coordination, and joint investigations — ensuring that law enforcement across Europe is aligned in tracking, investigating and disrupting VaaS networks.To support national authorities and raise awareness of this growing threat, Europol has already made public an intelligence notification outlining how criminal networks lure young people into violence and crime. The notification breaks down the recruitment ecosystem — from the use of encrypted messaging apps and social media to lifestyle messaging, manipulation tactics and gamification.Further updates will be shared as investigations developed under OTF GRIMM progress.What can parents do if they’re concerned?Look out for the subtle signs — sudden behaviour changes, expensive new items with no explanation. If your child stops asking for money but seems to have it, that’s not independence — it’s a red flag.Europol has put together an awareness guide with a list of warning signs.This isn’t about catching the kids out — it’s about pulling them back, before organised crime pulls them in.

The lab was located in a mansion in a remote area. Two Dutch nationals, who were identified as chemists, were responsible for the drug production, while one Belgian national facilitated the production process. Investigators believe the lab had been operating for more than a year and that it had the capacity to produce hundreds of kilos of amphetamine and methamphetamine every month.On the action day, two Europol experts supported national authorities in the field, both members of Europol’s Drug Lab Dismantling Team (ELDT). The ELDT is a unique service deployed upon request to assist national specialists and provide on-site technical assistance, chemical detection and operation support. It is equipped with state-of-the-art detection tools and staffed by experts in chemical identification and lab safety.Europol’s fight against synthetic drugsEuropol identifies synthetic drugs as one of the key threats to the EU. Europe is a key player in this market as the industrial-scale production of synthetic drugs takes place in the EU to meet demands in both the domestic and international markets. Synthetic drug production in Europe is driven by innovation in methods and equipment, and the availability of the key chemicals needed. A further spread of production facilities throughout European countries is also highly likely, posing a further threat to the EU. Additionally, legal business structures are often exploited to obtain chemicals and equipment for drug production, which is characterised by continuous innovation. That's why Europol prioritises the fight against this type of serious and organised crime.

The investigation, code-named ‘Nimmersatt’ (‘Insatiable’ in German), extended from the US to Russia, with links to Canada, Hungary, Ireland and the United Kingdom (UK), as well as 11 EU countries. Investigative measures were conducted today and yesterday in Bulgaria, Estonia, Germany, Hungary, Latvia, Lithuania, the Netherlands, Portugal, Romania and Spain.Wrecked cars, fake import papers, cosmetic repairs and tax fraudCriminal organisations exploit the US market for cars damaged in accidents, which are often sold by insurance companies abroad or dismantled for scrap. The criminal group targeted by the EPPO-led investigation bought huge quantities of wrecked cars from US insurance companies at online auctions to then ship them to the EU. By using a network of sham companies and fake invoices to cover the origin of the cars, those vehicles arrived in the EU with their commercial history obscured.The cars arrived at different ports, including Antwerp (Belgium), Bremerhaven (Germany), Klaipėda (Lithuania) and Rotterdam (the Netherlands). In order to evade a substantial part of the customs duties, the perpetrators presented false invoices to the custom authorities, declaring a much lower value than what they paid for the vehicles.The cars were then transported by land to Lithuania, to be repaired in auto repair shops. However, based on the evidence, the repairs were only superficial, in order to make the cars appear as new and to pass the required technical certification procedures. Later, when the cars were sold to final customers in Germany and in other EU countries, they were presented as “never having had an accident” or “being fully and professionally repaired”, even when they had hidden damage – including missing airbags or other serious security issues. Less valuable vehicles were sold to Eastern European markets.In Germany, according to the investigation, the vehicles were sold by car dealers linked to the criminal organisation. It is understood that they fraudulently applied reduced VAT, under the so-called ‘margin taxation scheme’. This provision allows resellers to pay VAT only on their profit margin (the difference between the price paid for the item and the price for which it is sold), when selling second-hand goods bought from private individuals. However, the companies under investigation applied this provision unlawfully, as the cars had been imported commercially, mainly from the US, and in some cases also from Canada. The suspected fraud also allowed the wrecked cars to be sold at a lower market price, thus causing unfair competition.In Lithuania, the members of the organised crime group are believed to have used Lithuanian companies to also launder their profits from VAT fraud and payments in cash from car buyers. The investigation determined that the Lithuanian cell of the organisation used companies in Bulgaria, Estonia, Hungary, Latvia, Lithuania, the Netherlands and Romania to fraudulently conceal the true turnover of the trade in salvage cars. This Lithuanian cell was established in 2020 and headed by a Lithuanian national who was arrested in the course of this action. From Lithuania alone, at least 16 500 cars were sold for an amount of EUR 144 million.Complex international criminal chainThanks to the joint efforts of the EPPO, Europol, Eurojust and national law enforcement authorities, the investigation uncovered an extremely complex criminal scheme with ramifications in 18 countries. The individuals targeted by this operation were the criminal organisation’s leading members from Russia and Lithuania, as well as suspects responsible for the import and transport of the vehicles as well as dozens of car dealers.The damage caused by these criminal activities, which is still under assessment, is estimated to be at least EUR 31 million in unpaid VAT and customs duties. Freezing orders of up to EUR 26.5 million were granted. For the time being, bank accounts were frozen, and 116 cars worth approximately EUR 2.3 million were seized, as well as EUR 0.5 million in cash and luxury items.Europol’s roleEuropol collected and analysed contributions by its partners, with the outcomes shared as analytical reports (such as cross-references in Europol’s databases), travel intelligence reports (to support the monitoring of main suspects) or financial intelligence reports (to identify as wide a possible overview of the financial circuits of the criminal activity to facilitate asset recovery measures). On the action day, Europol established a virtual command post for communications between the investigation teams and the central command centre set up in the EPPO headquarters. One Europol expert with a mobile office was deployed to the central command centre while six Europol digital forensics experts were deployed to the actions in Lithuania and Latvia, supporting on the spot.This investigation took place in the framework of an EMPACT Operational Action to combat organised crime groups involved in VAT fraud and other financial crime in the field of importation and trade of crashed cars from third countries (such as the US) into the EU. This EMPACT Operational Action is led by Lithuania and supported and coordinated by Europol from the very first instance when Lithuania shared information about this new modus operandi. 13 countries took part in a SIENA string that allowed them to share information about national investigations that would then develop into EPPO cases.  The EPPO is the independent public prosecution office of the European Union. It is responsible for investigating, prosecuting and bringing to judgment crimes against the financial interests of the EU. This investigation involved 16 European Delegated Prosecutors and counted on the support of the Dresden tax office in Germany, the Financial Crime Investigation Service (FCIS) in Lithuania, Europol, Eurojust and law enforcement forces from several countries. The cooperation with UK tax authorities was also crucial to the inquiry.List of main partners and national authorities involved in the action:EPPOEuropolEurojustBulgaria: National Investigation Service (Национална Следствена Служба)Estonia: Estonian Tax and Customs Board (ETCB) - Maksu- ja TolliametGermany: Tax Investigation Office Dresden (Steuerfahndung Dresden), in cooperation with other tax offices in Germany; and Central Customs Investigation Service (Zollkriminalamt)Hungary: National Tax and Customs Administration (Nemzeti Adó- és VámhivatalLithuania: Financial Crime Investigation Service (Finansinių nusikaltimų tyrimo tarnyba – FNTT)Latvia: Tax and Customs Police Department of the State Revenue ServiceNetherlands: Fiscal Information and Investigation Service (FIOD)Portugal: Guarda Nacional Republicana (GNR) - Unidade de Acção FiscalRomania: National Anticorruption Directorate (Direcția Națională Anticorupție – DNA)Spain: Guardia Civil

These results were made possible by the continued exploitation of encrypted communication platforms, including Sky ECC and ANOM, which remain powerful tools in the hands of investigators.Unmasking the drug pipelines into EuropeOn 15 April, coordinated raids took place in several European countries and Türkiye, targeting both the leadership and logistical arms of these criminal networks. A total of 232 suspects have been arrested, including High Value Targets who played a pivotal role in drug trafficking and money laundering operations.Investigations spanned multiple jurisdictions, with authorities in Belgium, France, Germany, the Netherlands and Spain joining forces with Europol to disrupt the networks operating across the European continent.Over the course of the investigations, over EUR 300 million worth of assets were seized in Türkiye and Europe, including 681 properties and 127 vehicles.These criminal organisations – each operating independently but collectively wielding immense power – had established themselves as dominant players in the European drug trade.Using both traditional smuggling routes and sophisticated logistics, the groups were linked to the seizure of at least 21 tonnes of drugs in Europe and Türkiye, including 3.3 million MDMA tablets. Investigators also exposed the groups' involvement in money laundering, violent crime and a wider network of organised criminal activity.Cracking the criminal cloud with SKY intelligenceKnown as Operation BULUT (‘cloud’ in Turkish), this data-driven operation was built on intelligence extracted from the SkyECC and ANOM platforms.As part of the operational framework, French authorities shared decrypted SkyECC data with Türkiye to support the development of local investigations into the country’s most prominent organised crime suspects. As part of the ongoing judicial cooperation related to SKY ECC data, the French JUNALCO Public Prosecutor’s Office handles all requests for international mutual legal assistance requests sent by interested countries. ANOM intelligence was provided to the Turkish authorities by the Australian Federal Police, further enriching the intelligence picture.This cooperation facilitated the deployment of Turkish National Police officers to Europol’s headquarters, where they worked side by side with European investigators supported by Europol to analyse the encrypted communications and identify criminal networks operating in Türkiye.The resulting intelligence led to the first wave of arrests in Türkiye, targeting key figures at the top of the drug trafficking hierarchy. As the investigation revealed substantial links to organised crime across the EU, the operation entered a second phase – coordinated by Europol – bringing together law enforcement authorities from several Member States to disrupt the networks’ activities on European soil.From intelligence to action: Europol’s coordinating role Over the past two years, Europol has played a key role in coordinating efforts across Europe to support investigations into these criminal networks. By hosting high-level coordination meetings, Europol brought together all involved countries to develop a joint strategy, while intelligence shared through its channels helped map the networks’ structure and identify links to other cases. Europol also facilitated efforts to define the scope of the investigations between the SKY ECC joint investigation team (France, the Netherlands and Belgium) and Turkish investigators.Using its extensive datasets, Europol cross-checked information on suspects against passenger name records and other systems, enabling the silent surveillance of key targets. These efforts strengthened operational outcomes, leading to new intelligence developments.Europol also played a crucial role in the operational phase by setting up a real-time coordination platform among the designated country coordinators. This system ensured swift and effective decision-making, allowing for continuous adjustments to the strategy as the situation evolved. In addition, Europol deployed staff in the Netherlands to support the Dutch authorities’ enforcement activities.Closing in on criminal networks across the globeThis operation is part of Europol’s wider strategy to support EU Member States in systematically identifying, targeting and dismantling the most resilient criminal networks operating in Europe, wherever they are based. These criminal networks rely on international supply chains and complex structures to traffic drugs and launder illicit profits across multiple jurisdictions.Jean-Philippe LecouffeEuropol’s Executive Deputy Director OperationsYears after their takedown, encrypted platforms like SKY ECC and ANOM are still helping law enforcement turn intelligence into action. This case shows how powerful that data remains in identifying and dismantling high-value criminal networks operating in Europe. From logistics coordinators to the top tier of the criminal infrastructure, no one is beyond reach when countries work together and act on solid intelligence.The following authorities took part in the investigation: France: JUNALCO (National jurisdiction against Organised Crime), National Police (OFAST)The Netherlands: National PoliceBelgium: Federal Judicial Police Central Unit (DJSOC), Federal Judicial Police of East FlandersGermany: Federal Criminal Police (Bundeskriminalamt)Spain: National Police and Guardia CivilTürkiye: National Police; Counter Narcotics Department/Istanbul Narcotics Division (Emniyet Genel Müdürlüğü Narkotik Suçlarla Mücadele Başkanlığı/ İstanbul Narkotik Suçlarla Mücadele Şube Müdürlüğü), Interpol-Europol Department (Emniyet Genel Müdürlüğü İnterpol-Europol Daire Başkanlığı)

Seven suspects have been arrested in connection with the gang, which is believed to have sourced high-powered weapons from illegal markets in the Western Balkans and trafficked them into France for onward distribution.The joint operation – supported by Europol and Eurojust – has taken down the full supply chain behind the trafficking route, from source to destination.Caravan weapons cache sparks major investigationThe case began in September 2023, when law enforcement from Bosnia and Herzegovina informed Slovenian authorities that a vehicle transporting large quantities of weapons and ammunition was heading towards France. As the vehicle was already in Slovenia on its way to Austria, Slovenian authorities informed Austria. Austrian police stopped the Slovenian-registered vehicle towing a caravan near the Slovenian border. Inside, officers discovered a hidden cache of weapons, including:25 AK-type assault rifles126 hand grenades of various types25 kg of AK ammunition1 machine gun1 pistolThe arsenal was concealed in hidden compartments, including the caravan’s spare tyre. The phone records of the Slovenian driver led investigators to French contacts and pointed to a broader network involving Serbian and Bosnian nationals who had prepared the shipment, as well as a Spanish national already under investigation by the Guardia Civil. A French associate was also identified as a co-director of the firearms shipment.The driver, a Slovenian national, was arrested. Austrian authorities then informed Slovenia that the driver and the vehicle owner were from Kranj, Slovenia. This led to further investigations by Slovenian authorities in Kranj. Two other suspects were also arrested.Trafficking route uncoveredThe weapons are believed to have originated in Bosnia and Herzegovina before being smuggled through Slovenia and Austria en route to France. Intelligence gathered throughout 2024 helped to identify key members of the network and their roles.The operational phase of the case began on 18 March 2025. Law enforcement authorities in France, Spain and Bosnia and Herzegovina carried out simultaneous arrests and searches, leading to:4 arrests in France1 arrest in Spain2 arrests in Bosnia and HerzegovinaSearches in Spain and Bosnia and Herzegovina uncovered further evidence of the network’s activities. The main suspect remains at large and is currently being sought by Bosnian authorities.European coordination Europol supported the investigation from the outset, delivering operational analysis to the cases in the countries involved, coordinating international cooperation by organising operational meetings and deploying officers to France and Spain for the action day.Eurojust ensured smooth judicial cooperation by facilitating the use of European Arrest Warrants and European Investigation Orders across the participating jurisdictions.The following authorities took part in the investigation: France: Interregional Specialised Jurisdiction (JIRS) Paris; Central Office for the Fight Against Organised Crime (OCCLO)Slovenia: District State Prosecutor's Office in Kranj; Criminal Police Kranj (General Criminal Police Directorate)Spain: Public Prosecutor’s Office of the National Court (Audiencia Nacional); Guardia Civil (Intelligence Service Headquarters)Bosnia and Herzegovina: The Prosecutor’s Office of Bosnia and Herzegovina; Border Police of Bosnia and Herzegovina; Ministry of Interior Affairs - Republic of Srpska 

At the end of 2022, the French Gendarmerie in Strasbourg initiated an investigation against a criminal network involved in the smuggling of migrants from Serbia into the EU. The criminal network was mainly active across the Serbian-Hungarian and Greek-Turkish borders. However, smuggling operations linked to this network were also detected at intra-Schengen borders, notably at the Austrian-Hungarian and the Hungarian-Croatian borders.The operational actions on 1 April 2025 led to:24 arrests24 house searchesSeizures including 3 vehicles with an estimated value of over EUR 115 000 and communication devices.The alleged organisers of the network, based in another EU country, coordinated the activities together with two French nationals, based in France, in the region of Alsace near Germany. The latter managed the logistics including the recruitment of the drivers in Strasbourg and its suburbs, and in the region of Paris. This network was in charge of only one segment of the transportation. This tactic seeks to limit the threat to the entire network in cases where some members are arrested by law enforcement authorities.Over 40 drivers identifiedThe drivers were provided with rental vehicles, either cars or vans and were sent to the area of Szeged at the border with Serbia. Once in the area, the drivers coordinated with local smugglers when and from where to pick up the migrants in order to further transport them on to Hungary, Austria or Slovenia. At the arrival in the EU, the migrants were handed over to other smuggling networks. Over 40 drivers were identified during the investigation. During the transportation, the drivers loaded as many people as possible into the back of vans without any consideration for their safety in order to increase profits. Drivers would have received up to EUR 12 000 for transporting over 30 migrants at once. The suspected smugglers, who were responsible for the logistics, paid the drivers after the transportation upon receipt of a video to prove that the smuggling had been successful.Europol facilitated the exchange of information and provided operational coordination and analytical support. During the action day, Europol deployed an expert to France to facilitate the real-time exchange of information and cross-check operational information against Europol’s databases, providing leads to investigators in the field.  

The Working Arrangement provides for a structured and enhanced exchange of information (non-personal data) on transnational, serious and organised crime. Following the signing of the Working Arrangement, Egypt’s Ministry of Interior will be able to deploy a liaison officer to join Europol’s liaison officer community at its headquarters in The Hague.  The Working Arrangement does not provide a legal basis for the transfer of personal data. It establishes a general framework for potential cooperation between Egypt and Europol and EU Member States, should there be an urgent and justified need in the fight against organised crime and terrorism.The Working Arrangement includes strong safeguards to ensure respect for fundamental and human rights, as required by the Charter of Fundamental Rights of the European Union and the Europol Regulation.  Europol is the only law enforcement agency to host a unique community of over 300 liaison officers from more than 52 countries and international organisations at its premises in The Hague.Catherine De BolleEuropol Executive DirectorI would like to extend my sincere thanks to the Ministry of the Interior for its pivotal role in establishing this crucial cooperation between Egyptian law enforcement and Europol. Yesterday’s signing of the Working Arrangement marks a significant milestone in our shared commitment to addressing key security challenges. This partnership reflects the trust and collaboration that will continue to grow as we work together to ensure a safer future for both the European Union and Egypt.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationStrengthening Europe’s security means working with international partners. ProtectEU, our internal security strategy, puts a strong emphasis on global action. The new agreement between Europol and Egypt is a decisive step in disrupting migrant smuggling networks and human trafficking. Europe is working with purpose, committed to enhancing its own and our partners’ security.Egypt is a key partner in EU’s Southern Neighbourhood and plays an important and active role in many areas of interest to the EU. In December 2017, Egypt was added to Europol’s priority list for the conclusion of a Working Arrangement. Negotiations began that same year, following an agreement between the EU and Egypt on the priority areas for cooperation between Europol and Egypt.  Europol has remained committed to strengthening operational cooperation through the conclusion of this Working Arrangement. The conclusion of negotiations on the Working Arrangement in September 2024 and its signing this Wednesday reflect the trust and collaboration that have developed between the parties.Europol’s mission is to support EU Member States in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism. To achieve this, Europol must establish cooperative relations with key security partners such as Egypt, as it promotes a multi-agency and cross-sectoral approach, working closely with established actors within the EU security architecture (all 27 EU Member States) and beyond (third countries). 

While the actions in May 2024 targeted high-level actors who facilitated cybercrime, by deploying ransomware, for example, this follow-up operation targets a different level. Law enforcement moved – and continues to move – against the criminals who used the services taken down during Operation Endgame, focusing on the demand side of the criminal ecosystem. Customers of crime-as-a-service providers are now learning the painful lesson that their personal data was not protected by these individuals who involuntarily painted targets on their backs.Follow-up after follow-up…Law enforcement agencies in all the involved countries have closely followed the leads uncovered during Operation Endgame, helping them to link online personas and their usernames to real-life individuals. When called in for questioning, several suspects chose to cooperate with the authorities by facilitating the examination of digital evidence stored on their personal devices. Several suspects resold the services purchased from Smokeloader at a markup, thus adding an additional layer of interest to the investigation.…and a dedicated website for those who want to get in touchSome of the suspects had assumed they were no longer on law enforcement’s radar, only to come to the harsh realisation that they were still being targeted. Operation Endgame does not end today. New actions will be announced on the website operation-endgame.com. Anyone with information is invited to contact the authorities through this website. In addition, suspects involved in these and other botnets, who have not yet been arrested, will be held directly accountable for their actions. Europol and the Joint Cybercrime Action Taskforce (J-CAT), hosted by Europol, continue to support the investigation of Operation Endgame. It has facilitated the information exchange between the authorities involved and provided analytical and forensic support to the investigators. To support the coordination of the operation, Europol organised coordination calls and operational sprints at its headquarters in The Hague.Participating authorities:Canada: Royal Canadian Mounted Police (RCMP)Czech Republic: Police of the Czech Republic (Policie České republiky)Denmark: Danish Police (Dansk Politi)France: National Police (OFAC) (Police Nationale - Office Anti-Cybercriminalité)Germany: Federal Criminal Police Office (Bundeskriminalamt); Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)Netherlands: National Investigations and Special Operations (NIS), Netherlands Police (Politie)United States of America: Federal Bureau of Investigation (FBI); United States Secret Service; United States Department of Defense - Defense Criminal Investigative Service (DCIS)Participating agencies:EurojustOperation Endgame - think about (y)our next move:

Decisive action against key smuggling routeIn recent years, Egyptian nationals have increasingly been reported as both irregular migrants and smugglers operating on various routes into and throughout the EU, including the Mediterranean and the Western Balkan routes. The network targeted by this investigation offered illegal journeys by sailboat from the Turkish coast to Italian and Greek destinations, demanding payments of between EUR 9 000 and EUR 10 000 from each migrant. On the action day on 8 April 2025, seven key members of the criminal network were arrested (two in Italy, one in Germany, one in Albania, one in Türkiye and one in Oman) and another arrest warrant issued for a suspect already in custody in Italy.This investigation started after an incident in May 2022, when Italian authorities intercepted a sailing vessel off the Italian coast. The vessel, operated by Egyptian skippers, had allegedly departed from Türkiye with 87 irregular migrants of Afghan and Syrian nationality. Italian authorities uncovered a series of similar transports in various regions, orchestrated by the same criminal network. The Egyptian criminal network is believed to have had cells in Türkiye, Egypt, Greece and Italy, with individual members responsible for different tasks. These tasks ranged from recruiting skippers, communicating with irregular migrants via social media and instant communication platforms, transferring money and providing temporary accommodation along the route.Europol’s contribution to the operationIn the framework of the Operational Task Force established with Italy and Greece, Europol provided analytical support to the investigating countries and acted as an information hub between all partners. Europol’s experts in the fight against migrant smuggling analysed all information shared via SIENA and cross-checked it against Europol’s databases. In addition, Europol guest officers deployed to Italian hotspots provided further intelligence and reports and coordinated directly with law enforcement authorities on the ground. From its headquarters in The Hague, the Netherlands, Europol hosted several operational meetings organised in the framework of the Operational Task Force as well as with partner countries such as Türkiye. Several partners, including non-EU countries relevant to the investigation, contributed to and supported the investigation leading up to the arrests on 8 April 2025.On the action day, Eurojust supported the judicial cooperation with Germany by transmitting the relevant legal requests for the arrest and searches to the relevant authorities. INTERPOL facilitated the arrests in non-EU countries. A Europol migrant smuggling expert was deployed to Germany while Europol guest officers based in the Italian hotspots were deployed to several locations in Italy. They supported the national authorities by checking the newly discovered information against Europol’s databases, providing forensic expertise and coordinating with their colleagues at headquarters. Participating countries:Italy: National Police - SCO (Polizia di Stato - Servizio Centrale Operativo); Anti-Mafia Prosecution Office of Catania (Direzione Distrettuale Antimafia di Catania)Greece: Hellenic Coast Guard (Λιμενικο Σωμα), Hellenic Police (Ελληνικη Αστυνομια)Germany: State Police Rhineland-Palatinate (Landespolizei Rheinland-Pfalz); General Public Prosecutor’s Office Zweibrücken (Generalstaatsanwaltschaft Zweibrücken)Participating agencies:EurojustINTERPOL

The operation took place on 7 April and resulted in:3 suspects arrested in Italy600 counterfeit euro banknotes seized in denominations of EUR 10, 20, 50, and 100 for a total value of around EUR 50,000Print shop producing counterfeit euro banknotes dismantledIllegal mint (stamping press) dismantledCryptocurrency payments and shipping through postal serviceThe investigation, which began in 2024, revealed that a criminal organisation operating in southern Italy was distributing large quantities of counterfeit EUR 10, 20, 50 and 100 banknotes across the eurozone. Austria, Belgium, France, Germany and Spain received most of the fake currency. The criminal group showed a high level of technical expertise and internal organisation. The leader of the gang sold the counterfeit banknotes via an online messaging platform, with buyers making payments in cryptocurrency. Once the payments were confirmed, the fake banknotes were sent through the regular postal service.Investigators also discovered that the same criminal group had established an illegal 2-euro coin mint in northern Italy. Authorities dismantled the illegal mint during the operation, along with a printshop for counterfeit euro banknotes in southern Italy.Europol’s role in the fight against counterfeitingDuring the investigation, Europol facilitated the exchange of information and financed and coordinated several operational activities. Europol’s analysts also provided analytical support to identify the country where the banknotes were distributed. On the action day, Europol sent three experts to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems. Criminal finances are one of the common elements of the key threats identified in Europol’s EU Serious and Organised Crime Threat Assessment (EU-SOCTA). These threats are progressively destabilising the EU and are nurtured online, as criminal networks gradually exploit digital and online infrastructures, including messaging platforms, as in this operation.  Authorities involved in the investigation:Austria: Federal Police (CIS)Belgium: Federal Police (OCRFM)France: National Police (OCRFM)Germany: Federal Police (BKA)Italy: Carabinieri (CCAFM)Spain: Brigada de Investigación Banco de España (BIBE, Spanish Police)

Although biometric recognition systems are generally robust, provided they are well-secured and implemented correctly, academic research shows that there are ways to trick these systems. Examples include the use of masks, artificial fingerprints or deepfakes to bypass biometric authentication mechanisms. As authentication increasingly relies on biometric identification, it is crucial for law enforcement to understand the associated vulnerabilities. By researching and identifying how criminals might exploit weaknesses, authorities can take more effective and targeted countermeasures. This new Europol report identifies potential ways of exploiting vulnerabilities, thus enabling law enforcement agencies to update their systems and detect such incidents during investigations. Building on expertise to stay ahead of tech-savvy criminals Law enforcement must work closely with experts in the field to gain insight into potential attacks, so that any attempts at exploitation will be detected early on. Encouraging collaboration across relevant disciplines, such as biometrics, forensics and cybersecurity, is essential to staying ahead of this threat. Authorities must also take steps to detect and document any attempted attacks to understand the progress criminals are making in exploiting potential weaknesses in biometric recognition systems. The report shows how law enforcement and academic experts have joined forces to identify and address the challenges posed by these technological developments, with a view to strengthening their community and keeping European citizens safe.Access the Biometric vulnerabilities reportAt a time when technology is rapidly transforming the nature of crime, the Europol Innovation Lab stands at the forefront of innovation, empowering the law enforcement community to stay ahead of emerging threats. The Lab’s 5th anniversary in 2025 marks five years of innovation, collaboration and progress in addressing the complex challenges of evolving technology and criminal methodologies.  

The members of the gang were involved in environmental crime, money laundering and document fraud. They exploited business structures and coordinated a supply chain for illegal plant protection products based in Italy, Portugal and Spain since 2020.The investigation was led by Spain (Guardia Civil). Given the complexity of the criminal network, the police operation was carried out in two phases: the first between June 2024 and January 2025 with the support of French authorities, and the second between June 2024 and January 2025 with the support of Italian authorities.Overall results of the investigation:29 arrests (22 in the first operation, 7 in the second)26 tonnes of illegal pesticides seized14 bank accounts frozenCriminal assets worth EUR 350 000 frozenEuropol’s expertise, key to successEuropol’s experts on environmental crime supported the investigation by providing analytical support and coordinating and facilitating the exchange of information between national authorities.The investigation revealed a new criminal trend based on the use of coordinated structures and illicit supply chains to distribute unauthorised products, either because they have expired, are unregistered or lack the necessary authorisation.The suspects used falsified documents to introduce these illegal products into the market, often disguising them as fertilizers or motor oils to avoid detection. They also camouflaged containers of illegal products and used foreign banks for transactions to make their operations more difficult to trace.The gang was well organised, with each member playing a specific role to ensure the success of their criminal activities. This made the case especially challenging for investigators, as it was difficult to tackle such sophisticated criminal networks hidden behind legitimate businesses.Criminal exploitation of legal businessesMore than 85% of criminal organisations exploit legal businesses to transport illicit goods, expand their influence and, as in this case, launder the proceeds of crime. This problem is widespread across all EU Member States and other global regions.Europol is addressing this threat by bringing together law enforcement, regulatory bodies, the private sector and international allies to provide an integrated approach and reactive measures, targeting high-value targets through operational task forces.Authorities involved in the investigation:France: French Gendarmerie (L'Office central de lutte contre les atteintes à l’environnement et à la santé publique, OCLAESP)Italy: Carabinieri – Health Protection Command (Comando Tutela della Salute)Spain: Spanish Guardia Civil 

This year’s topic: ‘Making Europe Safer’Participants have to be part of law enforcement agencies of EU Member States or of countries that have agreements and working arrangements with Europol. The 2025 Europol photo competition casts a wide net, inviting submissions that showcase the many ways that law enforcement officers are actively ‘Making Europe Safer’. Europe’s security starts abroad, which is why Europol is looking forward to receiving images that provide a glimpse of the daily routine of law enforcement officers going about their work in partner countries as much as in EU Member States.As Europol’s work usually deals with crimes that require an international approach and cooperation between several countries, inside and outside the EU, images showing international law enforcement cooperation are particularly welcome. The photo competition will also show officers on patrol or involved in operational activities to combat organised crime. Entries can give insights into training exercises and manoeuvres, or highlight the vital role of community policing. Additionally, creative submissions that offer abstract and artistic interpretations of the theme ‘Making Europe Safer’ are welcome. This may entail showing unexpected perspectives, innovative photography techniques or imaginative compositions that push the boundaries of conventional photography. However, images created or enhanced by artificial intelligence will not be accepted, as traditional photography methods should remain at the core of this contest.For full details on how to participate, photographers are invited to visit the competition page. The deadline for submissions is Friday 8 August 2025.Law enforcement officers are invited to submit up to five photos. Whether those participating are professional police photographers or passionate amateurs, Europol is excited to see their photography skills in action! Anyone who is eligible and hopes to win a trip to Europol is therefore invited to go out there, capture the best moments of law enforcement in action, and show why this profession deserves respect and gratitude.Entries will be used in Europol publications, including calendars, social media and other communication materials. 

A total of 1.8 million users worldwide logged on to the platform between April 2022 and March 2025. On 11 March 2025, the server, which contained around 72 000 videos at the time, was seized by German and Dutch authorities.The investigation resulted in the identification of almost 1 400 suspects worldwide. So far, 79 of these individuals have been arrested for sharing and distributing child sexual abuse material (CSAM). Some of those arrested not only uploaded and watched videos but also abused children. The investigation is ongoing.Results of Operation StreamThe investigation started in 2022 and resulted in action weeks from 10 to 23 March 2025. So far, it has led to the following outcomes:1,393 suspects identified79 suspects arrestedOver 3,000 electronic devices seized39 children protectedOver 91 000 CSAM videosKidflix was created in 2021 by a cybercriminal who made a huge profit from it, as it quickly became one of the most popular platforms among paedophiles. According to authorities, 91 000 unique videos were uploaded and shared on the platform while it was active, with a total running time of 6 288 hours. On average, around 3.5 new videos were uploaded to the platform every hour, many of which were previously unknown to law enforcement.Unlike other known platforms of this kind, Kidflix not only enabled users to download CSAM but also to stream video files. Users made payments using cryptocurrencies, which were subsequently converted into tokens. By uploading CSAM, verifying video titles and descriptions and assigning categories to videos, offenders could earn tokens, which were then used to view content. Each video was uploaded in multiple versions – low, medium and high quality – allowing criminals to preview the content and pay a fee to unlock higher quality versions.The largest child sexual exploitation operation in Europol’s historyOperation Stream has been the largest operation ever handled by Europol’s experts in fighting child sexual exploitation, and one of the biggest cases supported by the law enforcement agency in recent years.During the investigation, Europol’s analysts from the European Cybercrime Centre (EC3) provided intensive operational support to national authorities by analysing thousands of videos. Europol’s experts also cross-checked all available data and provided evidence to the relevant countries to facilitate the investigation. Given the scale of the case, Europol’s role in coordinating the exchange of information during the investigation and the action days was crucial to its success. Bringing partners together for cross-border cooperation and joint action is one of Europol’s main priorities in order to strengthen the fight against all forms of serious international and organised crime, cybercrime and terrorism.Catherine De BolleEuropol Executive DirectorThe digital dimension has driven a rapid evolution in online child sexual exploitation, offering offenders a borderless platform to contact and groom victims, as well as to create, store, and exchange child sexual abuse material. Some attempt to frame this as merely a technical or cyber issue – but it is not. There are real victims behind these crimes, and those victims are children. As a society, we must act to protect our children.Magnus BrunnerEU Commissioner for Internal Affairs and MigrationThe dismantling of this criminal network demonstrates the added value that EU agencies like Europol provide. This is precisely why the European Commission has presented a strategy for greater security in Europe. Criminals operate across borders, so we must also support investigators in doing the same.What happens online, stays onlineChild sexual exploitation (CSE) is one of the key threats to the EU’s internal security identified in the recently published EU Serious Organised Crime Threat Assessment report (EU-SOCTA). The digital dimension has triggered a rapid evolution of online CSE, providing offenders with a borderless platform to contact and groom victims, as well as to create, store and exchange CSAM. This trend will continue to grow in the coming years. However, the online world is not anonymous. Most of the suspects identified in Operation Stream were matched against records in Europol’s databases, proving that most offenders engaged in child sexual exploitation are repeat offenders and are not unknown to law enforcement authorities.Child sexual exploitation is a major threat and therefore one of the EU’s priorities in the fight against serious and organised crime. Since 2017, Europol has been running the Stop Child Abuse – Trace An Object initiative, encouraging citizens to identify objects to help police save abused children. At the request of EU Member States and other partners, Europol hosts a Victim Identification Taskforce twice a year, an initiative that brings together law enforcement to localise investigations and identify victims. Children in Germany and Australia have benefited from this project, which has provided them with protection.Participating countries:1. Albania: Albanian State Police, Directorate for the Investigation of Cyber Crime in the Criminal Police Department and Directorate of the Special Operational Force (Policia e Shtetit, Drejtoria për Hetimin e Krimeve Kibernetike, Drejtoria e Forcës së Posaçme Operacionale)2. Australia: Australian Federal Police (AFP)3. Austria: Criminal Intelligence Service (Bundeskriminalamt)4. Belgium: Belgian Federal Police (Federale Politie / Police Fédérale)5. Bulgaria: Cybercrime Directorate - General Directorate for Combating Organized Crimes, Ministry of Interior (Дирекция "Киберпрестъпност" - Главна дирекция "Борба с организираната престъпност", Министерство на вътрешните работи)6. Canada: Royal Canadian Mounted police (RCMP) - National Child Exploitation Crime Centre (NCECC), Ontario Provincial Police, Ottawa Police, Saskatchewan Internet Child Exploitation Unit, Northern Alberta Integrated Child Exploitation Unit7. Colombia: Police Cybernetic Center C4 (Policía Nacional de Colombia), National Police of Colombia (Dirección de Investigación Criminal e Interpol), Criminal Investigation and Interpol Directorate (Centro Cibernético Policial C4)8. Croatia: National Cybercrime Department (Služba kibernetičke sigurnosti)9. Cyprus: Cybercrime Unit – Cyprus Police (Υποδιεύθυνση Ηλεκτρονικού Εγκλήματος – Αστυνομία Κύπρου)10. Czech Republic: Bureau of Criminal Police and Investigation Service, Criminal Police and Investigation Service of the Regional Police Directorate of the Capital City of Prague, Criminal Police and Investigation Service of the Regional Police Directorate of Liberec, Ústí nad Labem, Pardubice, South Bohemian, Plzeň and South Moravian11. Denmark: National Cyber Crime Centre (NC3) at Special Crime Unit (SCU/NSK) and Danish National Police (Dansk Politi)12. Estonia: Estonian Police, Estonian Police and Border Guard Board (Politsei- ja Piirivalveamet)13. Finland: National Bureau of Investigation (Keskusrikospoliisi), Western Uusimaa Police Department (Länsi-Uudenmaan poliisilaitos), Eastern Finland Police Department (Itä-Suomen poliisilaitos), Oulu Police Department (Oulun poliisilaitos)14. France: Police department for the protection of children (OFMIN) of the national directorate of judicial police (DNPJ)15. Germany: State Criminal Police of Bavaria (Bayerisches Landeskriminalamt), Bavarian Central Office for the Prosecution of Cybercrime (ZCB), Federal Criminal Police Office (Bundeskriminalamt, BKA)16. Georgia: Central Criminal Police Department of the Ministry of Internal Affairs of Georgia (საქართველოს შინაგან საქმეთა სამინისტროს ცენტრალური კრიმინალური პოლიციის დეპარტამენტი)17. Greece: Cyber Crime Division (Διεύθυνση Δίωξης Ηλεκτρονικού Εγκλήματος) 18. Hungary: National Bureau of Investigation Cybercrime Department Investigative Division (Nemzeti Nyomozó Iroda Kiberbűnözés Elleni Főosztály Nyomozó Osztály)19. Iceland: Reykjavik metropolitan police (Lögreglan á Höfuðborgarsvæðinu)20. Ireland: An Garda Síochána21. Italy: National Police – Postal and Cyber Security Police Service (Polizia di Stato - Servizio Polizia Postale e per la Sicurezza Cibernetica)22. Latvia: Cybercrime Enforcement Department of Central Criminal Police Department of the State Police of Latvia (Valsts policijas Galvenās kriminālpolicijas pārvaldes Kibernoziegumu apkarošanas pārvalde)23. Lithuania: Lithuanian Criminal Police Bureau (Lietuvos kriminalines policijos biuras)24. Luxembourg: Police Luxembourg - Criminal Investigation Department - Sexual offences and juvenile delinquency (Police Luxembourg - Service de Police Judiciaire - Section Protection de la Jeunesse et Infractions à Caractère Sexuel)25. Malta: Malta Police Force (Il-Korp tal- Pulizija ta’ Malta)26. Netherlands: National Police (Politie)  27. New Zealand: New Zealand Police28. Norway: NCIS – Norway (Kripos)29. Poland: Central Cybercrime Bureau (CBZC)30. Portugal: Judicial Police (Polícia Judiciária)31. Romania: Romanian Police (Poliția Română).32. Serbia: Service for combating High-Tech Crime, Directorate for Technology, Ministry of Internal Affairs (Služba za borbu protiv visokotehnološkog kriminala, Uprava za tehniku, Ministarstvo unutrašnjih poslova)33. Slovakia: Police Force of the Slovak Republic (Policajný zbor Slovenskej republiky)34. Spain: Spanish National Police (Policía Nacional)35. Sweden: Swedish Police Authority, National Cybercrime centre CSE/CSA-team and the local CSA/CSE teams of region Stockholm, Mitt, Bergslagen and Syd (Polismyndigheten Nationellt IT-brottscentrum, Internetrelaterade sexuella övergrepp mot brott mot barn (ISÖB) and regionala ISÖB-grupperna i Stockholm, Mitt, Bergslagen och Syd)36. Switzerland: Federal Office of Police fedpol (Bundesamt für Polizei fedpol), Police Basel-Landschaft (Polizei Basel-Landschaft), Aargau Cantonal Police (Kantonspolizei Aargau), Bern Cantonal Police (Kantonspolizei Bern), Geneva Cantonal Police (Police cantonale de Genève), Thurgau Cantonal Police (Kantonspolizei Thurgau), Vaud Cantonal Police (Police cantonale vaudoise), Zurich Cantonal Police (Kantonspolizei Zürich)37. United Kingdom: National Crime Agency (NCA)38. United States: Homeland Security Investigations

MDMA production raises safety and environmental concernsMDMA is primarily produced via the so-called 'high-pressure' method, using large industrial reactors. However, criminal networks are constantly adapting their production methods in response to shortages of equipment or chemicals. For example, changes in the availability of 'high-pressure' reactors have led producers to switch to the ‘cold method’. This alternative MDMA production method has been associated with fires and explosions, increasing the risk of harm to local populations, first responders and the areas surrounding production facilities. MDMA production also generates significant chemical waste. It is estimated that, in the EU, it may have generated between 1 155 and 3 191 tonnes of chemical waste in 2021, typically dumped away from the production sites, causing health hazards, environmental damage and costly clean-ups. The safety and environmental risks associated with MDMA production underline the market’s broader societal impacts.  MDMA trafficked from the EU to Latin America: a reverse cocaine route?Outside the buoyant EU drug market, profitable markets in Oceania and Asia appear to be the main destinations of MDMA shipments from Europe, but there are signs that Latin America is becoming an increasingly important market — a shift requiring close monitoring. Traditionally, drug trafficking routes between Latin America and Europe have been dominated by cocaine exports. However, there have been reports that these routes are also used to traffic MDMA in the opposite direction. In some cases, criminals based in the EU and Latin America engage in barter deals, where MDMA is exchanged for cocaine, with no monetary exchange. Innovation in precursor chemicals remains a challengeThe supply of precursors and essential chemicals plays a key role in MDMA production, typically assured by dedicated criminal networks with links to legitimate business. MDMA producers bypass legal controls on the precursor used to make MDMA (PMK) by using alternative unregulated substances that are mainly sourced from China and converted into PMK in Europe. Since 2013, seizures of these alternative chemicals have surpassed those of PMK in Europe, challenging authorities’ efforts to control MDMA production in the EU. High-strength ecstasy tablets still pose risksFollowing successive years of rising amounts of MDMA in ecstasy tablets (2011–2019), this trend seems to have reversed, with the average MDMA content falling from 170 mg in 2019 to 144 mg per tablet in 2022. Nevertheless, potent tablets are still circulating.Social media platforms and instant messaging apps have become particularly dynamic channels through which MDMA is sold to consumers. Mixtures of MDMA, ketamine and additional substances, sold as 'tucibi' or 'pink cocaine' are also increasingly available.Addressing current threats and boosting preparednessToday's report takes a threat assessment approach, presenting key issues and recommendations for action at EU and Member State level to address the challenges posed by the MDMA market. The key areas for action include: improving the strategic intelligence picture, strengthening responses to reduce supply and enhance security, boosting international cooperation, investing in capacity-building, and strengthening policy, public health and safety responses.Catherine De BolleEuropol Executive Director‘Europe is a key player in the synthetic drugs market and a global supplier of MDMA, both producing and trafficking for domestic and international markets. Legal business structures are often exploited to obtain chemicals and equipment for drug production, which is characterised by continuous innovation. A further spread of production facilities throughout Europe is also highly likely, posing an additional threat to our societies. That's why Europol identifies drug trafficking as one of the key threats for the EU and prioritises the fight against this sort of serious and organised crime.'Alexis GoosdeelEUDA Executive Director'Understanding the evolving MDMA market is essential for developing effective responses. MDMA remains a popular drug in nightlife and music festival settings, so ecstasy tablets that contain high amounts of MDMA, or unexpected ingredients, pose serious risks. Harm reduction measures, like drug-checking services, are crucial to mitigate the dangers. Tailored prevention and treatment services are more critical than ever, as MDMA tablets may contain new psychoactive substances that could have harmful consequences. Today’s report also highlights how illicit MDMA production in Europe depends on access to precursor chemicals. Reducing their availability is essential to disrupt production and enhance public safety. That is why the EU Drugs Agency is supporting the European Commission in monitoring drug precursor diversion and trafficking and implementing precursor regulations.'

Criminals haunted by their chatsThis high-risk criminal network coordinated the drug trade using these sophisticated communication channels, relying on both encryption and multi-platform distribution. The sophistication of their communications was in stark contrast to the simplicity of their modus operandi; it consisted of smuggling cocaine and marijuana across the continent in vehicles equipped with custom-made secret compartments and cloned number plates.Europol’s supportEuropol has provided support for this investigation since November 2023, with experts from several crime fields contributing to its success. The information gathered during the Ghost takedown not only provided evidence of individual drug shipments but, more importantly, helped investigators piece together the network’s organisational structure.On the action day, Europol deployed two experts with mobile offices to Spain and Ireland to provide immediate support in analysing and securing evidence. The investigation and the action day were supported by the @ON Network, funded by the EU (Project ISF4@ON), which facilitated in-person meetings and the deployment of Irish and Spanish officers during the action days.See footage from the action day here: 

Europol supported the French National Police (Police Nationale/OLTIM) and the Spanish National Police (Policía Nacional) in dismantling an organised criminal network smuggling migrants from Spain to France.The investigation was initiated in November 2022 and targeted individuals, based in Marseille, suspected of smuggling migrants between Spain and France. Europol’s analysis of the operational data made it possible to identify additional suspects linked to this criminal organisation and further advance the case.The action day on 16 March 2025 led to:19 arrests17 house searchesSeizures including a semi-rigid boat, 4 vehicles and about EUR 20 000 in cashOver 1 700 migrants smuggled in nearly 500 operationsMigrants were picked up near train stations in Catalonia, Spain and then transported to the French city of Marseille. Each member of the criminal network had a specific task. Some recruited migrants, others arranged transport and some provided temporary accommodation. During car smuggling operations, the criminal network used forerunner vehicles to detect potential law enforcement checkpoints along the route to help them bypass police or customs controls.The smuggling network operated in a structured way to prepare and execute the smuggling activities. The criminal network charged between EUR 150 and EUR 250 per migrant, depending on the departure point and destination. The suspects smuggled migrants from the Maghreb region, but also from the Middle East, mainly from Syria and from Sub-Saharan Africa. Between May 2023 and August 2024, more than 500 smuggling operations were organised with an estimated turnover of between EUR 250 000 and EUR 427 000 from about 1 700 migrants transported to France.Europol facilitated the exchange of information and provided operational coordination and analytical support. During the action day, Europol deployed an expert to France to enable the real-time exchange of information and cross-check operational information against Europol’s databases to provide leads to investigators in the field. 

The fraud scheme centred on fraudulent reimbursements for hearing aids exploiting France’s public health insurance system. In July 2024, the fraudsters set up fictitious hearing aid companies, using usurped diplomas to secure accreditation from health authorities and contracts with the French health insurance fund. Armed with stolen patient details, they issued false invoices, leading to EUR 6.7 million in fraudulent reimbursements. The illicit funds were then channelled through dozens of shell companies across Europe.On 10 March, French authorities arrested eight key suspects involved in the fraudulent scheme, which exploited France’s healthcare system. The French Gendarmerie carried out searches at the suspects’ residences, a doctor’s home and a medical centre. Officers seized EUR 195 000 in criminal assets, including EUR 111 000 from bank accounts, as well as luxury items and electronic devices.Building on intelligence from the French operation, authorities in Germany launched a second phase of the investigation to target the laundering of the fraud’s proceeds.On 17 March, German law enforcement, supported by French investigators from the Gendarmerie and Europol, carried out a large-scale action against a major company suspected of funnelling illicit funds. Law enforcement officers searched eight locations, including the company’s headquarters, an accountancy firm, a warehouse and several residences linked to senior figures in the scheme.The German operation involved over 100 officers and resulted in the seizure of real estate, 73 high-end vehicles and EUR 260 000 in cash.Europol’s supportEuropol provided key analytical and operational support, helping investigators trace the flow of illicit funds and uncover links to other criminal cases. Its intelligence enabled authorities to map out the laundering network behind the fraud.During the action days, Europol deployed specialists on the ground with a mobile office for real-time cross-checks and digital forensic support. It also facilitated coordination between French and German investigators, funding logistical support to ensure the smooth execution of operations.The following authorities took part in this investigation:France: French National Gendarmerie (Gendarmerie Nationale - OCLTI)Germany: Police Headquarters South-East Hesse (Polizeipräsidium Südosthessen)

On 19 March 2025, an operation involving law enforcement and judicial authorities from Belgium and Germany, coordinated by Europol, targeted a migrant smuggling network active across the English Channel. The operation was also supported by Italy and Eurojust. The investigation targeted a criminal network based in Germany and involved in criminal activities facilitating the smuggling of Middle Eastern and East African migrants across the English Channel with low-quality inflatable boats.Officers from the German Federal Police (Bundespolizei) raided several houses and storage spaces under search and arrest warrants issued by the Belgian Court and executed under the supervision of the Public Prosecutor’s Office of Düsseldorf. One arrest following a European Arrest Warrant issued by Belgium was also made in the region of Calabria by the Italian authorities. Ten Belgian investigators were deployed to the German region of North Rhine-Westphalia to support the operational activities on the ground. The action day on 19 March led to:6 arrests (5 in Germany and 1 in Italy) under Belgian judicial order11 locations (8 houses and 3 storage spaces) searched in GermanySeizures include: 90 life vests, jerrycans, 2 firearms and more than 47 electronic devices.The criminal network, active since 2023, transported nautical equipment from storage spaces in Germany to France. Drivers recruited via online platforms for this purpose transported the boats, jackets and other gear in modified vehicles with darkened windows and special compartments for the transportation of the equipment. The criminal network was highly coordinated, arranging several trips per day. The illicit proceeds were laundered via the Hawala underground banking system. Key suspect arrested earlierIn the lead-up to this large-scale operation, one of the main suspects had already been arrested. On 10 March, a 25-year-old Iraqi national residing in Germany was apprehended early in the morning at Charleroi Airport while attempting to board a flight to Greece. He was interrogated by investigators and brought before the investigative judge on 11 March, who ordered his detention on suspicion of human smuggling and involvement in a criminal organisation.Migrant smuggling: An ongoing lethal threatSince 2019, migrant smuggling via small boats has steadily risen, surpassing lorries in 2021 as the primary method of transporting migrants from the EU to the UK. The criminal networks behind these operations remain highly active, increasingly violent and highly adaptable, continuously developing new crossing techniques. The criminal networks are using increasingly dangerous modi operandi and increasing the risk to life by transporting higher numbers of migrants per boat.In 2024, more than 36 000 migrants and 680 boats successfully reached the UK, up from approximately 28 000 migrants and 580 boats during the same period in 2023. The number of lives lost has also risen – 78 deaths at sea were recorded in 2024, compared to 12 in 2023. So far in 2025, 4 000 migrants have successfully reached the UK, 2 000 of whom arrived in the past three weeks.EU-wide cooperation to steer operational actionsIn July 2022, the first Operational Taskforce (OTF) on migrant smuggling via small boats dismantled the largest network facilitating crossings from France to the UK. Europol then launched a second OTF to combat other criminal groups smuggling migrants across the English Channel, a life-threatening crossing method. Coordinated by Europol, this Taskforce includes Belgium, France, Germany, the Netherlands and the UK. It targets the entire smuggling chain – from migrant recruitment to logistical operations and key organisers – focusing on High Value Targets to dismantle criminal networks. Europol experts, fully engaged in the OTF, have helped to uncover links between multiple national investigations.Europol created a dedicated financial instrument to support high-profile investigations and assist participating countries. It oversaw the coordination of investigative activities and organised multiple operational meetings for the Taskforce members. On the action day, Europol facilitated the deployment of 10 investigators from Belgium and one from France to various locations in Germany. Additionally, a Europol expert was sent into the field to help German authorities cross-check operational information in real time against Europol’s databases.Eurojust facilitated cross-border judicial cooperation by enabling information exchange and aligning investigative efforts. Through Eurojust, judicial authorities issued European Investigation Orders and Arrest Warrants, ensuring all legal instruments were in place.Law enforcement authorities involved in the action day:Belgium: Belgian Federal Police (Federale Politie / Police Fédérale)Germany: German Federal Police (Bundespolizei) Italy: National Police (Polizia di Stato) and Financial Guard (Guardia di Finanza)Judicial authorities involved in the action day:Belgium: Investigating judge West Flanders division BrugesGermany: Düsseldorf Public Prosecutor’s Office (ZeOS), General Prosecutor’s Offices of Hamm.  

A changing DNA: how organised crime is mutatingJust as DNA shapes the blueprint of life, the blueprint of organised crime is being rewritten. No longer bound by traditional structures, organised crime has adapted to a world shaped by global instability, digitalisation and emerging technologies.The EU-SOCTA identifies three defining characteristics of today’s serious and organised crime landscape:1. Crime is increasingly destabilisingSerious and organised crime is no longer just a threat to public safety; it impacts the very foundations of the EU’s institutions and society. The destabilising properties and effects of serious and organised crime can be seen on two fronts: Internally, through the laundering or reinvestment of illicit proceeds, corruption, violence and the criminal exploitation of young perpetrators;Externally, with criminal networks increasingly operating as proxies in the service of hybrid threat actors, a cooperation which is mutually reinforcing.2. Crime is nurtured online Digital infrastructures drive criminal operations – enabling illicit activities to scale up and adapt at unprecedented speed.Nearly all forms of serious and organised crime have a digital footprint, whether as a tool, target or facilitator. From cyber fraud and ransomware to drug trafficking and money laundering, the internet has become the primary theatre for organised crime. Criminal networks increasingly exploit digital infrastructure to conceal their activities from law enforcement, while data emerges as the new currency of power – stolen, traded and exploited by criminal actors.3. Crime is accelerated by AI and emerging technologiesAI is fundamentally reshaping the organised crime landscape. Criminals rapidly exploit new technologies, using them both as a catalyst for crime and a driver of efficiency. The same qualities that make AI revolutionary – accessibility, adaptability and sophistication – also make it a powerful tool for criminal networks. These technologies automate and expand criminal operations, making them more scalable and harder to detect.The fastest-growing threats This evolving criminal DNA is embedded in the most pressing security threats identified in the EU-SOCTA 2025. The report highlights seven key areas where criminal networks are becoming more sophisticated and dangerous:Cyber-attacks, mostly ransomware but increasingly attacks targeting critical infrastructure, governments, businesses and individuals – often with state-aligned objectives.Online fraud schemes, increasingly driven by AI-powered social engineering and access to vast amounts of data including stolen personal information.Online child sexual exploitation, with generative AI producing child sexual abuse material and facilitating online grooming.Migrant smuggling, with networks charging extortionate fees and showing complete disregard for human dignity, exploiting geopolitical crises.Drug trafficking, a diversifying market with changing routes, modus operandi and the potential further spread of violence and recruitment of young people across the EU.Firearms trafficking, which is expanding due to technological advancements, online marketplaces and weapons availability in Europe.Waste crime, an often overlooked but lucrative sector where criminals exploit legitimate businesses, severely impacting the environment. While some threats play out in the physical world, elements of every criminal process are increasingly moving online – from recruitment and communication to payment systems and AI-driven automation. Breaking the criminal code The key criminal threats identified in the EU-SOCTA 2025 share common reinforcing elements that sustain and amplify them in different ways. To tackle these threats effectively, law enforcement must take these cross-cutting elements into account when designing strategies to tackle serious and organised crime.The DNA of serious and organised crime is strongly embedded in the way criminal networks operate, as they find opportunities to act as proxies for hybrid threat actors in the online realm and use AI and technology for criminal purposes. In addition, criminal networks operate across borders or even from within prison, adapting their tactics to benefit their operations.Criminal finances and money laundering methods continue to evolve, with illicit proceeds increasingly channelled into a parallel financial system designed to protect and grow criminal wealth. Digital platforms and emerging technologies such as blockchain facilitate this system, making it more resilient to disruption.Corruption remains one of the most insidious enablers of organised crime, facilitating illicit activities across all sectors. It has adapted to the digital age, with criminals increasingly targeting individuals who have access to critical digital systems and using digital recruitment tactics to extend their reach.Organised crime-related violence is intensifying in several Member States and spilling over into wider society. This violence moves with and is shaped by criminal markets prone to competition and conflict. It is further fuelled by encrypted communication tools and online platforms that facilitate borderless recruitment, extortion and coordination.The criminal exploitation of young perpetrators not only tears at the social fabric but also serves as a protective layer for criminal leadership, shielding those at the top from identification or prosecution.These reinforcing tactics allow criminal networks to expand, maximise profits and strengthen their resilience, creating a self-perpetuating cycle. Breaking this cycle requires law enforcement to integrate strategies that target both the key criminal markets and the underlying mechanisms that sustain them.Catherine De BolleEuropol Executive DirectorThe very DNA of organised crime is changing. Criminal networks have evolved into global, technology-driven criminal enterprises, exploiting digital platforms, illicit financial flows and geopolitical instability to expand their influence. They are more adaptable, and more dangerous than ever before. Breaking this new criminal code means dismantling the systems that allow these networks to thrive – targeting their finances, disrupting their supply chains and staying ahead of their use of technology. Europol is at the heart of Europe’s fight against organised crime, but staying ahead of this evolving threat means reinforcing our capabilities – expanding our intelligence, operational reach and partnerships to protect the EU’s security for the years to come.Magnus BrunnerEuropean Commissioner for Internal Affairs and MigrationOur security landscape is evolving dramatically. The SOCTA report clearly shows how serious and organised crime - and the threat it poses to our security - is also changing. We need to make every effort to protect the European Union. Our internal security strategy will address these challenges.Tomasz SiemoniakPolish Minister of the Interior and AdministrationPoland, as an EU country bordering an active war, is fully mobilised to identify and neutralise emerging threats. Our focus spans drug and human smuggling—especially its digital dimension—human trafficking, criminal infiltration of legal structures, hybrid threats, and the illicit arms trade. Security is the core of our presidency as we shape the next EMPACT cycle, laying the foundation for international police cooperation. Guided by SOCTA, we are committed to strengthening EMPACT and Europol to ensure EU support meets Member States’ real needs in an evolving geopolitical landscape.The EU-SOCTA 2025 is more than just an intelligence assessment – it serves as the foundation for Europe's strategic approach to tackling serious and organised crime. Based on its findings, the Council of the European Union sets priorities for law enforcement action, guiding the development of operational plans of the European Multidisciplinary Platform Against Criminal Threats (EMPACT) for the next four years.

A large-scale drug trafficking investigation, supported by Europol, led to the dismantling of an Ecuadorian criminal cell involved in supplying wholesale cocaine to the EU via major ports. The international operation, led by the Ecuadorian National Police (Policía Nacional del Ecuador), also involved the German Criminal Police (LKA Baden-Württemberg), German Customs (ZFA Stuttgart) and the Spanish Guardia Civil.The criminal structure targeted in Ecuador is part of an intercontinental criminal network involved in multi-tonne cocaine trafficking via sea containers from South America to Europe. This cell arranged the transport from Ecuador to Europe, managed money flows through different companies and frontmen, and maintained contact with the suppliers. The criminal cells operating in Germany and Spain – equipped with commercial and transport companies and drivers – handled the logistical part of the operation in Europe and the further distribution of the drugs within the EU.The action day on 13 March in Ecuador led to:36 arrests in Guayaquil50 house searchesSeizures including vehicles, documents and electronic equipment. This criminal network was importing large quantities of cocaine from Ecuador to ports in Belgium, Germany, the Netherlands and Spain. Drugs packages hidden in charcoal Since the start of the investigation in 2024, national authorities have seized 73 tonnes of cocaine Ecuador and the EU, and arrested 14 individuals in Germany and Spain for their alleged involvement in the criminal enterprise.Europol’s Executive Director Catherine De Bolle said: “Criminal networks operate seamlessly across oceans, and our response must be equally interconnected. Strengthening cooperation with Latin American countries is essential – tackling organised crime requires a global effort. Every country along the supply chain plays a crucial role in dismantling violent criminal networks at every level, from production to distribution. Only through coordinated international action can we disrupt their operations, weaken their influence and ensure the safety of our citizens."Europol’s efforts to disrupt the entire cocaine supply chainSince mid-2023, Europol has facilitated the exchange of information and provided continuous analytical support to the international investigation, part of which was driven by the work of a Europol taskforce. Europol contributed to the overall case coordination between various agencies and, on the action day, deployed two experts to Ecuador to provide analytical and specialised support.This operation reflects Europol’s strategy to systematically disrupt criminal networks by targeting all levels of the supply chain globally, as well as connected networks, including financial flows and laundering of criminal assets. The operation illustrates the increased cooperation with non-EU countries, which are key pillars in the fight against serious and organised crime. It follows a week of significant progress in partnerships with Latin America, including the finalisation of an EU-Ecuador agreement to enhance collaboration and exchange operational information, as well as a new milestone in Europol’s cooperation with Brazil, enabling the exchange of personal data. The week concluded with Europol hosting ministerial delegations from the Latin American Committee for Internal Security (CLASI), reinforcing its commitment to deeper regional engagement.At the same time, this operation builds on ongoing efforts by EU Member States and Europol to tackle the most threatening criminal networks within the EU, particularly those embedded in major ports. By uniting Member States in a coordinated response, the aim is to dismantle logistical networks linked to command-and-control centres that undermine the EU’s internal security. To further this effort, Europol has partnered with the ports of Rotterdam, Antwerp and Hamburg/Bremerhaven to publish a joint analysis report outlining the risks and challenges posed by criminal networks in EU ports.

Europol’s EU Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA 2025) is a unique, intelligence-driven report offering forward-looking insights into how organised crime is changing – and its impact on our societies.As the cornerstone of EU crime priority setting, this assessment will guide law enforcement strategies and EU policies in tackling Europe’s most pressing criminal threats.Stay tuned for key findings that will shape the future of security in the EU. Join us for a press conference announcing the publication of this flagship report, where we will unveil key findings and discuss their impact on security in Europe.Date and time: Tuesday 18 March 2025, 13:00 CETSpeakers:Europol’s Executive Director Catherine De BolleCommissioner for Internal Affairs and Migration Magnus BrunnerPolish Undersecretary of State Maciej DuszczykCommander-in-Chief of the Polish Police Marek BorónPlace: Europol’s headquarters in The Hague, the Netherlands.Online: This press conference will also be live-streamed on the homepage of Europol’s website. Registration is not necessary to follow the livestream.RSVP: Journalists interested in attending this press conference in person at Europol’s headquarters are requested to RSVP to press@europol.europa.eu by Monday 17 March at 16:30 CET. Please send your full name + date of birth for registration. Valid ID credentials are required for admittance.Ground rules: On-the-record press conference. The conference room will be available for media to set up from 12:30 CET and everything must be pre-set by 12:55 CET. The media communications and the report will be published on Europol’s website on the day at 13:00 CET.For all media inquiries: press@europol.europa.eu

On 7 March 2025, Europol welcomed ministerial delegations from the Latin American Committee for Internal Security (CLASI) to its headquarters in The Hague. The visit marked the final day of the delegates’ official tour, following two days of high-level meetings in Brussels on the margins of the Justice and Home Affairs (JHA) Council on 5 March. Facilitated through the EU-funded EL PACCTO 2.0 project, the visit was aimed at strengthening cooperation between Latin American law enforcement authorities and Europol, enhancing strategic dialogue on tackling security threats such as organised crime and terrorism.Strengthening EU-Latin American cooperationEstablished in March 2022, CLASI plays a key role in coordinating efforts to combat serious and organised cross-border crime in Latin America. CLASI is supported by the EU-funded EL PACCTO 2.0 project, which aims to enhance security and justice in Latin America by supporting efforts to combat transnational organised crime. EL PACCTO 2.0 addresses the entire criminal chain through three key components: police, justice and the penitentiary system.Europol’s engagement with CLASI aligns with its commitment to supporting international cooperation against transnational crime. Several CLASI member countries, including Colombia, Chile, Ecuador and Mexico, already have agreements with Europol, and CLASI provides a framework for further strategic commitment. Just this week, the EU and Brazil signed an international agreement to fight organised crime and terrorism, which enables the exchange of operational information between Europol and Brazil. The initiative is endorsed by the EU Council, the European External Action Service and the European Commission. This visit focused on aligning Latin American security efforts with EMPACT to improve coordination in addressing common security challenges.Europol’s Executive Director, Catherine De Bolle, underscored the importance of this collaboration: Today, it is of great importance that the EU fosters an even higher level of cooperation with the countries of Latin America. Organised crime is truly global – we see it in every aspect of our work. Europol is fully dedicated to deepening our collaboration with our Latin American partners, ensuring that intelligence sharing, strategic coordination and joint operations continue to evolve in response to the growing common challenges that we currently face.Addressing common security challenges Discussions highlighted key security concerns, including the resilience of ports and other entry points, which are critical in the fight against serious and organised crime. Both Europe and Latin America face common threats such as drug trafficking, trafficking of weapons and explosives, cybercrime, organised property crime and financial and environmental crime. Criminal networks continue to exploit the digital age, legislative loopholes and border vulnerabilities, underscoring the need for a unified approach. As this visit marks the second CLASI delegation to Europol since 2022, it is a testament to the growing partnership between the European Union and Latin America on security matters. Europol remains committed to strengthening coordination, joint efforts and responses to emerging security threats, recognising that cross-border crime cannot be tackled in isolation.

The agreement was signed today by Commissioner for Home Affairs and Migration, Magnus Brunner, and the Minister of Justice and Public Security of Brazil, Ricardo Lewandowski, in the presence of Europol’s Executive Director, Catherine De Bolle.Brazil has been a key partner for Europol since 2017, with a strong record of operational cooperation across various crime areas, including drug trafficking, cybercrime and human trafficking. This agreement will further strengthen law enforcement collaboration, helping to disrupt criminal networks and combat transnational crime more effectively.Brazil is the first country in Latin America to sign such an agreement with the EU. The agreement is now subject to the European Parliament’s consent before its final implementation. Europol stands ready to support its full execution, further deepening operational engagement with Brazil in the fight against serious organised crime.Commissioner for Internal Affairs and Migration, Magnus Brunner, said: ‘International cooperation is a cornerstone of our work to strengthen the internal security of the EU and our partners. This agreement will provide us with the opportunity to enhance information exchange with a key partner, Brazil, and in turn increase Europol's support to Member States' cross-border criminal investigations.’Europol’s Executive Director, Catherine De Bolle, added: ‘This agreement marks a new chapter in our trusted partnership with Brazil. By strengthening our operational cooperation, we are enhancing our ability to tackle the most pressing security threats together. Europol remains committed to working hand in hand with the Brazilian authorities to combat serious and organised crime.’Cooperation with non-EU countries is a crucial component of Europol’s strategy to fight serious and organised crime. By strengthening operational ties with trusted international partners, Europol enhances the ability of EU law enforcement authorities to tackle transnational threats. Agreements like the one signed with Brazil reinforce Europol’s global network, allowing for a more coordinated approach to combating criminal networks that operate across borders.Recent operational examples involving Brazil include:Cocaine cartel collapses after final arrests in Spain (June 2024)One of Europe’s most wanted drug traffickers behind bars and 16 arrested in Brazil (October 2023)Balkan cartel sinks as Spain seizes 2.7 tonnes of cocaine on board large vessel (September 2023)15 arrested in Brazil over 17 tonnes of cocaine worth billions (March 2023)

In a coordinated effort to combat human trafficking, Europol hosted an international operational action between 25 and 28 February 2025, bringing together analytical, OSINT and investigative experts from 12 countries, including Ukraine*. The action took place at Europol’s headquarters in The Hague, coinciding with the third anniversary of the start of the Russian war of aggression against Ukraine.The operational action had an intelligence-driven approach and was aimed at detecting and disrupting human trafficking networks active online. With a focus on the sexual exploitation of Ukrainian nationals, experts monitored online platforms, identified potential cases and cross-checked intelligence against national databases.The main objectives of the operation included:Mapping and prioritising high-impact criminal networksDetecting new victims and associatesSome of the results include:690 entities checked (including platforms, persons, usernames, locations and phone numbers)21 potential suspected human traffickers identified41 potential victims of human trafficking identifiedEuropol’s support in targeting human traffickers operating onlineEuropol played a key role in facilitating the operation, providing logistical, financial and analytical support. The agency enabled real-time data crosschecks, allowing participating countries to enhance their investigations with the latest operational intelligence. Europol’s operational coordination also ensured continued international cooperation beyond the duration of the activity.As criminal networks increasingly exploit online platforms for recruitment, facilitation, advertisement, payment and victim control, traditional investigative methods are being reinforced with cutting-edge digital tools. This operation provided a unique opportunity to test and evaluate new investigative technologies, ensuring law enforcement agencies stay ahead of emerging threats.This four-day-long operational action focused on the digital aspect of human trafficking highlights Europol’s continued efforts to combat human trafficking. As an innovative operational model, it may serve as a blueprint for future cross-border investigations into other forms of serious and organised crime.Participating countries: BelgiumCzechiaDenmarkFinlandIrelandLatviaNetherlandsNorwayPolandSpainSwedenUkraine

Europol’s Operational Task Force, which is dedicated to targeting criminal networks in the Balkans, had identified the network’s leader as a high-value target. After a major crackdown in May 2023, which led to the arrest of 37 members, a branch of the criminal network remained active. It was led by a national of Bosnia and Herzegovina, who was incarcerated at the time. The ringleader orchestrated the network’s criminal activities from his prison cell, regularly issuing orders and instructions on matters related to the trafficking of drugs and firearms.Ringleader in hiding found after killing a witnessUpon his release, the high-value target went underground and continued to run the criminal network from a safe house in Slovenia. In late November 2024, the undercover ringleader allegedly organised and coordinated the professional assassination of a witness in the case. Marked as a suspect, Slovenian law enforcement authorities began zeroing in on his location.The high-value target was taken into custody during the operation’s first action day in December 2024. In the following days, Slovenian police arrested several of his criminal associates responsible for the organisation and preparation of the witness’s murder, as well as the trafficking of drugs, firearms and explosives into EU Member States. The criminal network was hierarchically organised, with each member fulfilling roles such as logistician, counter-surveillance specialist, assassin, as well as weapons, explosives and drug trafficker. Investigations are ongoing.Summary of the operation3 Action Days (5/6 December 2024 And 10/11 February 2025 Around Ljubljana (Slovenia); 4/5 February 2025 In Sarajevo (Bosnia And Herzegovina))10 Suspects Arrested (4 Slovenians, 5 Bosnians And 1 Albanian), With 7 Remaining In CustodyAn Automatic Rifle, Several Handguns (Some With Removed Serial Numbers), Silencers, And Over 200 Rounds Of Ammunition SeizedSeveral Remote Controls And Electric Detonators For Explosive Charges Seized10 Kg Of Heroin, 3.5 Kg Of Cocaine, 18 Kg Of Morphine And Other Drugs SeizedA Large Number Of Electronic Devices, Mobile Phones, SIM Cards As Well As Forged And Counterfeit Documents Seized Several electric detonators for explosive charges seized Europol’s supportEuropol organised an operational meeting, analysed the information shared by the involved countries and supported the development of intelligence. In addition to coordinating the operation during the three action days, Europol experts were deployed on the spot to facilitate immediate cross-checking of new evidence against Europol’s databases.Participating authoritiesBosnia And Herzegovina: Ministry Of Internal Affairs Of Canton Sarajevo – Criminal Police Department (Ministarstvo Unutrašnjih Poslova - Sektor Kriminalističke Policije)Slovenia: National Bureau Of Investigation (Nacionalni Preiskovalni Urad); Specialised State Prosecutor’s Office (Specializirano Državno Tožilstvo)Sweden: National Operations Department, Swedish Police Authority (Nationella Operativa Avdelningen, Polismyndigheten)

Most of the arrests were carried out simultaneously on 26 February 2025 during a global operation (Operation Cumberland) led by Danish law enforcement. More arrests are expected in the coming weeks, as the operation is still ongoing. Results of the operation, so far:273 suspects identified25 suspects arrested33 house searches173 electronic devices seized The main suspect, a Danish national who was arrested in November 2024, ran an online platform where he distributed the AI-generated material he produced. Following a symbolic online payment, users from around the world were able to obtain a password to access the platform and watch children being abused.During the course of the investigation, Europol and the Joint Cybercrime Action Taskforce (J-CAT), hosted by Europol, provided operational coordination to the law enforcement agencies involved in the case. Experts from Europol’s European Cybercrime Centre also facilitated information exchanges and provided intelligence and operational analysis to national investigators.Operation Cumberland has been one of the first cases involving AI-generated child sexual abuse material (CSAM), making it exceptionally challenging for investigators, especially due to the lack of national legislation addressing these crimes. In this regard, EU Member States are currently discussing a common regulation proposed by the European Commission to tackle this new situation and protect children from being sexually abused and exploited.Catherine De BolleEuropol's Executive DirectorThese artificially generated images are so easily created that they can be produced by individuals with criminal intent, even without substantial technical knowledge. This contributes to the growing prevalence of child sexual abuse material, and as the volume increases, it becomes progressively more challenging for investigators to identify offenders or victims. Law enforcement will need to develop new investigative methods and tools to address these emerging challenges.AI-generated CSAM: a serious crimeOnline child sexual exploitation remains one of the most threatening manifestations of cybercrime in the European Union and continues to be one of the top priorities for law enforcement agencies, which are dealing with an ever-growing volume of illegal content. Self-generated child sexual material constitutes a significant share of the CSAM that is detected. AI models able to generate or alter images are being abused by offenders to produce CSAM and for sexual extorsion. Such models are widely available and have developed quickly, with output that now increasingly resembles genuine material, making it harder to identify as artificially generated. This poses significant challenges to authorities in identifying the real victims. Even in cases when the content is fully artificial and there is no real victim depicted, such as Operation Cumberland, AI-generated CSAM still contributes to the objectification and sexualisation of children. Europol’s fight against child sexual exploitationThe fight against child sexual exploitation is a priority for Europol. Since 2017, the Agency has led the Stop Child Abuse – Trace An Object initiative, which enables citizens to provide information by recognising objects to help solve a child sexual abuse case. To date, the general public has shared almost 28 000 tips, 30 children have been removed from harm and 6 offenders have been identified and prosecuted.  At the request of EU Member States and other partners, Europol also hosts a Victim Identification Taskforce, a further initiative that allows law enforcement to work together to localise investigations and identify victims. Children in Germany and Australia have already been made safe as a result of this initiative. Next step: preventing future crimes Operation Cumberland not only focuses on stopping perpetrators, but also takes proactive steps to prevent further incidents. Europol and its partners will launch an online campaign in the coming days highlighting the consequences of using AI for illegal purposes and targeting potential offenders where they are most active: online. The campaign will use online messages to reach buyers of illegal content, as well as other methods such as knock-and-talks, social media messages and warning letters. Operation Cumberland demonstrates an ongoing coordinated effort by law enforcement to tackle this threat comprehensively, from arresting criminals to preventing future crimes through education, deterrence and providing support to those who want to seek support or help. Authorities involved in Operation Cumberland:Australia: Australian Federal Police (AFP)Austria: CIS Austria (Bundeskriminalamt), CID Vienna and CID Burgenland (Landeskriminalamt Wien und Landeskriminalamt Burgenland)Belgium: Federal Judicial Police (Federale Gerechtelijke Politie), Serious & Organised Crime Directorate – DJSOC (Directie voor de strijd tegen zware en georganiseerde criminaliteit – DJSOCBosnia & Herzegovina: Ministry of Interior of the Republic of Srpska (Ministarstvo unutrašnjih poslova Republike Srpske)Czech Republic: Police of the Czech Republic (Policie České republiky.)Denmark: Danish Police (Politiet)Finland: Finland National Bureau of Investigation (Keskusrikospoliisi)France: OFMIN (Office Mineurs)Germany: Federal Criminal Police Office (Bundeskriminalamt), State Criminal Police Offices in Bavaria, Hessen, Brandenburg, North Rhine-Westphalia and Rhineland-Palatinate (Bayerisches Landeskriminalamt, Hessisches Landeskriminalamt, Landeskriminalamt Nordrhein-Westfalen, Landeskriminalamt Rheinland-Pfalz), Bavarian Central Office for the Prosecution of Cybercrime (Zentralstelle Cybercrime Bayern – ZCB)Hungary: National Bureau of Investigation Cybercrime Department Investigative Division (Nemzeti Nyomozó Iroda Kiberbűnözés Elleni Főosztály Nyomozó Osztály)Iceland: National Commissioner of Police and Reykjavik Metropolitan PoliceThe Netherlands: National Police (Politie)  New Zealand: New Zealand PoliceNorway: NCIS Norway (Kripos)Poland: Polish Police Force (Policja Polska)Spain: National Police (Policía Nacional)Sweden: Swedish Police Authority (Polisen)Switzerland: Federal Office of Police fedpol (Bundesamt für Polizei fedpol), Police Basel-Landschaft (Polizei Basel-Landschaft), Lucerne Police (Luzerner Polizei,), City Police Zurich (Stadtpolizei Zürich),United Kingdom: Online Child Covert Intelligence Team (OCCIT), Metropolitan Police, Kent Police, West Mercia Police, Northamptonshire Police, Essex Police, Police Scotland, Hertfordshire Constabulary and Lincolnshire Police

With serious and organised crime posing an increasing threat to communities across Europe, discussions focused on the Agency’s operational impact, strategic direction and future role in tackling criminal networks.The meeting comes ahead of the EU Serious and Organised Crime Threat Assessment (EU SOCTA) 2025, scheduled for publication on 18 March. This report will outline the most pressing security threats facing the EU and shape law enforcement priorities for years to come.Strengthening Europol’s operational and strategic directionAddressing the JPSG, Europol’s Executive Director Catherine De Bolle provided updates on key developments, including the Multiannual Programming Document 2026-2028, which sets out Europol’s long-term objectives in the fight against organised crime, terrorism and emerging security threats.Ms De Bolle highlighted Europol’s strengthened partnerships with law enforcement agencies worldwide, its enhanced technological capabilities and its ongoing efforts to dismantle criminal networks. She also reaffirmed the Agency’s commitment to supporting the enforcement of EU sanctions and tackling the criminal infiltration of legal businesses.Operational impact: fighting crime across the EUAt the operational level, Europol is delivering results. Criminal networks remain the driving force behind many of the EU’s most serious threats. Intelligence gathered by the Agency shows that 86% of them exploit legal business structures to launder illicit profits. Europol is working closely with the private sector and national law enforcement to dismantle these networks and close financial loopholes.Migrant smuggling remains a key focus, with a new expert network called DigiNex launched to tackle the increasing use of digital tools by smugglers. Counter-terrorism efforts also continue, with Europol leading the fight against terrorist content online.A recent Referral Action Day targeted hate speech and incitement to violence, removing harmful content before it could spread further.Looking ahead: Europol’s future mandateAs the EU prepares for the next phase of its internal security strategy, discussions have turned to the future of Europol’s mandate. The Agency’s operational demands have surged, and there is growing recognition that it must be equipped with the tools and resources to match. Strengthening Europol’s capabilities in financial crime, cybercrime and migrant smuggling will be crucial in the years ahead.Concluding the JPSG meeting, Catherine de Bolle said: “The future of Europol lies in equipping the Agency with the necessary tools and resources to tackle the growing complexities of financial crime, cybercrime and migrant smuggling—critical areas for maintaining Europe’s safety.”A recording of the JPSG meeting is available for viewing.

The cold case revolves around a brutal murder that occurred in Dümmerlohausen, Germany, on 8 August 1996. The victim, a male national from the former Yugoslavia residing in Hamburg at the time, was involved in criminal circles and known to law enforcement for his involvement in burglaries in northern Germany. Local hunters had found him shot dead next to a stolen red vehicle.New evidence, new leads and a renewed appeal to the publicFollowing an intense media offensive and a call for information from the public in summer 2024, German investigators received new evidence, allowing them to follow new leads. Europol facilitated the contact between the German authorities and Dutch, Serbian and Swedish law enforcement, which ultimately led to the identification of three persons with possible ties to the case. On 20 February 2025, German and Swedish police, supported by special forces, searched three persons’ residences, collecting evidence destined to be analysed in Germany. Europol provided remote operational support during the searches, allowing for real-time cross checks of information. At this point in time, no further information about the three suspects can be disclosed. For more insight into the case, the Oldenburg Police Department hosts a dedicated webpage including a short film. Authorities are urging anyone with information, no matter how insignificant it may seem, to come forward.Investigators in this murder case also accept any information via phone or via email, the contact details can be found on the dedicated webpage. In addition, witnesses can contact the police anonymously via a tip portal, which also allows the upload of files and images.

The investigation started in 2020. Since then, law enforcement authorities have seized over 12 000 counterfeit documents, secured EUR 250 000 and arrested 42 suspects in total, all members of the same organised criminal group. The most recent action days against the gang took place on 3 and 4 December 2024 in Poland and resulted in:7 suspects arrested4 locations searchedSeizure of electronic devicesSeizure of documents and bank credit cardsForged documents advertised on social media platformsThe suspects used websites and social media platforms to advertise the sale of forged documents under the pretence of legal assistance. Individuals were charged EUR 1 500 per document. Individuals seeking these documents were redirected to a customer service centre, where they received initial information about the process, costs, and details to pay deposits. Once the forged documents were ready, the buyers received photographs of the documents via online messaging platforms and were instructed to pay the remaining balance. The documents were then delivered via postal operators or personally by members of the organised criminal group. Investigation coordinated by EuropolThroughout the four-year long investigation, Europol’s specialists coordinated and facilitated the exchange of information with Polish authorities. They also provided their expertise on the ground during the action days in Poland.The most dangerous organised crime groups carry out complex money laundering schemes to conceal their illegal profits. To tackle these top criminals successfully, Europol is putting more focus on investigating High Value Targets, financial investigations and asset recovery, as done in this case.Poland, at the helm of the Council of the EUPoland is holding the Presidency of the Council of the EU in the first half of 2025, from 1 January to 30 June. During this period, the Polish Presidency has outlined seven key priorities in the field of internal security, all of which align closely with Europol’s mission to make Europe safer:New EU Internal Security StrategyCountering migrant smugglingCountering drugs smugglingCombating trafficking in human beingsMonitoring weapons and ammunition smuggling from Ukraine – preventive measuresExternal conflicts and their implications for the EU’s internal securityEnhancing cooperation with law enforcement agenciesThrough its expertise, operational capabilities, and strategic insights, Europol is working hand in hand with the Polish Presidency, EU Member States, EU institutions and agencies, partner countries and other relevant stakeholders to turn these priorities into actionable outcomes.See footage from the recent action days in the video below:This press release was updated following publication with accurate figures.

Developed by the Strategic Group on Technology and Ethics under the European Clearing Board, with support from Europol’s Innovation Lab, the report sets out a seven-step ethical assessment method to help law enforcement navigate the challenges of digital transformation. It aims to ensure that the adoption and use of new technologies align with core values such as transparency, fairness, privacy and accountability. One of the lead authors, from the Norwegian Police University College, presented the report at the Fundamental Rights Conference 2025 hosted at Europol’s headquarters on 20-21 February 2025.A structured approach to ethical decision-making The report introduces a value-based framework designed to assist law enforcement agencies in evaluating the ethical implications of emerging technologies. This includes identifying moral concerns, assessing risks and benefits, and ensuring that technology use remains lawful and proportionate. To illustrate the method in practice, the report examines various law enforcement technologies, including:Video analytics technology – assessing privacy implications while enhancing public safety.AI risk assessment for gender-based violence cases – balancing the need for predictive tools with fairness and transparency.Open-source data scraping – evaluating the ethical and legal concerns of automated online investigations.Chatbots to prevent online child sexual abuse – considering the balance between proactive intervention and privacy rights.Automated analysis of large and complex datasets – addressing the risks of function creep and ensuring responsible data use.The case studies are not intended to provide a definitive judgement on the ‘right’ or ‘wrong’ use of a technology, but to empower law enforcement agencies to apply the method in diverse contexts.A dynamic and evolving resourceThe report is intended to be a ‘living document’, regularly updated with new use cases and ethical considerations as law enforcement agencies across Europe continue to adapt to technological advancements.By promoting a structured ethical framework, Europol aims to increase public confidence in law enforcement’s use of technology, ensuring that innovation in policing remains aligned with societal values and legal safeguards.

Europol today issues an Intelligence Notification calling attention on the rise of violent online communities dedicated to the serious harm of children. This strategic document focuses on online grooming cult groups dedicated to normalising violence and corrupting minors, advocating for the collapse of modern society through acts of terror, chaos and violence, and spreading ideologies that inspire mass shootings, bombings and other acts of crime. These communities recruit offenders and victims on a global scale and function as cults formed around charismatic leaders who use manipulation and deception to lure and control their victims. The communities’ hierarchy is based on the amount of content shared, with the most prolific contributors earning higher rankings. Community members share extremely violent content, ranging from gore and animal cruelty to child sexual exploitation material and depictions of murder.Europol’s Executive Director Catherine De Bolle said: Today, digital platforms enable communications globally; violent extremist online communities also leverage this opportunity. Violent perpetrators spread harmful ideologies, often targeting our youth. These networks radicalise minds in the shadows, inciting them to bring violence into the real world. Awareness is our first line of defence. Families, educators and communities must stay vigilant and equip young people with critical thinking skills to resist online manipulation. International cooperation is also imperative – by sharing intelligence and holding perpetrators accountable, we can combat these dangerous communities and safeguard future generations from the grip of extreme violence and crime.Vulnerable minors targeted through gaming platforms and self-help communitiesThe perpetrators leverage online gaming platforms, streaming services and social media platforms to identify and lure their victims. The members of these groups target vulnerable young people, particularly minors between 8 and 17 years old – especially who are LGBTQ+, racial minorities and those struggling with mental health issues. In some cases, perpetrators infiltrate online self-help or support communities dedicated to individuals impacted by these issues.These violent criminal actors employ different tactics to lure and manipulate their victims into producing explicit sexual content, perpetrating self-harm, harming others and even carrying out murders. In the beginning, perpetrators often use ‘love bombing’ techniques – extreme expressions of care, kindness and understanding to gain the trust of the minors – while collecting personal information about their victims. The criminal actors use this information in the exploitation phase of the grooming, when they force the vulnerable minors into producing sexual content and committing acts of violence. The perpetrators then blackmail the victims to do even more harmful acts by threatening to share the victims’ explicit content with their families, friends or online communities.Once caught in the net of the predators, minors become even more vulnerable – the detection of these criminal activities is crucial.Beware of these behaviours in your children:Secrecy about online activitiesWithdrawal and isolationEmotional distressInterest in harmful contentChanges in language or symbols usedConcealing physical signs of harm Do not ignore these signs in your children’s online behaviour:Unusual activity on platformsInteraction with unknown contactsEncrypted communicationsExposure to disturbing content 

The action day took place on 21 January 2025 in Spain (Madrid, Málaga, Marbella, Torremolinos, Coín and Ayamonte) and Portugal (Lisbon). All in all, the operation led to:14 arrests9 house searchesSeizure of over EUR 1 million in cash and cryptocurrencies.Suspects mainly operated in Spain, used the Hawala method to move the cash sourced mainly from drugs trafficking, and launder the funds collected relying on their own company networks. Investigators believe the gang were carrying out daily cash transactions, occasionally reaching up to EUR 300 000 per day.Putting the focus on financial investigationsThroughout the investigation, Europol experts provided analytical support to national authorities. A specialist was also deployed during the action day to work hand-on-hand with investigators on the spot and assist them in the extraction of data and further analysis.The most dangerous organised crime groups carry out complex money laundering schemes to conceal their illegal profits, as in this case. To tackle these top criminals successfully, Europol is putting more focus on investigating high-value targets, financial investigations and asset recovery.At the same time, Europol aims at increasing its operational impact by dismantling poly-criminal organised groups. To this end, Europol is enhancing its analytical capabilities and developing a complete operational support model to identify, organise, coordinate and deploy multi-disciplinary teams to work with Member States and support priority investigations.Authorities involved in the investigation:Portugal: Judiciary Police (Polícia Judiciária)Spain: National Police (Policía Nacional)Funding through EU financial mechanismsOfficers from the Spanish National Police, supported by Europol, carried out these joint operations in partnership with Portugal and in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem.To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combating criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.

The investigation has so far identified 85 individuals linked to the Russian war of aggression against Ukraine. The National Police of Ukraine has opened a special criminal case, which contains information about the recruitment, training, financing, and the use of the alleged mercenaries in combat actions against Ukraine. This information has been shared with authorities in Moldova, where new preliminary investigations have been initiated.The action days on 12 and 13 February 2025 led to:Over 50 locations searched in Moldova;3 arrests in Moldova;Seizures, including documents, electronic equipment, video material and picture evidence.The seizures made during the raids include a large number of documents, pictures and video material, which attest to the recruitment and conditions of service within the Wagner Group private military company and illustrate the involvement of the suspects in military actions in the territory of Ukraine. The individuals, all Moldavan nationals, allegedly participated in the occupation of the city of Bakhmut, the battle for Donetsk Airport, the creation of the Debaltsevo cauldron within the Wagner paramilitary group, the Somali battalion and other armed formations of the self-proclaimed Donetsk Republic and Russia. Investigative information shows that the investigated individuals have been awarded medals and decorations by the military leadership of the Russian forces in the occupied territories.Europol supported the investigation by facilitating information exchange, coordinating operational activities and providing specialised analytical support focussed on the potential involvement of these individuals into war crimes committed in Ukraine. On the action days, Europol established a virtual command point to streamline communication between involved authorities and enhance field operations by cross-checking real-time operational data against its databases.See more about the operation in this video by the the National Police of Ukraine: