Crime News

Abusing an infrastructure of legal businesses, the criminal network is believed to have managed the illegal trafficking and disposal of the waste from the countries of origin, mainly Italy, to the destination in Croatia. To that end, the criminal network relied on legal companies in Italy, as well as transport companies and other legitimate businesses in Italy and Croatia. Laboratory analysis shows that the illegally disposed garbage, which the criminals falsely declared as recyclable plastic waste, is legally considered dangerous waste. Croatian authorities believe that the criminal network also illegally buried and dumped medical waste from Croatian companies.Falsified documentation as key to profitCriminal networks engaged in waste trafficking take advantage of the high treatment costs, particularly for hazardous waste. In this case, the modus operandi was to win tender procedures for the treatment of waste in Italy by offering lower prices compared with other providers on the legal market. Upon winning a contract, the Croatian-led criminal network would transport the waste – without any previous mandatory treatment – to Croatia. To circumvent the necessary consent of the destination country, the criminals would falsify documentation to declare the waste as merely destined for recycling, thus veiling its true nature. By disposing of medical or hazardous waste in Croatia without having treated in any way, the criminal network saves the costs associated with this procedure and pockets the difference.Huge profits, low risk, and irreparable damageWaste trafficking is an illegal activity that allows criminal networks to obtain huge profits while exposing themselves to comparatively low risk. Illegal disposal of waste often causes irreparable damage to the environment, polluting soil, water, and air. These crimes usually go hand in hand with the falsification of documents, or financial crimes such as money laundering or corruption. During the action day, officers on the scene seized electronic devices, mobile phones and documents, which will be subject to further investigation.Europol supported the investigations conducted by national law enforcement and environmental protection agencies. Europol’s experts on environmental crime coordinated the operation by holding coordination and operational meetings as well as providing analytical support. On the action day, Europol’s experts provided the authorities with real-time support.Participating countries:Croatia: Criminal Police Directorate (Služba općeg kriminaliteta)Italy: Carabinieri - Environmental Protection and Energy Security Command (Comando Tutela Ambientale e Sicurezza Energetica)Slovenia: Slovenian Criminal Police (Kriminalistična policija)

The operation, which took place in the early hours of 27 January 2025, was carried out by law enforcement authorities in France, Spain and Israel, with support from Europol and judicial authorities.International fraud schemeThe investigation began after a French citizen was deceived between April and May 2022, believing he was making substantial investments in renewable energy contracts. The suspects maintained regular contact with the victim, persuading him to transfer large sums of money to company bank accounts both inside and outside the EU.To reinforce the illusion of a legitimate investment, the fraudsters returned small amounts of money, falsely presenting them as interest payments – a common tactic used to build trust before stealing larger sums.When the victim realised they had been scammed, they reported the fraud to the French Gendarmerie, triggering a major international investigation.Global police cooperationLed by the French Gendarmerie, under the guidance of the Annecy Judicial Court, the investigation uncovered a sophisticated criminal infrastructure. Investigators traced both the technical and financial networks used by the fraudsters, identifying additional victims who had suffered significant financial losses.Europol facilitated analysis and operational meetings between investigators from different countries, ensuring a coordinated international response. This work led to simultaneous police actions across France, Spain and Israel.On the day of the operation:France: Europol deployed a case analyst to the coordination centre to assist with real-time intelligence checks.Israel: Two French Gendarmerie officers, a French investigative judge and a Europol officer took part in searches and coordination efforts on the groundSpain: The National Police carried out enforcement actions against the suspects.During the action day, EUR 133 800 worth of cash in various currencies was seized in Israel along with expensive watches. To date, French investigators have recovered approximately EUR 450 000. Investigations remain ongoing to identify further suspects and trace additional financial losses.To learn more about how law enforcement is tackling this crime area, listen to episode ‘S1/E7: Targeting scam call centres’ of The Europol Podcast.

This follows a series of high-impact arrests targeting Phobos ransomware:An administrator of Phobos was arrested in South Korea in June 2024 and extradited to the United States in November of the same year. He is now facing prosecution for orchestrating ransomware attacks that encrypted critical infrastructure, business systems, and personal data for ransom.A key Phobos affiliate was arrested in Italy in 2023 on a French arrest warrant, further weakening the network behind this ransomware strain.As a result of this operation, law enforcement was also able to warn more than 400 companies worldwide of ongoing or imminent ransomware attacks.This complex international operation, supported by Europol and Eurojust, involved law enforcement agencies from 14 countries. While some countries focused on the investigation into Phobos, others targeted 8Base, with several participating in both.Europol played a critical role in bringing together intelligence from these separate investigations, enabling authorities to take down key actors from both ransomware networks in a coordinated effort.Phobos: A discreet but highly effective ransomwareFirst detected in December 2018, Phobos ransomware has been a long-standing cybercrime tool, frequently used in large-scale attacks against businesses and organisations worldwide. Unlike high-profile ransomware groups that target major corporations, Phobos relies on high-volume attacks against small to medium-sized businesses, which often lack the cybersecurity defences to protect themselves.Its Ransomware-as-a-Service (RaaS) model has made it particularly accessible to a range of criminal actors, from individual affiliates to structured criminal groups such as 8Base. The adaptability of this framework has allowed attackers to customise their ransomware campaigns with minimal technical expertise, further fuelling its widespread use.Taking advantage of Phobos’s infrastructure, 8Base developed its own variant of the ransomware, using its encryption and delivery mechanisms to tailor attacks for maximum impact. This group has been particularly aggressive in its double extortion tactics, not only encrypting victims' data but also threatening to publish stolen information unless a ransom was paid.Europol’s coordinating roleWith law enforcement efforts spanning multiple continents, Europol played a central role in connecting investigators and coordinating enforcement actions. Supporting the investigation since February 2019, Europol’s European Cybercrime Centre (EC3) has:Brought together intelligence from parallel investigations, ensuring that law enforcement authorities targeting Phobos and 8Base could pool their findings and coordinate arrests efficiently.Organised 37 operational meetings and technical sprints to develop key investigative leads.Provided analytical, crypto-tracing and forensic expertise to support the case.Facilitated intelligence exchange within the Joint Cybercrime Action Taskforce (J-CAT), hosted at its headquarters.Exchanged nearly 600 operational messages via Europol’s secure SIENA network, making this one of EC3’s high-priority cases.Eurojust organised two dedicated coordination meetings to assist with the cross-border judicial cooperation and provided support with outstanding requests of all authorities involved.  The following authorities took part in the investigation:Belgium: Federal Police (Federale Politie / Police Fédérale)Czechia: Police of the Czech Republic (Policie České republiky)France: Paris Cybercrime Unit (Brigade de lutte contre la cybercriminalité de Paris - BL2C), Court of Paris - National Jurisdiction Against Organised Crime (Juridiction Nationale de Lutte contre la Criminalité Organisée – JUNALCO)Germany: Bavarian State Criminal Police Office (Bayerisches Landeskriminalamt – LKA Bayern), Bavarian Central Office for the Prosecution of Cybercrime (Generalstaatsanwaltschaft Bamberg – Zentralstelle Cybecrime Bayern)Japan: National Police Agency (警察庁)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)Romania: Romanian Police (Poliția Română)Singapore: Singapore Police Force CyberCrime CommandSpain: Guardia CivilSweden: Swedish Police Authority (Polisen)Switzerland: Office of the Attorney General of Switzerland (OAG), Federal Police (fedpol)Thailand: Cyber Crime Investigation Bureau (CCIB)United Kingdom: National Crime Agency (NCA)United States: US Department of Justice (US DOJ), Federal Bureau of Investigation (FBI – Baltimore Field Office), US Department of Defense Cyber Crime Center (DC3)

Featuring keynote speeches from Europol experts and live demonstrations of the latest technology by companies, this event brought Europol staff and national law enforcement practitioners up to speed with the latest technological advancements in the security market. As a response to the needs expressed by the law enforcement community, and matching criteria such as the innovative nature and relevancy to the users’ strong interest in compliance technology, Europol invited technology providers to our headquarters to demonstrate their latest developments. A selection panel composed of Europol experts from across the organisation and the Innovation Lab opted for 32 technology providers to showcase their technical solutions, tools, methodologies and processes related to six themes, as follows:Robots, drones and other unmanned systemsDeepfake detectionAdvanced biometrics for forensic analysisAI Tools for target detection, identification, and trackingOSINT analysis of private channelsCryptocurrencies, financial intelligence and cybersecurityOn the second day of the event, the Top Contributor Award for the Europol Tool Repository (ETR) was presented to the Norwegian Police. This award recognises the EU Member State or Europol partner country that has made the most significant contributions to the ETR, enhancing it with innovative tools that support law enforcement across Europe. The ETR features 40 investigation-support tools, with over 8 000 downloads. Developed by law enforcement for law enforcement, these tools demonstrate the power of collaboration and shared expertise in addressing the evolving challenges of modern crime. Europol works under the premise that traditional law enforcement approaches must be complemented by partnering with non-law enforcement partners, in order to grasp the added value emerging technologies can bring to investigations. Enhancing collaboration with private sector partners offers numerous advantages, such as improving efficiency and adopting the best solutions for law enforcement compliance needs in the fields of personal data, fundamental rights, and transparency, in the fight against criminality.Europol does not endorse any of the mentioned companies, neither any of their products/services.

On 7 February 2025, Europol hosted a Quantum Safe Financial Forum (QSFF) event, during which the QSFF has issued a call to action for financial institutions and policymakers, urging them to prioritise the transition to quantum-safe cryptography. With the rapid advancement of quantum computing, the financial sector faces an imminent threat to its cryptographic security. This transition presents both a challenge and an opportunity to enhance cryptographic management practices across the industry. During the event, representatives from leading organisations discussed the need to urgently address the transition and the challenges industry peers, vendors, policymakers, and society are facing.A coordinated approach to the transitionA sufficiently advanced quantum computer has the potential to break widely used public-key cryptographic algorithms, endangering the confidentiality of financial transactions, authentication processes, and digital contracts. While estimates suggest that quantum computers capable of such threats could emerge within the next 10 to 15 years, the time required to transition away from vulnerable cryptographic methods is significant. A successful transition to post-quantum cryptography requires collaboration among financial institutions, technology providers, policymakers, and regulators.The forum recommends the following key actions:Financial institutions and policymakers should prioritise the transition to quantum-safe cryptography and actively support its implementation.Coordination among different stakeholders will be key, ensuring alignment on their planning, roadmaps and the concrete implementation of the transition to PQC, establishing common goals and a shared view of the requirements to achieve them.There is no need for additional legislation to be made, a voluntary framework established between regulators and the private sector would be sufficient, setting guidelines for quantum-safe cryptography and promoting standardisation across institutions.This transition presents an opportunity to enhance cryptography management practices. A forward-looking framework to cryptography management is needed.Promote collaboration, knowledge sharing and fostering a cohesive approach across jurisdictions at global scale. This means encouraging the industry, including private and public sector actors, to partner up in the context of quantum-safe experiments, projects, Points of Contact and other initiatives.The threat of ‘Store now, decrypt later’ and the regulatory response to itThe QSFF warns of the increasing risk posed by ‘Store now, decrypt later’ (SNDL) attacks, where malicious actors collect encrypted data today with the intention of decrypting it in the future using quantum computing. Sensitive financial information, including long-term investment strategies and confidential agreements, could be compromised if urgent security measures are not taken.These challenges have been identified by Europol and presented in the First Report on Encryption, published by the EU Innovation Hub, and The Second Quantum Revolution report, published by Europol’s Innovation Lab. Although these reports focus on the law enforcement perspective, there are synergies that can also be applied to the financial industry.Governments and regulatory bodies worldwide have begun addressing the quantum threat, with the introduction of major regulatory acts in Europe, the United Kingdom, the United States and Singapore. Despite these efforts, a 2023 survey of 200 financial sector leaders found that 86% of organisations feel unprepared for post-quantum cybersecurity. Additionally, 84% anticipate the need to adopt quantum-safe solutions within the next two to five years.The QSFF urges financial institutions, vendors, and policymakers to take immediate steps towards a quantum-safe financial ecosystem. The QSFF emphasises that action should be taken promptly to protect the industry from significant risks, financial losses, and reputational damage.

The meeting provided an opportunity for representatives from both regions to exchange expertise and knowledge on cross-border security challenges. Participants also shared insights on emerging crime trends, working towards a more effective response to transnational crime. GCCPOL and Europol have been working together since signing a Letter of Intent on 14 July 2017 to enhance collaboration against organised crime and terrorism. This meeting marked another step in that partnership, reinforcing joint efforts to disrupt transnational criminal networks and protect communities from criminal activity.To this end, GCCPOL and Europol reaffirmed their intention under the Letter of Intent to enhance cooperation by:1. Exploring opportunities to exchange best practices and experience in the various areas of combating crime.2. Supporting the capacity building for cooperation and information exchange among the law enforcement authorities of the GCC countries and EU Member States.3. Fostering a strengthened cooperation among the GCC countries and EU Member States in the area of internal security.By improving cross-border collaboration, GCCPOL and Europol aim to tackle criminal threats more effectively across both regions. 

Law enforcement authorities target members of prolific online communities dedicated to the sexual abuse of children and manipulation of vulnerable minors into committing violent crimes. This coercion into committing violent crime spans multiple areas, including acts of cruelty against people and animals, murder and self-harm. These extremist communities are part of a larger online network, so called “The Com”. Through this network, extremists around the world collude to groom and abuse children. These groups operate virtually in easily accessible online spaces such as social media platforms, mobile applications and online gaming platforms. International cooperation via Europol has intensified in the past year, leading to the identification of dangerous individuals and the safeguarding of victims, mostly vulnerable minors.Two suspected leaders of online group “CVLT” arrested in the USOn 30 January, the United States Homeland Security Investigations arrested two individuals for participating in a neo-Nazi child exploitation ring that groomed and then coerced minors into produce child sexual abuse material and images of self-harm. The group allegedly abused at least 16 minors around the world. According to the investigation, the two men were members of “CVLT” (pronounced “cult”), an online group that promoted neo-Nazism, nihilism, and paedophilia as its core principles.The investigations into these individuals (a 23- and 41-year-old males from the US), were supported by Europol, and involved the French National Police (Police Nationale), the United Kingdom’s National Crime Agency and the New Zealand Department of Internal Affairs. These arrests follow previous arrests of two other prolific members of this community, both males in their twenties. One of the previously arrested suspects has been in French custody since 2022 for several child exploitation and related offenses. The second is currently in the US, serving a 50-year sentence for child sex abuse crimes committed in 2020 and 2021.Three of these four arrested offenders are considered to have acted as leaders and administrator of the violent online abuse community, hosting and running CVLT online servers and controlling membership for the group.Victims trapped in an abuse cycleMembers of this violent CVLT community groomed children into producing child sexual abuse material through various means of degradation, including exposing the victims to extremist and violent content. CVLT specifically targeted vulnerable victims, including minors suffering from mental health issues or a history of sexual abuse. Victims were encouraged to engage in increasingly dehumanising acts, including cutting and eating their own hair, drinking their urine, punching themselves, calling themselves racial insults, and using razor blades to carve CVLT members’ names into their skin.CVLT members’ coercion escalated to pressuring victims to kill themselves via video livestream. They blackmailed the victims to submit and remain silent, threatening to distribute already-obtained compromising photos and videos to their family and friends. CVLT would sometimes go through with their threats against victims who tried to escape their grip. CVLT is part of a larger network of extremist and child abusers active within similar online communities, referred to as “The Com”.Extremely violent online communities manipulate children and young peopleViolent online groups are targeting and manipulating vulnerable children and young people across widely accessible online platforms. There are multiple groups, associations and evolving subgroups that make up the online network known as The Com – short for community. The Com is a virtual community of groups and individuals who conduct illicit activities that glorify serious violence, cruelty, and gore.Elements of The Com network are known to have extreme ideological views and victimise children, coercing them to commit violent acts. Predators groom their victims through different methods – one approach is establishing friendships based on trust or romantic relationships. Another technique involves the use of power or coercive tactics with one goal – taking control over the victims, while getting them to engage in serious violence, self-harm, or other gruesome. It’s a vicious cycle - the predators in this network influence children or young people into conducting acts that increasingly shame, incriminate, or isolate them, this in turn makes them more vulnerable to further exploitation.Europol’s role in bringing investigations around the world closer togetherEuropol facilitates the exchange of information and provides analytical support to investigations into members of online communities targeted at child abuse and serious harm to vulnerable youth. At the end of January 2025, Europol hosted a three-day-long operational meeting related to The Com network of online child abusers. On the first day of the meeting, Europol connected 100 intelligence and police officers around the globe to exchange knowledge on the topic. During the meeting, 50 participants discussed cases to identify members active in these communities, and identify and safeguard their victims.  

The investigation uncovered a highly structured organisation using sophisticated methods to transport and conceal drugs. The traffickers operated from a logistical base in southern Spain, where they stored and prepared drug shipments before smuggling them into France. Their modus operandi relied on convoys with lead and carrier vehicles equipped with hidden compartments to smuggle the drugs and evade detection. To further secure their operations, the network used counter-surveillance tactics and frequently changed routes and vehicles.On 27 January, a coordinated law enforcement operation led to the interception of one such drug convoy upon its arrival at a property in the Morbihan region of France. The French Gendarmerie arrested the three drivers as well as the syndicate’s regional leader, who was there to oversee the delivery. Simultaneously, house searches were conducted in France and Spain, resulting in the arrest of the two suspects who led the network and the collection of significant evidence against the group.Operational resultsThe operation, carried out in close cooperation with Spanish authorities, resulted in the arrest of 24 individuals and the seizure of 151 kg of drugs - including cocaine, synthetic drugs, cannabis resin, and herbal cannabis, with an estimated street value of EUR 2.5 million.Europol supported the investigation by providing analytical expertise to map out the syndicate’s structure, identify key players, and track smuggling routes. Europol also coordinated intelligence sharing and funded the deployment of French officers to Spain to facilitate cross-border cooperation. On the action day, Europol deployed experts to France and Spain to ensure the exchange of real-time information between the involved law enforcement authorities.Eurojust supported the judicial authorities during their investigation and prepared the European Arrest Warrants and European Investigation Orders executed during the operation.Participating authorities:France: National Gendarmerie (Gendarmerie Nationale – Section de Recherches Rennes)Spain: National Police (Policía Nacional – UDYCO Málaga)

Europol continues to strengthen the fight against crime through international cooperation, reaching a new milestone in its Secure Information Exchange Network Application (SIENA). Over the past year, Europol has expanded its network of SIENA connections from 3 000 to 3 500, adding, on average, two new partners every day.This development reflects Europol's commitment to fostering collaboration between law enforcement authorities across borders through providing them with the tools to tackle increasingly complex criminal threats. SIENA enables the secure, efficient, and timely exchange of information between Europol and its partners, including national, regional and local law enforcement authorities, as well as customs, border guards, and other specialised police forces.Every new connection strengthens national law enforcement authorities’ capabilities to make the European Union more secure. SIENA provides law enforcement authorities the ability to share operational intelligence, which is crucial to efficiently tackle complex criminal threats spread across borders. As Europol's network grows, the power of collaboration, in line with Europol’s strategy, is an even stronger force in delivering security for the EU and beyond. SIENA received recently a “legislative home”. The Information Exchange Directive 2023/977, which took effect a month ago, is revolutionising international policing by making SIENA the “default channel” of cooperation for European law enforcement authorities.  Europol's Deputy Executive Director Andrei Linta said: International cooperation is the driving force behind criminal investigations targeting serious cross-border crime. Increasing the connections in our SIENA network means expanding the network of partners in the fight against global criminality. This achievement is a testament to the commitment of law enforcement authorities across Europe, and beyond, to work together in safeguarding our communities.

The report highlights several pressing challenges faced by law enforcement, including the overwhelming volume of digital data, the risk of data loss, and the persistent barriers to accessing critical information due to legal and technical constraints. The increasing use of anonymisation services has further complicated efforts to track criminal activities online.To help mitigate these challenges, the report explores the impact of new EU legislative tools, such as the e-Evidence Package, the Digital Services Act, and the EU AI Act. These instruments aim to facilitate data access, improve cross-border cooperation, and enhance investigative capabilities. However, their effectiveness will largely depend on how they are implemented and integrated into existing operational strategies.The report also underscores the value of the strategic cooperation between Europol and Eurojust, highlighting initiatives such as the SIRIUS Project, which has strengthened collaboration in cybercrime investigations. These efforts continue to play a crucial role in helping law enforcement agencies navigate an increasingly complex digital landscape.While challenges remain, the report emphasises the potential of these new legislative measures to strengthen the fight against cybercrime. Equipping law enforcement with the right tools and ensuring their effective use in investigations will be key to staying ahead of evolving cyber threats.   

The Europol Financial Intelligence Public Private Partnership (EFIPPP) provides a collaborative mechanism between more than 90 private stakeholders, Financial Intelligence Units (FIUs) and law enforcement agencies to address structured threat information across the community. The EFIPPP secretariat is located within the European Financial and Economic Crime Centre (EFECC) at Europol.The drafting of the Practical Guide was based on existing operational cooperative mechanisms in Denmark, Ireland, Latvia, Sweden, the Netherlands and the UK. Taking a practical approach, the Practical Guide highlights that successful collaboration relies on trust between public and private stakeholders. Providing an outline of the building blocks required for successful collaboration, it recommends starting small with realistic expectations, and providing leadership by example.Catherine de BolleEuropol Executive DirectorToday financial and economic crime represents one of the most pervasive dangers to our society, threatening its very fabric. Collaboration between competent authorities and the private sector in the financial arena is crucial to improving the fight against organised crime and terrorism. Together we can tackle the complex schemes set up by criminals and terrorist groups to hide their assets across the globe.Wim MijsCEO of the European Banking FederationThe EBF is a proud partner of the leading cross-border community fostered by EFIPPP in the fight against financial crime. The insights shared in today's Practical Guide highlight the power of trust and collaboration when working with European authorities. This guide offers valuable insights for building impactful operational public-private partnerships and driving meaningful action against financial crime.As well as offering hands-on guidance to investigative authorities and financial institutions in shaping their cooperation, the Practical Guide provides inspiration for policymakers in areas where there is not yet an enabling legal environment. With this guide, the EFIPPP delivers on the call made by the European Commission in its EU roadmap to fight drug trafficking and organised crime.  

The two platforms, Cracked and Nulled, had more than 10 million users in total. Both of these underground economy forums offered a quick entry point into the cybercrime scene. These sites worked as one-stop shops and were used not only for discussions on cybercrime but also as marketplaces for illegal goods and cybercrime-as-a-service, such as stolen data, malware or hacking tools. Investigators estimate that suspects earned EUR 1 million in criminal profits.The operation took place from 28 to 30 January and led to:2 suspects arrested7 properties searched17 servers and over 50 electronic devices seizedAround EUR 300 000 of cash and cryptocurrencies seizedThroughout the course of the action day, 12 domains within the platforms Cracked and Nulled were seized. Other associated services were also taken down; including a financial processor named Sellix which was used by Cracked, and a hosting service called StarkRDP, which was promoted on both of the platforms and run by the same suspects.Europol’s expertise provided on the groundThroughout the investigation, Europol provided operational, analytic and forensic support to authorities involved in the case. On the action day, a specialist and an analyst were deployed on the spot to work hand-in-hand with German investigators. Europol’s experts from the European Cybercrime Centre (EC3) facilitated the exchange of information in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at the Europol headquarters in The Hague, the Netherlands. One of Europol’s priorities is to act as the broker of law enforcement knowledge, providing a hub through which Member States can connect and benefit from one another’s and Europol’s expertise.Fighting cybercrime-as-a-serviceCybercrime-as-a-service is a growing trend on platforms like Cracked.io and Nulled.to. Cybercriminals offer tools and infrastructure as a service, enabling even less technically-skilled individuals to carry out attacks. This trend makes cybercrime increasingly accessible to a wider group of people, as these platforms often share security vulnerabilities and even provide tutorials on creating malware and engaging in other criminal activities. These two forums also offered AI-based tools and scripts to automatically scan for security vulnerabilities and optimise attacks. Advanced phishing techniques are frequently developed and shared on these platforms, sometimes employing AI to create more personalised and convincing messages. As cybercrime becomes more aggressive and confrontational, Europol aims to strengthen the fight against this sort of crime by bringing relevant partners together for cross-border cooperation and joint action.Participating countries:Australia: Australian Federal PoliceFrance: Anti-Cybercrime Office (Office Anti-cybercriminalité)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)Greece: Hellenic Police (Ελληνική Αστυνομία)Italy: State Police (Polizia di Stato)Romania: General Inspectorate of Romanian Police (Inspectoratul General al Poliției Romane)Spain: Guardia Civil; Spanish National Police (Policía Nacional)United States of America: Department of Justice, Federal Bureau of Investigation

Operation SHIELD’s 2024 edition was led by a steering group composed of French, Greek, Italian and Spanish law enforcement authorities. Europol supported this wide-reaching operation with several operational meetings and the deployment of experts with mobile offices offering analytical and forensic support.Preliminary results of Operation SHIELD V418 individuals arrested, charged, or under prosecution 52 organised crime groups investigated4 underground labs dismantledTotal seizures worth above EUR 11.1 million, including: 426 016 illegal packages of illegal pharmaceuticals4 111 kilograms of powder and raw material108 litres of active ingredient174 968 vials and ampoules over 4 683 426 tablets and pills 4 083 anti-doping “in and out competition” controls carried outPharmaceutical crime is a growing threat in the EUPharmaceutical crime has a direct impact on public health and safety, as it affects individuals, communities and national healthcare systems. It generates enormous financial losses for legitimate companies, undermines brand credibility but also endangers investments in research. To emphasise this growing threat, Europol has launched a dedicated report on intellectual property crime (IPC) targeting the production and marketing of pharmaceutical products.Selling sub-standard, falsely labelled, or falsified pharmaceutical products, as well as products diverted from the legal supply chain, organised crime networks are behind a wide range of illicit medicines and doping substances. Purchasing fake medicines pays criminals, risks the consumers’ health, and undermines the economyFake medicines traded in the EU are on the rise, which comes with a huge cost for the individual and society. Europol, the European Union Intellectual Property Office (EUIPO), and the European Medicines Agency (EMA) have come together to raise awareness about the issue of fake medicines and how they work to protect consumers against this threat.Social media and online marketplaces, both on the surface and on the dark web, continue to be central to the trade of counterfeit pharmaceuticals. These platforms provide various degrees of anonymity and target wide audiences, making it challenging to identify the criminal actors involved.Purchasing fake medicines pays criminals, risks consumers’ health, and undermines the economy. Consumers are warned to be mindful to not fund organised crime or harm themselves by buying fake medicines.

On 17 December, law enforcement conducted raids at 14 properties across Barcelona (4), Madrid (9), and Toledo (1) in Spain, and one property in Zagreb in Croatia. These operations resulted in 30 arrests, among which were the leaders of the criminal network. In addition, EUR 180 000 in cash was also seized, alongside weapons, 70 passports, equipment to falsify passports and visas, narcotic substances, 10 high-end vehicles and 33 mobile phones. A total of 33 victims – Chinese and Vietnamese nationals – were also safeguarded.This investigation builds on the dismantling of Europe’s largest Chinese prostitution ring in February 2023. Digital evidence seized during that operation has since then been meticulously analysed, including at a forensic sprint held at Europol’s headquarters in March 2023. During this sprint, experts from nine countries extracted tens of terabytes of data from hundreds of confiscated mobile phones.The new intelligence provided unprecedented insights into the methods used by Chinese criminal networks in Europe, revealing a sophisticated division of labour and reliance on crime-as-a-service actors.Two cells, one exploitation chainThe criminal organisation, composed primarily of Chinese nationals, profited significantly from the sexual exploitation of vulnerable women. To maximise profits, the group engaged in additional criminal activities, including document fraud, money laundering, and the facilitation of illegal immigration.Victims were lured into prostitution in Europe under the promise of earning high income within a short timeframe. However, upon arrival, they were subjected to severe debt bondage and trapped in a cycle of exploitation they were unable to escape due to their vulnerabilities and dependence on the traffickers.The organisation operated in two interconnected cells:Recruitment and smuggling cell: Victims were recruited in China through "travel agencies" where they disguised the exploitation by presenting prostitution opportunities as legitimate employment abroad. Using the Western Balkan corridor, the smuggling cell coordinated with local facilitators and drivers to illegally transport victims into the EU. Safe houses were maintained along the route, with logistics managed through instant messaging apps. Exploitation cell: Once in Europe, victims were initially exploited in entry-point countries. Later, they were transferred to Spain and other Member States, where they were forced to work in brothels or short-stay facilities. Victims were rotated between cities and across borders to evade detection and meet the growing demand for sexual services. The organisation maintained strict control over every aspect of the victims’ lives, taking 50% of their earnings even after their debts were repaid.A highly organised and resilient networkThe smuggling operations were meticulously coordinated through instant messaging apps, with facilitators managing safe houses along the route and providing instructions on victim transport. Upon arrival, victims were initially exploited in entry-point countries before being transferred to Spain and other EU Member States, where their exploitation continued under the strict control of the criminal group.Victims trafficked by the group were identified in exploitation networks across multiple EU countries, underscoring the scale and resilience of this criminal network.International cooperation leads to successThe operation was led by the Spanish National Police (Policía Nacional) in close cooperation with the Croatian National Police (Policija) and Europol.The Agency supported national authorities by enabling the exchange of critical intelligence and providing expert analytical support. On the action day, Europol deployed two experts to Madrid and Barcelona, where they worked alongside investigators, cross-checking real-time operational data, assisting with operations on the ground, and conducting forensic extractions of mobile phones used by the suspects.This investigation is part of a wider operational taskforce at Europol, dedicated to combating Chinese human trafficking networks. Involving 11 countries, the taskforce is focused on dismantling these criminal groups operating across Europe. 

The organised criminal network, composed of mostly Ukrainian but also Armenian, Azerbaijani, or Kazakh nationals, has been providing cash courier and underground banking services to other criminal networks. Chinese actors were also part of this criminal network, providing money laundering services. This catalogue of crime-as-a-service offerings was used by various Russian-speaking and Asian criminal actors engaged in drug trafficking, tax evasion, or the smuggling of illicit goods. These crimes were mostly committed in Spain.Results of the action days include:23 suspects arrested (20 in Spain, 1 in France, and 2 in Slovenia)91 house searches carried out (77 in Spain, 1 in France, and 13 in Cyprus)17 additional suspects prosecutedEUR 8.2 million in cash seizedEUR 27 million in cryptocurrency seized or frozenEUR 2 million in bank accounts seized or frozen36 vehicles (including some luxury vehicles), real estate, luxury watches, jewellery as well as electronic devices seizedAbuse of temporary protection status as Ukrainian citizensThe suspects are believed to have abused the temporary protection status granted to Ukrainian refugees by the EU since 2022, as well as other citizens affected by the Russian war of aggression against Ukraine. Many of the millions of refugees from Ukraine took their savings with them to Europe in cash to safeguard it from the consequences of the war. Taking advantage of the exceptions put in place to facilitate the transfer of money between jurisdictions, the criminal network moved huge amounts of cash without being questioned in detail or scrutinised during customs checks. Declaring the cash sums as part of their own patrimony, the money mules, some of whom are family members of the criminal leaders, travelled regularly between Spain, Cyprus, France, and other countries. Once several cash couriers started to be arrested, the criminal network adapted their modus operandi. It moved from significant physical cash movements to the cryptocurrency sphere, making the money transfers harder to detect. According to initial estimates, at least EUR 75 million had been moved from March 2023 to February 2024. During raids performed in Cyprus, law enforcement seized and froze around EUR 26 million in one cryptocurrency.Europol’s roleEuropol supported this international operation with experts specialised in financial crime, fighting high-risk criminal networks, unravelling money laundering structures, and tracing cryptocurrency flows. Providing analytical, operational, and coordination support to the involved countries from the very start, Europol supported the action days by deploying analysts and specialists. During the action days, these experts performed cross-checks with their mobile offices, gave forensic support in reading out seized electronic devices, and provided cryptocurrency expertise. Europol was also part of the judicial Joint Investigation Team formed by Eurojust and involving Spain, Cyprus, and Germany. 

His Majesty the King of the Netherlands visited Europol today, where he gained insight into the Agency’s efforts to support EU Member States in tackling serious and organised crime, and terrorism.Europol’s Executive Director Catherine De Bolle welcomed His Majesty to the organisation’s headquarters as Europol recently marked 25 years of fostering law enforcement cooperation across Europe and beyond. Becoming fully operational in 1999, Europol is headquartered in The Hague, the Netherlands, serving as a hub for European police collaboration.During the visit, His Majesty toured Europol’s Operational and Analysis Centre, where he observed how live operational intelligence is processed to assist ongoing investigations. With a workforce of over 1 700 people and a network of more than 300 liaison officers, Europol provides around-the-clock support to law enforcement authorities across Europe and to partners worldwide.His Majesty was also briefed on Europol’s efforts to combat priority crime areas, including drug trafficking, migrant smuggling, human trafficking, and the online sexual exploitation of children. These transnational crimes pose significant threats to the safety and security of EU citizens, and Europol plays a vital role in coordinating efforts to dismantle the criminal networks behind them. In 2024 alone, Europol supported over 3 300 investigations across Europe and beyond.As part of his tour, the King met with liaison officers from Norway and Ukraine, who are based at Europol’s headquarters. They shared their experiences of working with Europol as partner countries to enhance international cooperation in the fight against organised crime.Europol’s headquarters in The Hague connect more than 3 000 law enforcement authorities from over 70 countries and international organisations, reinforcing its position as a central player in the international fight against serious organised crime.

The fugitive was wanted in connection with multiple serious offenses across Poland and Germany. These included his suspected involvement in a fatal violent incident in Poland in December 2021, in which the victim succumbed to his injuries. He was also convicted in Poland for a violent offence in 2019, for which he was sentenced to one year in prison, and for additional crimes, including drug-related offences, resisting arrest, and insulting law enforcement officials, for which he received a 3.5-year prison sentence.This arrest highlights the effectiveness of Europol’s EU Most Wanted website and the critical role the public plays in supporting law enforcement efforts. By submitting information anonymously, individuals help ensure justice.This website has a proven track record since its launch in 2016:479 fugitive profiles have been published.167 fugitives have been apprehended.54 arrests occurred directly due to profiles published on the platform.One tip could make all the difference, check out our website to see if you recognise anyone. If you do recognise one of the fugitives featured on EU Most Wanted website, do not approach them directly. Let the national FAST teams know through the fugitives’ profile pages.

The Spanish Civil Guard (Guardia Civil), supported by Europol, has dismantled a large-scale drug trafficking network in an investigation involving Bulgaria, Colombia, Costa Rica and Panama. The suspects were allegedly involved in the reception and wholesale distribution of cocaine across the EU, as well as in money laundering. The sting was coordinated by Europol’s Operational Taskforce.Network spans Latin America, Europe and the Middle EastThe investigation, initiated in June 2022, uncovered this drug trafficking network operating across three continents. The members of the network – nationals from Albania, Bulgaria, Colombia and Spain – organised the trafficking of large quantities of cocaine from the source country to Europe. They each took on different roles within the logistical chain. The Colombian nationals handled the shipments from Colombia to Europe, while Bulgarian, Colombian and Spanish nationals oversaw the reception and further distribution of the drugs. The rescuers hid in a container to sneak into the port and, with the help of corrupt workers, extracted the cocaine during the night.  Other Albanian members, based in Dubai, acted as investors – they provided the finances needed to pay the producers for the shipments from Colombia. Members of the network also laundered the proceeds from their crimes. Intelligence suggests that the criminal network had the capacity to receive up to one tonne of cocaine per week. The shipments were made via air cargo and maritime containers. In October 2024, authorities seized 4.1 tonnes of cocaine in Panama, destined for Spain, in connection with this network. The network is allegedly linked to cocaine seizures totalling over seven tonnes. In addition, law enforcement authorities had seized another two tonnes of cocaine in Spain since the beginning of the investigation. Results of the action, carried out in three phases, between December 2024 and January 202522 arrests in Spain (Spanish and Colombian nationals);27 house searches in Barcelona, Cádiz, Madrid, Malaga and Valencia;Seizures include about 1 tonne of cocaine and 5 kg of ‘tusi’ (pink cocaine), 35 vehicles, including 8 luxury cars (estimated valued of about EUR 2.5 million), luxury watches and jewellery (estimated value of about EUR 1.5 million) and EUR 6.5 million in cash;48 weapons (5 long weapons, 5 handguns and 38 historical type weapons);53 bank accounts frozen.Europol’s support and Operational Taskforce The increase in cocaine shipments from South America to Europe, as well as the penetration of criminal networks into legal and illegal businesses in the EU, prompted the creation of an Operational Taskforce at Europol. The Taskforce targeted these groups in the source countries and along the distribution chain. During the investigation, Europol coordinated the exchange of information between national authorities, bringing them together to efficiently target the entire drug trafficking network. In addition, Europol provided continuous intelligence development, analysis and digital forensic expertise to support investigators. This intelligence gave law enforcement agencies the full picture of the covert network operating across various countries and continents. During the action days, Europol deployed experts to Spain to provide analytical and technical support to officers in the field.The following law enforcement authorities took part in the operation:Bulgaria: General Directorate Combating Organised Crime (Главна дирекция „Борба с организираната престъпност“)Colombia: Colombian National Police (Policía Nacional de Colombia)Panama: Panama National Police (Policía Nacional de Panamá)Spain: Civil Guard (Guardia Civil)

The criminal networks orchestrated a series of attacks with the use of explosives, as well as serious kidnapping cases on German soil, which immediately caught law enforcement’s attention. Law enforcement in Germany and the Netherlands monitored the situation and then carried out the most recent action day in Amsterdam on 21 January 2025.Cross-border crime tackled via cross-border action dayThe action day saw 3 persons arrested and 8 house searches. Authorities in both countries had already arrested 20 suspects and performed several house searches before the action day. Law enforcement seized various criminal assets such as a converted firearm, powerful explosive pyrotechnics, EUR 20 000 in cash, illicit substances and mobile phones.The arrested persons were wanted for a variety of crimes such as kidnapping, causing bodily harm, and drug trafficking. Performing attacks with dangerous explosives highlights the criminals’ disregard for potential collateral damage and injury. Furthermore, the criminals might have relied on minors to perform some of the attacks, highlighting the unsettling and increasing trend of crime-as-a-service involving a younger age group. Europol supported this cross-border investigation by providing data analysis and fostering the exchange of information between the involved authorities. During the action day in Amsterdam, a Europol expert was deployed with a mobile office to the coordination centre to perform cross-checks.Participating countries:Germany: Police Department Cologne (Polizeipräsidium Köln); Public Prosecutor’s Office Cologne (Staatsanwaltschaft Köln)Netherlands: Amsterdam Police (Politie Amsterdam); Internationaal Rechtshulp Centrum (IRC) Amsterdam 

The German Criminal Inspectorate (Karlsruhe Kriminalinspektion) and the Hungarian National Bureau of Investigation THB Unit (Nemzeti Nyomozó Iroda Emberkereskedelem Elleni Osztály), supported by Europol, have dismantled a criminal network involved in human trafficking for sexual exploitation. The investigation resulted in a simultaneous action day in Germany and Hungary on 15 January 2025.The investigation into this criminal network was initiated in 2023. The suspects recruited the victims, young women from Hungary, via the so-called lover boy method or by seducing them with the false promise of good work opportunities abroad. The victims originated from the same region in Hungary and came from particularly fragile socio-economic environments.  Once the victims were under their control, the suspects transported them to Germany. There, the suspects forced the victims into street prostitution often while coercing them through violence. The alleged traffickers are all male except for one woman who oversaw the victims at the place of prostitution. The actions led to:9 house searches (1 in Germany and 8 in Hungary)7 arrests (3 in Germany and 4 in Hungary)11 victims identified in Germany and HungarySeizures including: 2 real estate properties, 2 vehicles, phones, documents and cash.The lover boy scamThe ‘lover boy’ technique is widely used by criminals to recruit victims facing economic and social hardship. The suspects target their victims’ vulnerabilities and seduce them with expensive gifts and promises of a better life abroad. Many victims end up leaving their families in search of love and new opportunities in other countries. Once they find themselves in their new home abroad, they are forced into prostitution to earn money for their handler. The victims are lured with affection, violence and even threats against them and their families back home.Europol's supportEuropol coordinated the operational activities, facilitated the exchange of information and provided analytical support. During the action day, Europol deployed an expert on the spot to cross-check operational information in real time and support investigators on the field.  

From 13 to 17 January, the specialists pooled their knowledge and expertise to establish a new organisational workstream to identify, freeze and seize criminal assets through all possible means available. This includes sharing expertise in identifying persons and new modi operandi surfacing in money laundering schemes, and planning joint actions to seize assets.Throughout the operation, experts identified:53 properties, 8 of which were valued EUR 38.5 million;Over 220 bank accounts, including one with a US $5.6 million balance;15 companies, over 20 yachts and luxury vehicles, 4 of which were valued more than EUR 600,000;83 cryptocurrency addresses and wallets.Another key result of the operation was the freezing of EUR 200 000 in cryptocurrencies. The initiative was organised by the European Financial and Economic Crime Centre (EFECC) and supported by Europol’s specialists and analysts in asset recovery, cryptocurrencies, open-source intelligence and innovation tools.  Burkhard MühlHead of the European Financial and Economic Crime Centre (EFECC)This week, the Asset Search & Seize Enforcement Taskforce showcased Europol at its finest. Bringing together over 80 top experts from law enforcement and the private sector, we worked as one to trace, freeze, and seize the profits of organised crime. Together, we’re striking criminals where it hurts most – their wallets. As we move forward united, success is inevitable.Objective: seizing criminal assets… The seizure of criminally acquired assets is extremely low worldwide. It is estimated that law enforcement manages to take just a fragment of criminal assets out of criminals’ hands; below 2% of the estimated yearly proceeds of organised crime. The remaining 98% provides the fuel for the continuation and expansion of organised crime activities. The most threatening criminal networks in the EU use real estate as one of the main industries to launder their illicit –and untaxed– profits (41%). Even though Project A.S.S.E.T. has taken place this week, law enforcement in all EU Member States and beyond are already setting up joint actions to increase the number of criminal assets recovered. Recent major operations Whitewall and Gorgon are good examples of this international law enforcement cooperation to increase seizures. Based on the findings from these two investigations, Europol supported authorities from six countries in taking down underground bankers who were laundering the proceeds of large-scale drug trafficking and other serious crimes. One of the most successful outcomes of this operation was the seizure of EUR 27 million in cryptocurrencies alone. …through joint action Project A.S.S.E.T is a decisive step taken by EU Member States and third parties towards prioritising financial investigations, one of the areas which Europol is focusing on to successfully tackle top criminals. In addition, the new Directive on Asset Recovery and Confiscation, which came into force in 2024, will become an important tool in the confiscation of these criminal assets. It gives new powers to the Asset Recovery Offices to efficiently freeze assets when required and to take immediate action to preserve the property until a freezing order has been issued. The initiative exemplifies how Europol aims to strengthen the fight against all forms of serious international and organised crime by bringing relevant partners together. In this regard, a crucial element of Project A.S.S.E.T. is the participation of financial actors from the private sector, especially organisations from the banking sector and cryptocurrency exchanges. The public-private partnership between Europol and the financial sector is a priority for the law enforcement agency: in December, Europol hosted a milestone plenary to address key issues in financial crime and intelligence, which concluded with the launch of a new workstream.Project A.S.S.E.T. is supported by the @ON Network funded by the EU Commissions, led by the Italian Antimafia Investigation Directorate (DIA).

Phase 3 of the SIRIUS project will continue to assist LEAs, JAs, and service providers in navigating the increasingly complex legal framework. The project will continue to foster close cooperation between the public and private sectors, ensuring that criminal investigations are more effective and efficient in the digital age. The adoption of new EU-wide legislation, alongside key international agreements such as the Second Additional Protocol to the Budapest Convention, and the agreed draft text for a UN Convention on Cybercrime, are reshaping the legal and operational landscape surrounding electronic evidence.  In this challenging environment, SIRIUS has established itself as a centre of excellence in the field of cross-border access to electronic evidence in the EU. It offers a variety of services, such as guidelines, trainings and tools, to help with accessing data held by service providers.To this day, SIRIUS serves a community of competent authorities from over 50 countries, representing all EU Member States and a growing number of third countries. It supports over 8 500 competent authorities and fosters collaboration with 220 service providers. With the upcoming implementation of new legal frameworks at EU and international level, Europol and Eurojust foresee to reinforce the success of the SIRIUS project with the expanded mission and diversified portfolio of activities, which will ensure seamless support to national LEAs and JAs during this critical transition.The project’s activities will include the development of investigative tools, the organisation of high-impact events, and expanded capacity building to address urgent needs from LEAs and JAs. Additionally, the project will prepare LEAs and JAs to effectively use new instruments under the forthcoming EU Electronic Evidence legislative package, as well as other legislative changes concerning the cross-border acquisition of electronic evidence.With its third phase, the SIRIUS project will also expand its geographical focus, strengthening cooperation with non-EU countries of particular importance for the implementation of the new legislation. This broadened approach will significantly contribute to the fight against all types of crime, with particular emphasis on organized crime and terrorism.By leveraging the expertise and established frameworks of Europol and Eurojust, SIRIUS project will smoothly transition into its next phase, ensuring that European LEAs and JAs stay at the forefront of innovation in criminal investigations involving electronic evidence. 

Three awards were given out this year, each decided by a different group of voters:the international law enforcement community represented in our headquarters, the Heads of Communication of the European law enforcement authorities, and members of the public.We are happy to announce that Sergio Chicharro from Spain, Connie Maria Westergaard from Denmark a Capture two-time winner, and Sara Teixeira from Portugal submitted the winning entries.The winners of Capture24The Europol Liaison Network’s Vote went to Sergio Chicharro from Spain for his submission showing officers of the Spanish National Police inspecting a tunnel. This image was the favourite of the 300 liaison officers from around the world, representing both EU Member States and Third Parties in the Europol headquarters in The Hague.  Connie Maria Westergaard from Denmark entered the favourite picture of the Heads of Communication of the European law enforcement authorities, who were asked to cast their vote during the annual “European Law Enforcement Communicators Conference”. Her winning image shows a German Shepherd puppy and his handler from the Danish National Police training together in the snow. A frequent entrant in the competition, Connie also won the Public Vote in the 2023 edition of Europol’s photo competition. The Public Vote was awarded to Sara Teixeira from Portugal with her portrait of a motorcycle officer of the Public Security Police giving a ride to a “Careto”, a traditional Portuguese figure that emerges during carnival. Her photograph received the most votes in the online ballot advertised on our social media channels, which was open to anyone who wanted to participate.The three winners win a trip for two to the Netherlands, including a visit to Europol. Their images also feature in our 2025 calendar and will be used in other Europol publications.If you are a law enforcement officer with a passion for photography, keep an eye on our website for next year’s photo competition!

The operation resulted in over 500 cash movement checks and the subsequent detection of illicit cash flows of almost EUR 2.7 million in cash. This amount is likely to increase in the upcoming months as many discoveries are currently being prosecuted. In addition to cash, authorities also seized valuable items such as gold and jewellery, including 18 gold bars with a value exceeding EUR 1,7 million. The joint action was aimed at identifying cash smuggling in EU territory. It was led by French Customs and also involved the European Anti-Fraud Office (OLAF). Throughout the two-week-long action, authorities searched over 300 passengers at airports, ports, train stations and borders of EU countries, and inspected several postal purchases.Europol’s role in combatting money launderingEuropol’s European Financial and Economic Crime Centre (EFECC) played a crucial role in this major operation by providing essential operational support to the authorities involved. Throughout the action weeks, two financial analysts and a money laundering specialist supported national authorities by cross-checking and validating information. Close cooperation with Customs agencies was key in this operation, as it constituted a powerful strategy for combatting transnational criminal threats and money laundering. By pooling resources, expertise and intelligence, authorities can effectively disrupt illicit financial flows and dismantle criminal networks operating across the EU.Enhancing the EU's interoperabilityEuropol has established itself as the EU criminal information hub and is enhancing the value of its network by providing Member States with access to a growing number of partners and sources of information. In this regard, the Agency is further evolving from collecting to connecting information. This money-laundering case is a good example of its evolution.Europol is also working with relevant EU agencies, the European Commission and the Member States to implement its roadmaps related to travel intelligence and to EU systems interoperability.Participating countriesAuthorities from the following countries took part in this operation: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Finland, France, Germany, Greece, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Romania, Slovak Republic, Slovenia, Spain and Sweden. 

The suspects were targeting individuals on social media and are accused of running a sophisticated phishing scheme to steal funds from European citizens. Exploiting Facebook Marketplace, the criminals used phishing techniques to trick victims into sharing their banking details, which were then used to transfer funds to accounts controlled by the group.On 19 December, Ukrainian authorities carried out 10 searches in Kyiv and Zaporizhzhia, seizing computers and mobile devices containing evidence of fraudulent activities. Investigations have so far identified at least 30 victims from Denmark, Finland, Norway, and Hungary, with total losses exceeding EUR 50 000.Europol’s European Cybercrime Centre supported the investigation by facilitating the exchange of information and providing analytical support. During the action day, a Virtual Command Post set up by Europol enabled Ukrainian and Finnish authorities to share, in real time, information gathered during the house searches.The Ukrainian National Police has released a news article outlining more details about the searches.

The 17 action days also resulted in the seizure of 30 tonnes of molluscs and 6 tonnes of glass eels worth up to EUR 10 million on the seafood market. Six of the suspects are considered High Value Targets by authorities. Molluscs linked to risk of hepatitis The criminal gangs mainly fished Japanese clams, which are enjoyed by locals and tourists in coastal areas, including during the festive season. The gangs falsified the contaminated seafood documentation to present it as suitable for human consumption. This could have developed into a major health issue, as the continuous consumption of contaminated molluscs puts people at risk of serious diseases such as hepatitis.The investigation led to the uncovering of organised criminal groups involved in trafficking either clams or glass eels, depending on the season of the year, in France, Portugal and Spain. This led to the dismantling of a major criminal network involved in the illegal poaching, gathering and smuggling of glass eels.  Criminal networks operating internationallyOne kilo of these molluscs can be sold on the seafood market for up to EUR 25. Criminal networks exploited fishers, originating from Asian countries, paying them just EUR 1 per kilo of molluscs they fished. The fishers would fish illegally in Portugal, sending the molluscs to Spain and on to the criminal networks.First-ever connection between human trafficking and environmental crime proved in the EUThe contrast between the price of the molluscs on the market and the fishers’ earnings led authorities to confirm the link between environmental crime and trafficking in human beings for labour exploitation for the first time ever in the European Union.  Criminal trend detected by EuropolEuropol experts from the Environmental Crime Unit detected the criminal trend and provided their expertise to the Member States involved. Europol supported operational meetings, coordinated the action days and provided national authorities with financial support.During the action days, Europol’s experts were also deployed on the ground in Portugal, Spain and France. The outcomes of the operational analysis led to the identification of new high-value targets and triggered new investigations.Authorities involvedThe following law enforcement authorities were involved in the operation: France: French Gendarmerie (Gendarmerie Nationale: Commandement pour l’environnement et la santé, CESAN; Office central de lutte contre les atteintes à l’environnement et à la santé publique, OCLAESP) French Office for Biodiversity and French Customs;Portugal: Nature and Environmental Service Protection of the Portuguese National Republican Guard (SEPNA/GNR), and Food and Economic Safety Authority (Autoridade de Segurança Alimentar e Económica, ASAE);Spain: Spanish Civil Guard (Guardia Civil, SEPRONA).

The key findings of today’s report cover the following areas:The types of businesses prone to abuseOrganised crime activities enabled by legal businessesMethods used by criminals to exploit these structuresA critical enabler of organised crimeThe report identifies the abuse of legal businesses as a key enabler of organised crime. Legal business structures are integral to laundering criminal proceeds, distorting economic competition, transporting illicit goods and expanding the influence of criminal networks. Cash-intensive businesses, in particular, are exploited to shield money laundering activities, creating unfair advantages that undermine legitimate enterprises.The findings also highlight how criminal networks use corruption to deepen their grip on local communities, fostering economic dependencies that shield illicit activities from law enforcement.Key findingsA common threat vector: 86% of the EU’s most threatening criminal networks exploit legal business structures. Criminals use these frameworks to disguise their activities, facilitate money laundering, and expand their operations while evading law enforcement.Criminal ownership and infiltration: High-level infiltration or outright ownership of legal businesses allows criminal networks to mix legitimate and illicit activities seamlessly. Some companies are established purely as fronts for criminal operations, while others are taken over to serve long-term criminal goals.Cross-border abuse: Although the abuse of legal business structures is a global phenomenon, most exploited or infiltrated companies used by EU-based criminal networks (70%) operate within the EU or its neighbouring countries. Nevertheless, there is a significant share of EU criminal networks that are involved in legal structures located in other places in the world. Criminally infiltrated legal business structures are situated in almost 80 countries across the globe.Insider threats: Employees, managers, or executives in legitimate positions are increasingly exploited by criminal networks to gain access, knowledge, and influence over operations.Facilitating multiple crimes: Criminally controlled businesses often serve several networks simultaneously, enabling various forms of serious and organised crime.The findings will inform future operational activities, but will also serve as input to discussions on administrative and preventive measures. 

Paper trail on euro banknotesIn 2021, cash was seized during a house search in connection with an investigation into cocaine trafficking. Some of the five-euro notes had handwritten inscriptions that provided information on who was coordinating and facilitating the financial aspect of the drug trafficking.The Spanish Guardia Civil submitted this information to Europol, which cross-checked it against the data gathered in the EncroChat and Sky ECC cases. As a result, the suspect was identified as a coordinator offering underground banking services to a criminal network based in southern Spain, which in turn was under the supervision of a network operating from Dubai. The suspect, a British national, was arrested on 12 September 2022.Building on this successThe next step in the investigation was to analyse the data in greater depth to identify individuals in contact with the suspect. This effort aimed to map the criminal network and understand the roles of its members. The close collaboration between Europol, the Spanish Guardia Civil and members of the dedicated Operational Taskforce established at Europol facilitated the distribution of numerous intelligence packages. Based on these findings, a Europol-coordinated action day took place on 4 November 2024 in Malaga, Spain, with the participation of Belgian, Bulgarian, Dutch, and United States law enforcement authorities.‘Offline’ and ‘online’ money flowsOperation WHITEWALL was the first criminal investigation of what was to become a Europol Operational Taskforce focused on underground banking. It aimed to disrupt and dismantle financial networks offering ‘crime as a service’. Predominantly controlled from the United Arab Emirates and operating throughout the EU and beyond, these criminal service providers cater to those who need to conceal the origins of vast amounts of illicit income.One of the main findings of the investigation was that a member of a criminal network based in Albania, targeted during Operation GORGON, was facilitating the transfer of large sums of money through cryptocurrencies. Used not only by the Albanian criminal underworld, but also by other criminal organisations and high-value targets, this is an innovative approach to money laundering.Europol as the centre of expertiseThe takedown of these sophisticated criminal enterprises relied on Europol’s multi-faceted expertise in the various areas of crime under investigation. Operations GORGON and WHITEWALL highlighted the many facets of organised crime, with underground banking and money laundering not only functioning as financial crimes in their own right but also as services for those involved in drug trafficking, contract killings and weapons trafficking, to name but a few of the crimes in which the networks are involved.In the course of these long-term investigations, some of which are still ongoing, Europol has disseminated numerous intelligence and analytical reports to the cooperating partners, as well as numerous operational meetings held at the Agency’s headquarters in the Netherlands or in Spain and Albania. During the action days, Europol deployed specialists and analysts to the raids, where they provided expertise in organised crime, financial crime and asset recovery. Cryptocurrency experts and cyber specialists supported the actions on site with mobile offices, as well as from Europol’s headquarters, offering their digital forensic abilities and remote investigative capabilities.Operation GORGON and Operation WHITEWALL are textbook examples of structured data-driven case building, trust-based international partnerships, and cross-department support provided by Europol. The collaboration with a leading stablecoin issuer and a prominent global cryptocurrency asset provider proved to be instrumental in achieving the operations’ successes. Their seamless integration into the investigation and dedication to halting illegal activities enabled the efficient execution of complex operational measures. This success showcases the power of public-private-partnerships in achieving seizures within the digital asset ecosystem.Participating countries:Albania: Special Prosecution Office for Anti-Corruption and Organised Crime (Struktura e Posaçme Anti-Korrupsion – SPAK), National Bureau of Investigation (Byroja Kombëtare e Hetimit)Bulgaria: General Directorate Combating Organized Crime (Главна дирекция „Борба с организираната престъпност“)Belgium: Federal Police (Federale Politie)Netherlands: FIODSpain: Guardia CivilUnited States: Drug Enforcement Administration 

Searches were conducted simultaneously at multiple locations. The State Police carried out 26 searches in Riga, discovering warehouses containing cigarettes and detaining 7 individuals, including 6 Latvian and 1 Russian national. Meanwhile, the State Border Guard carried out 8 searches in Ludza, Rēzekne and Daugavpils, detaining 25 Ukrainian nationals at the Ludza factory, where counterfeit cigarettes were being manufactured under well-known brand names.Seizures by the State Police164 million cigarettes without excise stamps, equivalent to 16 semi-trailer lorry loads3 passenger cars and 3 cargo trucks used for criminal activitiesEUR 55 000 in cashVarious technical equipment, including GPS signal jammers and detectorsAn unregistered firearm and ammunitionSeizures by the State Border Guard132 million cigarettes without excise stamps, equivalent to 13 semi-trailer lorry loadsApproximately 47 tons of shredded tobacco leaves, enough to produce 68 million cigarettes4 cargo trucks with trailers and 1 cargo van used for criminal activitiesCounterfeit excise stampsAn illegal cigarette factory in Ludza, equipped with production machinery and raw materialsWarehouses containing raw materials for cigarette production in other locationsThe investigation was supported by Europol, which provided analytical support to the authorities involved. Europol also organised operational meetings and provided remote support during the searches. The Lithuanian Customs Criminal Service (Muitinės kriminalinė tarnyba) also supported this investigation. Several criminal cases related to illegal tobacco production and money laundering have been initiated by Latvian authorities as a follow-up to the operation. Prior to the raids, several individuals linked to the network's criminal activities and involved in laundering illicit funds in Latvia were detained. The extensive operation by Latvian authorities to dismantle the illegal cigarette factory has been documented in a comprehensive video:

In total, 12 countries collected over 6 350 links from 46 online platforms and 20 websites that incite violence or contain hate speech against ethnoreligious groups. This includes material produced or disseminated by organisations, individuals or groups containing illegal hate speech, such as anti-Semitic hate speech, as well as material celebrating or calling for violent or terrorist acts against an ethnoreligious group. Law enforcement authorities have identified an increasing polarisation of the online sphere, especially after 7 October 2023.Key collaboration with service providersAll forms of violence identified during the investigation were referred to online service providers for assessment under their own terms of service. In addition, authorities were also able to issue legally binding removal orders on the action day.Cooperation with online service providers is essential to combat illegal online content, such as hate speech, incitement to violence, violent extremism and terrorism. Europol is strengthening this effort by bringing together relevant partners for cross-border cooperation and joint action. Private parties are also key partners.Europol’s crucial role in combating hate speechEuropol experts from the EU Internet Referral Unit (EU IRU) coordinated the international action and supported national counterterrorism police units by identifying, collecting and referring online hate speech content. Europol relied extensively on the EU Council Framework Decision 2008/913/JHA on combating racism and xenophobia, which tackles the dissemination of hate speech by ensuring that EU Member States have criminal penalties and other measures in place.The EU IRU is comprised of a team of experts who detect and investigate malicious content on the internet and in social media. The EU IRU has just published the “Online jihadist propaganda: 2023 in review”, an analysis of the major trends and developments in the online propaganda of the most prominent Sunni jihadists organisations – the Islamic State (IS) and al-Qaeda (AQ). The review covers the period from 1 January to 31 December 2023 and identifies the dominant themes and types of productions exploited by the two groups during this period. Countries involvedNational Internet Referral Units and specialised police units from the following countries took part in this Referral Action Day: Albania, Austria, Belgium, France, Germany, Hungary, Iceland, Italy, Luxembourg, Portugal, Spain and the United Kingdom. 

The scale and scope of this operation were designed to be as wide as possible. Checks and searches encompassed both the physical and the online world, including the clear web, the dark web, and social media platforms. Notably, these ‘cyber patrols’ involved not only law enforcement authorities but also prosecutors from different jurisdictions, adding significant value to their operational effectiveness.In total, results of the JAD SEE 2024, which was held under the motto “Uniting Forces Against Organised Crime”, include:796 individuals arrested316 new investigations initiated442 weapons seized31 109 officers on duty performed 655 914 checks on entities, which includes 516 153 persons, 152 284 vehicles, 4 985 postal packages and 1 181 premisesEU security begins outside its bordersFrom the proactive participation of partners in the Western Balkan region and of countries part of the Eastern Partnership such as Moldova and Ukraine, to the support of Türkiye, the key to this operation’s success was cross-border collaboration. Working side by side, EU and non-EU agencies and projects have provided their expertise, enabling the JAD SEE 2024 to present a truly united front against organised crime.Europol supported this joint undertaking by deploying experts with mobile offices who could cross-check new information against the agency’s databases. The partner countries and agencies similarly deployed specific expertise, with special detection units, canine units, experts in the detection of concealment methods, and document fraud experts supporting the vast physical and virtual operation.The EU4FAST project supported the setup of the coordination centre and the participation of the Western Balkan countries, Moldova, Ukraine, Türkiye and selected EU Member States, as well as INTERPOL, during the operational phaseEMPACT as platform for collaborationThe JAD SEE 2024 is informed and driven by the European Multidisciplinary Platform Against Criminal Threats (EMPACT), the EU’s security initiative for combating serious and organised crime globally. The success of this operation is rooted in intelligence-driven actions and a unified, collaborative approach, showcasing the added value of collective efforts in addressing complex and serious international crime.Participating EU Member statesAustria, Bulgaria, Croatia, France, Germany, Greece, Hungary, Italy, Netherlands, Poland, Portugal, Romania, Slovenia, Slovakia, Spain, SwedenParticipating third-party countriesAlbania, Bosnia and Herzegovina, Kosovo*, Moldova, Montenegro, North Macedonia, Serbia, Türkiye, UkraineParticipating agencies and projectsEU Commission, CEPOL, Europol, Eurojust, Frontex, EU Strategy for the Danube Region, EU4FAST, INTERPOL, SELEC, UNDP SEESAC, UNODC *This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence. 

Catherine De Bolle, Executive Director of Europol, said:In today’s changing world, terrorist actors are continuously adapting their narratives, outreach and activities in response to the most recent geopolitical and socioeconomic developments. The targeting of young people and their involvement by terrorist groups, including their active role in the production of online propaganda and the planning of attacks, is an increasing concern. Equally concerning is the use of AI and other technology by terrorist groups to strengthen their messages and facilitate their operations. Europol and its partners stand resolute to combat these emerging developments through strong partnerships and innovative solutions.The EU TE-SAT 2024 underscores the adaptive nature of terrorist threats. Only by leveraging real-time intelligence, fostering cross-border collaboration, and employing advanced technologies, we can counter these evolving challenges and protect our communities.Geopolitical tensions amplifying terrorist narratives The 7 October 2023 Hamas attack on Israel and the subsequent military response in Gaza have triggered global reactions. Hamas widely shared propaganda from the initial attack to mobilise jihadist groups globally. Terrorist groups used the high number of civilian casualties to develop propaganda, radicalise individuals and intensify calls for violence. Hamas utilised the crisis to secure funding via money transfers, cryptocurrencies, and Hawala networks. Some of these transfers potentially came from the EU.The conflict and the propaganda stemming from it has unified extremist narratives across jihadist, right-wing, left-wing, and anarchist groups, sparking online incitement to violence, particularly targeting Jewish and Israeli interests worldwide. This has amplified anti-Semitic and anti-Muslim tensions within the EU. Regionally, Hezbollah's confrontations with Israel raise EU security concerns.Leveraging today’s youth and technologyThe involvement of young people in terrorism-related activities is growing. Terrorist groups increasingly exploit online platforms and gaming environments to reach younger audiences. Disseminating content like videos, music and memes, these groups radicalise individuals and mobilise them for propaganda production, recruitment, and even attacks. Furthermore, the radicalisation has sped up; the time between initial exposure to extremist content and violent action has significantly decreased.Increased anti-Semitic and anti-Muslim rhetoric has heightened societal tensions, resulting in strong polarisation of certain groups. Meanwhile, both jihadist and right-wing extremists have used the Israel-Hamas conflict to promote their narratives and inspire action.The dual nature of technology emerges when it is exploited by terrorist groups, which are capitalising on advancements in AI and encrypted communication technologies to further their operations. AI-generated deepfakes are being used for propaganda and disinformation, while encrypted messaging apps provide secure communication channels for planning and recruitment. Innovation has been used for weaponry, with 3D-printed firearms becoming more popular, particularly among right-wing extremists. EU TE-SAT 2023 key figures: 120 terrorist incidents across seven EU Member States, including 98 completed attacks, 9 failed attempts, and 13 foiled plots, marking a significant rise from 2022.6 fatalities and 12 injuries resulted from jihadist attacks, the deadliest form of terrorism in the EU.426 arrests for terrorism-related offences were made across 22 Member States, with jihadist offences accounting for 78 % of the total.Jihadist terrorism: a continuous and lethal threatJihadist terrorism remains the most significant threat to EU security. In 2023, 5 of the 14 attempted jihadist attacks were completed. All these were carried out by lone actors, highlighting the challenges of preventing attacks by isolated individuals. Furthermore, these so-called lone actors are well connected via online communities. Most attacks used weapons such as knives and firearms, with perpetrators often radicalised online. Jihadist propaganda continued to exploit divisions in society and geopolitical events, such as the October 2023 Hamas attack on Israel, to recruit and radicalise individuals.Terrorist groups are also leveraging encrypted communications and social media to evade detection while continuing to disseminate propaganda targeted at vulnerable individuals. Young people are increasingly involved in producing and disseminating propaganda on online networks. 334 individuals were arrested for jihadist-related offences, with young people making up a growing proportion of the total arrests. Detention facilities remain hotspots for radicalisation, with some inmates attempting to recruit others. Released prisoners continue to pose a potential security risk.Right-wing terrorism: exploiting digital toolsWhile only two right-wing terrorist attacks took place in 2023, and both were foiled, the ideological and operational threat posed remains significant. Right-wing extremists, particularly younger individuals, are increasingly active in online communities, producing propaganda, inciting violence, and experimenting with technologies such as 3D printing to create weapons.Online platforms are used for spreading propaganda, recruiting others, and sharing weapon-making instructions, with significant interest in 3D-printed firearms. Arrests included young individuals who were radicalised online and involved in incitement and planning attacks. Narratives like eco-fascism and anti-system rhetoric gained prominence, combining environmental concerns with extremist ideology. Left-wing and separatist terrorism: persistent activitiesLeft-wing and anarchist terrorism accounted for 32 attacks in 2023, mostly targeting property and critical infrastructure. Separatist groups were responsible for the majority of completed attacks. These left-wing and anarchist terrorist groups often align their activities with socio-political grievances, such as anti-capitalist and environmental movements.Left-wing actors targeted government buildings, financial institutions, and businesses. Support for imprisoned anarchists remained a catalyst for violent acts, as did broader anti-state sentiments. Ethno-nationalist groups remained active, often focusing on regional independence.

Known as ‘booter’ and ‘stresser’ websites, these platforms enabled cybercriminals and hacktivists to flood targets with illegal traffic, rendering websites and other web-based services inaccessible.This multifaceted operation, coordinated by Europol and involving 15 countries, targeted all levels of those engaged in this crime. Three administrators behind these illicit platforms were arrested, and several actions were taken against numerous users of these services.The festive season has long been a peak period for hackers to carry out some of their most disruptive DDoS attacks, causing severe financial loss, reputational damage and operational chaos for their victims. The motivations for launching such attacks vary, from economic sabotage and financial gain to ideological reasons, as demonstrated by hacktivist collectives such as Killnet or Anonymous Sudan.Overview of the operational activities Twenty-seven booter and stresser websites taken down, including zdstresser.net, orbitalstress.net, and starkstresser.net.Three administrators arrested in France and Germany. Over 300 users identified for planned operational activities.With countries on opposite sides of the globe involved, Europol – home to the world’s largest network of liaison officers from EU Member States – played a pivotal role in coordinating the international effort.Europol’s European Cybercrime Centre (EC3) facilitated operational meetings and organised intensive one-week technical sprints to develop investigative leads in preparation for the final phase of the operation.In addition, Europol provided analytical support, crypto-tracing expertise, and forensic assistance to the investigation, while facilitating the exchange of information through the Joint Cybercrime Action Taskforce (J-CAT), which operates from its headquarters.An ad a day to keep cybercrime at bayIn response to this growing threat, Operation PowerOFF not only focuses on dismantling the infrastructure supporting these attacks but also takes proactive steps to prevent further incidents. The InterCOP network played an important role in enabling countries to join the PowerOFF operation.Building on past efforts, law enforcement is launching an online ad campaign aimed at deterring individuals from engaging in such activities. The campaign highlights the consequences of DDoS attacks and will target potential offenders where they are most active: online.The campaign will use the following channels:Google search ads: targeted deterrence messages shown to young people searching for DDoS-for-hire tools on Google.YouTube ads: preventative messages aimed at young people watching YouTube tutorials on DDoS-for-hire tools.In addition to these digital interventions, other methods such as knock-and-talks, more than 250 warning letters, and over 2,000 emails will be used to reach users of illegal services.Operation PowerOFF demonstrates an ongoing coordinated effort by law enforcement to tackle this threat comprehensively, from dismantling illegal platforms to preventing future attacks through education and deterrence. Operation PowerOFF continues.The following authorities are taking part in this year’s edition of PowerOFF: Australia: Australian Federal Police (AFP)Brazil: Federal Police (Polícia Federal) Canada: Royal Canadian Mounted Police (RCMP)Finland: National Police (Poliisi)France: National Police (Police Nationale – OFAC), JUNALCO (Juridiction Nationale de Lutte contre la Criminalité Organisée)Germany: Federal Criminal Police Office (Bundeskriminalamt), Hessian State Criminal Office (Hessisches Landeskriminalamt), Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center (Generalstaatsanwaltschaft Frankfurt am Main – ZIT)Japan: National Police Agency (NPA)Latvia: State Police (Valsts policija)The Netherlands: National Police (Politie)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości)Portugal: Judiciary Police (Polícia Judiciária), Public Security Police (Polícia de Segurança Pública)Sweden: Swedish Police Authority (Polisen – SC3), Regional Cybercrime Centre Region West (RC3)Romania: Romanian Police (Poliția Română)United Kingdom: National Crime Agency (NCA)USA: U.S. Department of Justice (US DOJ), Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), Defense Criminal Investigative Service (DCIS) 

They have taken lives, let’s take them down.The European Network of Fugitive Active Search Teams (ENFAST), supported by Europol, maintains the EU Most Wanted website to seek help finding fugitives across Europe. Over 20 criminals have just been added and this year’s catchphrase “blood on their hands” seeks to increase public awareness about dangerous fugitives wanted for serious crimes such as murder.When you send an anonymous tip via the website, you will reach the ENFAST community, which is the European network of police officers within national fugitive teams. They are available around the clock and can immediately undertake action to locate and arrest fugitives when necessary. The members of ENFAST are all specialised in locating criminals on the run who are suspected, or have been convicted, of serious crimes and are subjects of European Arrest Warrants.One tip could make all the difference.This website has a proven track record since its launch in 2016:454 fugitive profiles have been published;164 fugitives have been apprehended;53 arrests occurred directly due to profiles published on the platform.If you do recognise someone, do not approach them directly. Let us know through the fugitives’ profile pages. All new profiles are marked in red. Anonymous tips are accepted too.  

This workstream will focus on professional enablers, such as lawyers, real estate brokers, and accountants who help, knowingly or not, to move illicit funds into legitimate systems. The workstream will begin operating in 2025, based on insights shared by expert speakers during the event.A highlight of the plenary was Wim Mijs, CEO of the European Banking Federation, meeting Europol’s Executive Director Catherine De Bolle. They discussed how the financial sector and law enforcement can work together to fight financial crime. Their joint closing speeches on 5 December emphasised the EFIPPP’s vital role in building a unified approach against illicit activity.Catherine De Bolle, Europol Executive Director: Success in a globalised world is not achieved by strength alone, but by the partnerships we build. I am therefore very proud to see how the EFIPPP has developed. The project started with just a handful of partners sharing concerns and expertise and gradually grew to become the fully-fledged public-private partnership we know today; an innovative and dynamic platform allowing public and private partners to work together in building a common intelligence picture of financial crime threats and terrorist financing.Wim Mijs, CEO of the European Banking Federation: Since its inception, the EFIPPP has grown into a ground breaking alliance, bringing together 96 institutions from 27 jurisdictions. This includes law enforcement agencies, Financial Intelligence Units, and financial institutions. This remarkable expansion highlights the increasing recognition across sectors of the necessity and shared desire to work hand in hand to combat financial crime. The EFIPPP is the first transnational information sharing mechanism ever established in the field of Anti-Money Laundering and Counter-Terrorism Financing. Created in 2017, the EFIPPP provides an environment for cross-border cooperation and information exchange between Europol, competent authorities (including Financial Intelligence Units and law enforcement agencies) and regulated financial service entities such as banks.The EFIPPP offers a unique opportunity to test and increase possibilities for cross-border cooperation that transcends sectorial lines. In particular, the EFIPPP seeks to:Build a common intelligence picture and understanding of financial crime risks through the examination and public-private sharing of risk indicators, early warnings and threat typologies;Facilitate the exchange of operational or tactical intelligence associated with on-going investigations (in accordance with the applicable national and EU legal frameworks);Identify gateways for information sharing and support work on clarification of regulatory constraints (in accordance with the applicable national and EU legal frameworks);Promote the use of new tools for combatting financial crime, leveraging new technologies and exchanging common experience and methods for innovation and trainings;Support domestic and similar collaborative fora in relevant jurisdictions with the goal to act as an effective hub between the different platforms and facilitate cross-public-private partnership information and intelligence sharing. 

Although most of the criminal activities took place in Belgium, the main perpetrators mostly operated from the Netherlands. Besides committing large-scale ‘phishing’ campaigns and trying to gain access to financial data by phone or online, the suspects also pretended to be police or banking staff and approached older victims at their doors.After committing their criminal activities, the suspects spent all the victims’ money buying luxury watches and jewellery, and partying dressed in designer clothes at expensive clubs. Authorities believe that the victims are based in at least 10 European countries and that the economic damages amount to several millions of euros.Overall results of the action day:8 suspects arrested (4 in Netherlands, 4 in Belgium)17 searchesSeizure of electronic devices, luxury watches and jewellerySeizure of large amounts of cashSeizure of a firearmEuropol’s contribution began in 2022Belgian authorities conducted their first investigations in 2022 with the support of Europol and Eurojust. As the main suspects were Dutch citizens, Dutch authorities opened their own investigation in 2023. A few months later, an operational task force was created to investigate the high-value targets involved in the above-mentioned criminal activities and dismantle the gang. During the course of the investigation, Europol brought all partners together to ease effective coordination and facilitated the exchange of information between Member States. Europol’s experts also provided national authorities with analytical and financial support. As of 2022, Eurojust was also involved to support the investigations at judicial level. Eurojust organised eight coordination meetings to enable the cooperation with the Dutch authorities and support the operation against the OCG.Do not take the baitWith regard to this case, Belgian and Dutch authorities have issued specific warnings to citizens.Do not trust correspondence allegedly from banks stating that accounts need an urgent update.Do not trust messages that phone accounts have been locked and need an update.Be careful when buying goods via second-hand sites when sellers ask for an initial payment of EUR 0.001.Make sure URL links start with ‘https://’.What can you do if you click something?Use antivirus software on all your electronic devices.Ensure that your security software and operating systems are up-to-date.Set up unique passwords for all your online accounts.Think twice before clicking on any links and attachments as criminals could be trying to ‘phish’ or ‘smish’ you. If in doubt, do not click links, open attachments or reply and certainly do not give out any financial information.Authorities involved in the investigation:Belgium: Federal PPO (Federaal Parket); Investigating Judge Court of First Instance Antwerp, section Mechelen (Onderzoeksrechter van Rechtbank van Eerste Aanleg Antwerpen, sectie Mechelen); Federal Judicial Police East-Flanders (Federale Gerechtelijke Politie Oost-Vlaanderen)The Netherlands: PPO Rotterdam (Openbaar Ministerie Rotterdam); National Police (Nationale Politie – Eenheid Rotterdam)Agencies involved in the investigation:EuropolEurojust 

On 4 December 2024, an operation involving law enforcement and judicial authorities from France and Germany, coordinated by Europol and Eurojust, targeted a large criminal network involved in migrant smuggling activities across the English Channel. The French-led investigation focused on an Iraqi-Kurdish network suspected of illegally smuggling middle-Eastern and East African migrants from France to the United Kingdom using non-EU certified low-quality inflatable boats.Over 500 officers from the German Federal Police (Bundespolizei) raided several houses and storage spaces under search and arrest warrants issued by the French Court of Lille and executed under the supervision of the Public Prosecutor’s Office of Düsseldorf.Over 20 French investigators from French Border Police (OLTIM), one analyst from the German Criminal Police (BKA), and three Europol experts were deployed to the German regions of North Rhine-Westphalia and Baden-Wuerttemberg to support the operational activities on the ground. One British investigator was also present as an observer.The action day led to:13 arrests (8 arrests in Germany under French judicial order and 5 in France), including 1 High Value Target25 locations (15 houses and 10 storage places) searched in GermanySeizures of equipment include: 21 inflatable boats, 24 engines and 76 life vests, as well as over 600 inner tubes and 100 air pumpsOther seizures include: about EUR 70 000 in cash, gold valued at more than EUR 5 000 and over 40 electronic devicesThe investigation, initiated in 2024, uncovered that the suspects, Iraqi and Syrian nationals of Kurdish origin, were in Germany. Further investigation and information exchange that showed they organised the purchase and transportation of inflatable boats, which were unfit for the EU market, from Turkey through France to be stored in Germany.Migrant smuggling: a continuously deadly threatMigrant smuggling via small boats has steadily increased since 2019, overtaking lorries in 2021 as the most common method for smuggling migrants from the EU to the United Kingdom. However, enhanced law enforcement measures have led to a significant reduction in smuggling activities, with over 30 % fewer incidents and migrants smuggled in 2023 compared to 2022.However, the criminal networks involved remain highly active, increasingly violent, and exceptionally adaptive, regularly employing new techniques for crossings. In the first 11 months of 2024, around 34 000 migrants and 630 boats successfully reached the United Kingdom, compared to about 28 000 migrants and 580 boats during the same period in 2023. The loss of lives has also increased; in 2024 this criminal activity led to over 70 deaths at sea, compared to 12 over the same period in 2023. Therefore, law enforcement authorities have further increased their efforts in cross-border operations such as this one.Europol’s dedicated Taskforce to connect the dotsIn July 2022, the first Operational Taskforce (OTF) targeting migrant smuggling with small boats led to the dismantling of the then-largest network smuggling migrants from France to the United Kingdom via small boats. Following this, Europol set up a second OTF to target other criminal networks smuggling migrants across the English Channel, a criminal phenomenon putting migrants’ lives at great risk. This second OTF, coordinated by Europol, involves Belgium, France, Germany, the Netherlands and the United Kingdom.The Тaskforce targets the full chain of smuggling activities – from the recruitment of migrants through to logistical cells and up to the main organisers. Its investigative activities focus on High Value Targets, as the prosecution of these suspects is instrumental in dismantling criminal organisations as a whole. The dedicated Europol experts, who were fully involved in the work of the OTF, contributed to the identification of criminal connections between several national investigations.Europol has established a dedicated financial instrument to facilitate such high-profile investigations and support participating countries. Europol managed the overall coordination of investigative activities, while also organising operational meetings between the members of the Taskforce. During the action day, Europol facilitated the deployment of 20 investigators from the French Border Police (OLTIM) to several locations in Germany. In addition to these coordination activities, Europol deployed three Europol experts to the coordination centre in Cologne to assist the German authorities in cross-checking, in real time, operational information against Europol’s databases.Eurojust enables judicial cooperation to ensure compliance of legal proceduresEurojust enabled cross-border judicial cooperation through multiple means. Eurojust organised coordination meetings to compile and exchange existing information, to explore how to best cooperate without jeopardising each other's investigations, and to prepare for the joint action day. With the support of Eurojust National Desks, judicial authorities exchanged European Investigation Orders and European Arrest Warrants, and they carefully ensured that all legal instruments were in place to take action. During the action day, the agency set up a coordination centre to facilitate rapid cooperation between the judicial authorities, ensuring cohesion and preventing legal difficulties obstructing the work of officers on the ground.Law enforcement authorities involved in the action day:France – French Border Police (OLTIM-Office de lutte contre le trafic illicite de migrants)Germany – German Federal Police (Bundespolizei), German Criminal Police (Bundeskriminalamt)Judicial authorities involved in the action day:France: JIRS Lille (Interregional Specialised Jurisdiction) - Court of LilleGermany: Düsseldorf Public Prosecutor's Office (ZeOS), General Prosecutor’s Offices of Hamm, Cologne and Karlsruhe.For media inquiries:France: Court of Lille (Tribunal Judiciaire de Lille)+33 6 18 17 81 58; presse.pr.tj-lille@justice.frGermany:Bundespolizeidirektion Sankt Augustin | Presse- und Öffentlichkeitsarbeit+49 2241 238-5555 | Fax: +49 2241 238-1409presse.nrw@polizei.bund.deEurojust: media@eurojust.europa.eu – press line: 00 31 70 412 55 00Europol: 24/7 media line: +31 (0)70 302 5001; press@europol.europa.eu     

The investigation began in the autumn of 2022, following reports of fraudulent phone calls in which scammers impersonated bank employees to extract sensitive information, such as addresses and security answers, from victims. The stolen data was traced back to a specialised online marketplace that operated as a central hub for the trade of illegally obtained information.A central hub for cyber fraudThe marketplace allowed its thousands of users to buy stolen data sorted by region and account balance. This customisation enabled criminals to carry out targeted fraud with greater efficiency. Investigators also uncovered a network of fake online shops used to trick consumers into entering payment information, a method commonly referred to as phishing. The stolen credentials were then sold through the marketplace, generating significant profits for its operators.Cross-border crackdown on cyber fraud infrastructureOn 4 December, coordinated actions were carried across Europe. Searches were conducted in Germany and Austria, while infrastructure linked to the marketplace and fake shops was dismantled in Germany, Finland, the Netherlands and Norway.Law enforcement seized over 50 servers, securing more than 200 terabytes of digital evidence. The two main suspects – a 27-year-old and a 37-year-old – were arrested in Germany and Austria respectively under European arrest warrants and are currently in pretrial detention.Europol’s unique support to Member States’ investigationsEuropol has been closely involved in this investigation for over two years, providing a vital platform for cooperation and intelligence sharing between law enforcement agencies across Europe and beyond.Its European Cybercrime Centre (EC3) deployed its full range of resources and expertise, ensuring that every aspect of this complex operation was covered. Europol’s unique forensic capabilities played a pivotal role in advancing the case, offering tailored solutions to analyse and secure the complex digital evidence.In addition, Europol deployed a dedicated taskforce of data scientists who worked to process and interpret vast amounts of data, uncovering crucial connections. During the action day, three EC3 experts were deployed to Germany and Austria to assist the national authorities in their enforcement actions. The following authorities took part in the operation:Austria: State Office of Criminal Investigation (Landeskriminalamt)Czechia: Bureau of Criminal Police and Investigation Service, Regional Police Directorate of the Capital City of PragueFinland: National Bureau of Investigation (Keskusrikospoliisi)Germany: Hanover Police Department (Polizeidirektion Hannover), Verden Public Prosecutor’s Office (Staatsanwaltschaft Verden)The Netherlands: National Police (Politie)Poland: Central Cybercrime Bureau (Centralne Biuro Zwalczania Cyberprzestępczości) 

The signatures of these two legal instruments put into practice the Working Arrangement between Chile and Europol, which is in force since 1 May 2021. The SIENA Memorandum of Understanding will allow Chile to establish a connection with the Agency, permitting a secure exchange of sensitive information. A SIENA connection would enable law enforcement authorities from Chile to be connected with over 3 000 law enforcement agencies from over 70 countries and international entities, facilitating bilateral communication both with and without the involvement of Europol.The Liaison Officer Agreement allows the secondment of liaison officer(s) from Chile to Europol’s headquarters in The Hague, the Netherlands. Currently, Europol hosts a network of over 300 liaison officers from EU Member States, third countries and international organisations.Luis Cordero, Undersecretary of Chile's Ministry of the Interior and Public Security, said:These legal instruments are key to put into practice the Working Agreement and represent a decisive step in our strategy to combat organised crime and strengthen public security. The implementation of the secure communication channel will enable our police forces to act more swiftly and accurately, ensuring an effective response to transnational threats.Catherine De Bolle, Europol’s Executive Director, said:Europol celebrates a significant milestone in its partnership with Chile, marking a new chapter in our collective efforts to combat international crime threats. This achievement underscores the strength of our bilateral cooperation with Latin America. It also shows our shared commitment to enhancing security and efficiency in addressing global criminal challenges.Europol’s mission is to support EU Member States in preventing and combatting all forms of serious international and organised crime, cybercrime and terrorism. It serves as the centre for law enforcement cooperation, analytical expertise and criminal intelligence in Europe. 

MATRIX, a messaging service made by criminals for criminals, was first discovered by Dutch authorities on the phone of a criminal convicted for the murder of a Dutch journalist in 2021. A large-scale investigation into the messaging service was initiated. It was soon clear that the infrastructure of this platform was technically more complex than previous platforms such as Sky ECC and EncroChat. The founders were convinced that the service was superior and more secure than previous applications used by criminals. Users were only able to join the service if they received an invitation. The infrastructure to run MATRIX consisted of more than 40 servers in several countries with important servers found in France and Germany. Cooperation between the Dutch and French authorities started through a JIT set up at Eurojust. By using innovative technology, the authorities were able to intercept the messaging service and monitor the activity on the service for three months. More than 2.3 million messages in 33 languages were intercepted and deciphered during the investigation.The messages that were intercepted are linked to serious crimes such as international drug trafficking, arms trafficking, and money laundering. Actions to take down the service and pursue serious criminals happened on 3 December in four countries. In France, one suspect was arrested, and his house searched. In Spain, two suspects were arrested following a European Arrest Warrant from the Netherlands and six houses were searched. Six houses were searched in Lithuania. The main servers in France and Germany were taken down. Criminals using the messaging service are alerted to the interception by the authorities through a splash page. Through legal requests, authorities will now be able to access the messages for their investigations. The cross-border investigation into MATRIX is a clear example of the importance of international cooperation to fight serious organised crime. By working together in a JIT, Dutch and French authorities were able to exchange information and evidence swiftly and execute joint actions. To support investigations into the illegal activities enabled by this communication platform, an Operational Task Force (OTF) was established at Europol in June 2024 between the Netherlands, France, Lithuania, Italy and Spain. This taskforce played a key role in monitoring criminal activity on the platform. Europol's OTF will also provide assistance with independent follow-up investigations stemming from intelligence gathered during the live phase of the operation. German authorities supported the operation with their technical expertise. Spanish authorities have been working with their French and Dutch counterparts since the early stages of the investigations.  The encrypted communication landscape has become more fragmented following the takedown of several services such as Sky ECC, EncroChat, Exclu and Ghost. Criminals, in response to the disruptions of their messaging services, have been turning to a variety of less-established or custom-built communication tools that offer varying degrees of security and anonymity. While the new fragmented landscape poses challenges for law enforcement, the takedown of established communication channels, shows that authorities are on top of the latest technologies that criminals use.The following authorities were involved in the actions:France: JUNALCO National Jurisdiction against Organised Crime; OFAC National Police Cybercrime divisionNetherlands: Team High Tech Crime of the National Investigations; Special Operations (NIS) of the Netherlands Police; Netherlands Public Prosecution Service (National Office)Germany: Frankfurt am Main Public Prosecutor General's Office – ZIT; German Federal Criminal Police, Serious and Organised Crime Division Italy: National Antimafia Directorate (D.N.A.); Central Directorate for Anti Drug Services (D.C.S.A.)Lithuania: Prosecutor General’s Office; Lithuanian Criminal Police BureauSpain: Central investigative Court 1 and 5 of Audiencia Nacional; Invesigative Court 1 of Marbella; Spanish National Police 

In a long-term investigation supported by Europol, law enforcement authorities from Belgium, Colombia and Spain have dismantled a drug ring orchestrating large-scale cocaine trafficking from Colombia to the EU. The national authorities involved arrested 32 individuals in total, including the leader of the network. Law enforcement also seized 5.8 tonnes of cocaine in Colombia (Cartagena and Baranquilla) and on European soil in Spain (Barcelona and Valencia) and Belgium (Antwerp). The sting was coordinated by Europol’s Operational Taskforce.This operation follows the arrests of two high-profile Camorra fugitives, falling under different investigations, and which were made in October in Colombia. International cooperation established between Europol and strategic countries in South America, such as Colombia, has proven essential for the advancement of large-scale investigations and the dismantlement of criminal cartels smuggling tonnes of cocaine to Europe. This cooperation is a key element of successful law enforcement operations targeting drug trafficking and serious and organised crime networks, which impacts the security of citizens in the EU and beyond.  Results of the action day on 5 November 2024:6 arrests in Colombia (Baranquilla, Cartagena, Colombia Medellin and El Guamo);5 house searches; Seizure of cell phones and documents.Overall results of actions targeting this criminal network:32 arrests in Colombia and Spain (26 made in 2023);5.8 tonnes of cocaine seized in Belgium, Colombia and Spain;Seizures of assets including movable properties and real estates.Combatting corruption to cut off the logistical chain  The investigation, conducted under Europol’s Operational Taskforce targeting the large-scale cocaine trafficking from source countries in Latin America, was initiated in April 2023. The operational activities focused on identifying how the network operated and who was behind it. The analysis of operational information gathered during the seizures identified that most of the members of the criminal network were based in Spain and Colombia.On the action day this week, the Colombian National Police arrested individuals playing different major roles within the organisation. Among the six suspects are the alleged ringleader, investors, coordinators of the trafficking operations, corrupted authorities and workers along the logistical chain.  The investigation uncovered that the targeted drug cartel was capable of exporting significant amounts of cocaine through commercial vessels. The suspects used different maritime routes. They concealed cocaine inside containers and then shipped the cargo to European ports from several Colombian harbours, such as Cartagena and Barranquilla.Maritime trafficking and commercial vessels play a crucial role in the large-scale exportation of narcotics. The ring members collaborated with corrupted authorities to avoid police and custom controls during the different phases of the cocaine trafficking. Identifying and intercepting the corrupted officials was crucial in dismantling the full chain of command and logistical organisation of this cartel. Large-scale drug trafficking requires complex logistical organisation, drug cartels tend to corrupt authorities to facilitate drug trafficking along the different phases, from production to exportation.Europol’s support and Operational TaskforceDuring the investigative activities, Europol coordinated the exchange of information between national authorities, bringing them together to efficiently target the entire drug trafficking network. In addition, Europol provided continuous intelligence development and analysis to support investigators. This intelligence allowed law enforcement to uncover a full picture of the covert network operating across various countries and continents. Intelligence provided by Europol contributed to some of the seizures made during the course of these investigations. During the action days, Europol deployed experts to Colombia to provide analytical and technical support to officers in the field.Law enforcement authorities:Colombia: Colombian National Police (Policía Nacional de Colombia)Belgium: Belgium Federal Police (Federale Politie/Police Fédérale) Spain: Civil Guard (Guardia Civil) and National Police (Policia Nacional)

The investigation focused on several interlinked criminal groups that were smuggling migrants from the Indian sub-continent (India, Sri Lanka and Nepal) to Europe, the United Kingdom and North America. The smugglers facilitated migrants’ travel to the EU via Dubai or different African countries using unlawfully obtained tourist, work or medical visas. Migrants would be charged between EUR 15 000 and EUR 26 000 per person for the full smuggling service.The network is believed to have smuggled several thousand people to France since 2022, providing them with flight tickets, fake documents and other resources to facilitate their illegal travel. It is estimated that the groups generated several hundred million euros in illegal profits altogether. In 2024, French authorities arrested 26 suspects in total.  Overall results:26 arrestsSeizures including:real estate (9 houses and 4 shops) with a total value of EUR 3 432 00035 bank accounts holding over EUR 440 000 EUR 121 000 in cryptocurrencies 23 luxurious vehicles worth about EUR 752 000 gold and jewellery valued at over EUR 5 million 1 700 in restaurant vouchers machines for the production of jewellery estimated at EUR 500 000 EUR 350 000 in cashEUR 400 000 of building materialFollowing the moneyLaw enforcement and judicial authorities focused heavily on the financial aspects of this case. They uncovered that the smuggling network laundered their criminal assets in multiple ways: through shell companies, hawala, and the trafficking of gold. The network also used restaurant tickets, a system of lunch bonuses for employees widely adopted in France, for money laundering. The first action day on 12 March 2024 led to the arrest of 13 suspected smugglers and 6 financial brokers. The latter were part of a hawala network suspected to have transferred annually over EUR 50 million in criminal assets for the migrant smuggling network.  During the second action day on 25 June 2024, the French law enforcement authorities targeted two illegal gold brokers turning over EUR 5 million per year. Following these actions, a Tamil priest, who was part of the network, took over the activities of the arrested hawala brokers and used the temple for the recovery of money from migrant smuggling. He was arrested on 12 November 2024, charged, and subsequently remanded in custody.Later that month, 4 other individuals were detained for laundering over EUR 200 million through the use of public works companies. Using a legitimate company as a front, the network used its ‘cleaned’ assets to expand its activities, while also employing irregular migrants and paying them significantly less than the regular salaries for the sector.  

The investigation was led by the German authorities with the support of the Netherlands and Europol. Over the past few months, the authorities involved joined forces within the framework of an Operational Taskforce (OTF) set up at Europol to gather intelligence and coordinate the operational activities. On 23 November, a 57-year-old Turkish citizen was arrested in Albania. Residential and business properties linked to the suspect and his girlfriend were searched in Rotterdam, the Netherlands. The suspect, one of Europol’s high-value targets, is suspected of heading a criminal network responsible for the large-scale import of heroin into Western Europe. The investigation was able to link the suspect to the seizure of 703 kilos of heroin in the port of Hamburg in Germany on 30 August 2022. The heroin was hidden in a container shipment of soap originating from Iran.A single dose of a two-digit milligram consumption unit of heroin can be fatal to the consumer. The suspect is now awaiting his extradition to Germany.Europol’s supportEuropol has supported this investigation since April 2022 with continuous intelligence development and the coordination of the operational strategy between all the countries involved.An Operational Taskforce was launched at Europol in August 2023. This Taskforce is the result of law enforcement heightened understanding of heroin trafficking in Europe, based on this case and other further developed and supported in the framework of Europol’s analysis work into encrypted criminal communications.While cocaine is grabbing the headlines, heroin trafficking is still an attractive venture for criminals. The OTF aims to identify and disrupt the ‘control and command’ of heroin supply and targets criminal networks, in the EU and beyond, that are behind multi-tonne shipments of heroin to the EU.Authorities involved in this investigationGermany: Federal Criminal Police Office (Bundeskriminalamt) and Prosecutors Office in Dresden/GermanyNetherlands: Netherlands Police - National Investigations and Special Operations Unit and Netherlands Public Prosecutors Service – National Public Prosecutor’s Office.Albania: Border PoliceEuropol: European Serious Organised Crime Centre 

The Working Arrangement provides a legal framework for the negotiation of related implementing agreements, such as the SIENA Memorandum of Understanding or the Liaison Agreement. If established, a SIENA connection would allow law enforcement authorities from Singapore to be connected with over 3 000 law enforcement agencies from over 70 countries, facilitating both bilateral communication with or without the involvement of Europol. A Liaison Agreement would allow the secondment of liaison officer(s) from Singapore to Europol’s headquarters in The Hague, the Netherlands. Currently, Europol hosts a network of over 300 liaison officers from EU Member States, third countries and international organisations.Mr Ngiam Shih Chun, Deputy Secretary (Policy) of the Ministry of Home Affairs, Singapore, said:The Working Arrangement signed today between Europol and the Ministry of Home Affairs demonstrates our shared commitment to strengthening cooperation. Recognising that safeguarding the safety and security of our citizens requires a coordinated global approach, this Arrangement marks the first step in paving the way for regular and systematic collaboration between Europol and the law enforcement authorities in Singapore and cements our strategic partnership in confronting common security challenges.Ms Catherine De Bolle, Executive Director of Europol, said:In an increasingly globalised world, the security of the European Union begins beyond its borders. Security challenges have become more complex and multidimensional. Today, there is a strong link between events outside the EU and security within Europe. The Working Arrangement signed today between Singapore and Europol underscores the interconnected nature of modern security threats and highlights the importance of international cooperation in addressing them effectively. By partnering with Singapore, Europol reinforces the European Union's commitment to proactive and comprehensive security measures.Europol’s mission is to support EU Member States in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism. It serves as the centre for law enforcement cooperation, analytical expertise and criminal intelligence in Europe.Image courtesy of the Ministry of Home Affairs, Singapore.

The investigation revealed that the criminal network used the same modus operandi and, in part, also the same organisation and infrastructure as the perpetrators previously investigated under Operation Admiral. Announced in November 2022, the investigation is considered the largest VAT fraud ever uncovered in the EU, with damages now estimated at EUR 2.9 billion.The EPPO established links between individuals and companies investigated in Operation Admiral and suspects based in the Baltic states. Members of this criminal network carried out a massive VAT carousel fraud, which is a complex criminal scheme that takes advantage of EU rules on cross-border transactions between its Member States, as these are exempt from VAT.Fraudulent chain of deceptionAccording to the investigation, the suspects established companies in 15 EU Member States, which acted as legitimate suppliers of electronic goods. They sold over EUR 1.48 billion worth of popular electronic devices via online marketplaces to end customers in the EU. Although the end customers paid VAT on their purchases, the selling companies failed to fulfil their tax obligations. By disappearing, they avoided paying the amounts owed to the respective national tax authorities. Other companies in the fraudulent chain would subsequently claim VAT reimbursement from these national tax authorities, resulting in an estimated VAT loss of EUR 297 million. The proceeds of this criminal activity were then transferred to offshore accounts.Poly-criminal and international criminal networkThe EPPO suspects that over 400 companies are involved in this complex fraudulent scheme, which is also believed to have been used to launder proceeds stemming from drug trafficking, different types of cybercrime and investment fraud.The investigation also uncovered a possible Russian organised crime connection, indicating that certain Russian criminal networks may have been involved in this network. Evidence suggests that these groups injected assets into the criminal operation in exchange for periodic payments and exerted influence over certain aspects of its management.Cross-border actionThis week’s international action led by the EPPO resulted in more than 300 searches in 16 countries and 36 arrests in Latvia and Lithuania. In Latvia alone, over 200 Customs and Tax Police, State Police and Corruption Prevention and Combating Bureau investigators and criminal intelligence officers supported the investigative measures. Europol supported this investigation by providing analytical support in the run-up to the action day by deploying four forensic experts and a specialist with a mobile office. The specialist carried out cross-checks, provided expertise, and coordinated and monitored the Virtual Command Post accounts created for the field investigators involved in the searches. With the support of Europol and national law enforcement authorities, the EPPO connected the dots between organised crime networks and implemented a coordinated investigative strategy to dismantle this complex web of fraud.Participating countries:Austria, Belgium, Bulgaria, Cyprus, Czechia, Estonia, France, Germany, Italy, Latvia, Lithuania, Luxembourg, Poland, the Netherlands, Slovakia, SpainParticipating agencies and EU bodies:Europol, Eurojust, EPPO 

Results of the operation include:102 suspects identified11 people arrestedOver 112 house searches conductedAt least 29 servers seized100 domains taken down270 IPTV equipment/devices seizedOver 560 resellers identifiedVarious drugs and weapons seizedAround EUR 1.6 million in cryptocurrency and EUR 40,000 in cash seizedEuropol supported this international case since its inception by organising several virtual meetings and hosting an operational meeting at the Europol Headquarters in The Hague. During the investigation phase, Europol analysed the available intelligence, provided cross-match reports and coordinated the next steps with Eurojust. Collaboration between authorities was set up at Eurojust to take down the streaming service. On the action day, Europol experts were deployed to Croatia, Italy and the United Kingdom with mobile offices and to provide forensic support.Participating countries:Bulgaria, Croatia, France, Germany, Italy, the Netherlands, Romania, Sweden, Switzerland, United KingdomParticipating agencies:Europol, Eurojust, Audiovisual Anti-Piracy Alliance (AAPA), @ON Network 

The cocaine traffickers targeted in this investigation used different maritime routes and modus operandi. The criminal network is connected to a seizure of over half a tonne of cocaine, with a street value of a EUR 50 million, at the port of Ploče in southern Croatia in late March 2021. The drugs were concealed in a modified cargo container floor. This seizure is a further indication that international drug trafficking organisations are increasingly targeting smaller EU ports.EUR 1 million in cash seized and 18 under investigationOn the action day on 26 November 2024, law enforcement authorities arrested 11 suspects (2 in Bosnia and Herzegovina, 1 in Croatia and 8 in Serbia). One of them is a high-value target. During the house searches, law enforcement officers seized weapons and a large amount of ammunition, as well as several expensive vehicles, watches and over EUR 1 million in cash. Four other individuals under investigation for belonging to this network are already in imprisoned. International Arrest Warrants have been issued for three others.The criminal network bribed several corrupt customs’ officer to avoid police and customs controls during the logistical phase of the export. One corrupt customs officer was arrested during the operation. The other arrests were of members of the criminal network who played different roles in the organisation. Some of them led different criminal cells, while others either financed the activities or coordinated and arranged the logistics. One of the suspects, a high-value target arrested in Serbia, was already wanted by an EU Member State. He was involved in a million-euro theft as part of the notorious Pink Panther group. Both the theft and his escape from prison after his conviction date back to the early 2000s.Intelligence developments following the takedown of Sky ECCThis investigation is a follow-up to a previous operation against a connected criminal network. These cross-border operations are the result of intelligence developments following the takedown in March 2021 of the encrypted communications platform Sky ECC.In cooperation with France, Belgium and the Netherlands, and with the support of Europol’s Drugs Unit, Serbia was able to identify the key targets on its territory and map their criminal activities across the world. This criminal organisation is believed to be linked to a large-scale criminal network importing multi-tonne shipments of cocaine from Colombia through Brazil and Ecuador.Europol’s Operational TaskforceThe recent takedown of three encrypted communication tools used by criminals – EncroChat, Sky ECC and Anom – revealed the prevalence of Balkan criminals in the global cocaine trade and related organised crime activities. Europol responded to this threat by creating an Operational Taskforce, consisting of countries inside and outside the EU, to effectively combat the threat emanating from criminal networks with ties to this region. This action day is a result of this Operational Taskforce, which is ongoing….The following authorities took part in this action:  Bosnia and Herzegovina – State Investigation and Protection Agency (SIPA)Croatia - Criminal Police Service of the Dubrovnik-Neretva Police Department and Drug Enforcement Department (SKD, PNUSKOK)Serbia: Criminal Police Investigations Directorate (Управа криминалистичке полиције)

The operation, supported by Europol, was launched after the analysis of encrypted communications from the SKY ECC communication platform revealed extensive evidence of corrupt practices, including organised and serious crimes. The suspects are alleged to have played key roles in enabling and shielding the activities of a violent Albanian criminal group importing cocaine from South America to Europe. The proceeds from these criminal activities were laundered in Albania, where numerous properties and assets linked to the criminal network were identified and seized.The former judge and lawyer are accused of manipulating judicial proceedings in favour of the criminal organisation, while the police officer is suspected of leaking sensitive operational information. Two journalists are believed to have exploited their position to disseminate disinformation, influencing public opinionand undermining investigations into the criminal network.The criminal organisation, centred around a family clan, originates from the city of Elbasan in Albania. Its members are notorious for employing extreme violence against rivals, including orchestrating sniper attacks and murders both within Albania and internationally.During the investigation, two significant drug seizures were linked to the network: approximately 450 kilograms of cocaine intercepted in the Netherlands and a further 900 kilograms seized in Ecuador.Europol has played a pivotal role in this investigation, leveraging its analytical and operational capabilities to support the Albanian authorities in their corruption probe beyond the core organised crime investigation. In coordination with the Belgian, Dutch and French authorities, Europol delivered intelligence packages from SKY ECC communications to Albanian authorities and conducted in-depth analysis to uncover links to other EU investigations.On the action day, Europol deployed a specialist to Albania’s capital, Tirana, to assist with international coordination, while analysts at its headquarters provided live data cross-checks to support ongoing operations.The following authorities took part in the investigation: Albania: Special Prosecution Office for Anticorruption and Organised Crime (SPAK), National Bureau of Investigation (Byroja Kombëtare e Hetimit), with the support of the State Police (Policia e Shtetit)Belgium: Federal Judicial Police (Police Judiciaire Fédérale/Federale Gerechtelijke Politie)France: National Police (Police Nationale) Italy: State Police (Polizia di Stato)The Netherlands: National Police (Politie)  

The man was arrested in Poland while transporting weapon kits that he had purchased in Austria. A subsequent search of the suspect’s home and a nearby forest carried out by Polish investigators uncovered dozens of illegally-held weapons including pistols, rifles, revolvers and automatic weapons such as Škorpions, as well as over 80 essential weapon parts and more than 20 000 pieces of ammunition. They were all hidden in barrels buried underground.Weapons purchased in parts kits…The suspect, a Polish national, had previously worked as a licensed firearms dealer. This gave him expertise regarding firearms laws in Europe, including a loophole regarding weapons parts kits in Austria, which in turn supported his illegal activities. After buying weapons parts kits in Austria, investigators believe the suspect sent some parts to Poland, and smuggled the rest into Poland himself. Once in Poland, he manufactured the weapons before trafficking them.…and sold for violent crime across the EUFurther investigation proved that the suspect had indeed sold dozens of illegal weapons, including automatic guns and pistols, to criminal networks operating in Germany and Poland. This led to the suspect being designated a high-value target by the authorities.Thanks to international cooperation and exchanging intelligence, Swedish investigators discovered that a violent gang was using weapons sold by the suspect to carry out contract killings. Moreover, authorities established that firearms previously seized in Belgium, Germany, Lithuania and Sweden could be attributed to the suspect.Europol’s roleThe suspect initially came to authorities’ attention after Europol shared intelligence with Austrian authorities concerning an individual who was buying large amounts of weapon kits in Austria. This led Austrian police to begin surveillance of the suspect, while a separate weapons trafficking investigation was opened in Poland. Europol then coordinated operational meetings with the participating authorities and provided analysis of the data received from the Member States, together with real-time cross-checks. Two weapons experts from Europol were deployed to Poland to assist with technical assessment of the seized weapons. The nature of these cases requires law enforcement to act quickly before any weapons can be moved, disposed of, or used. In this particular case, the fast initiation of the coordination by Europol and the agile exchange of information between the authorities involved were key to success.Europol’s strategic prioritiesEuropol is increasing its operational impact by delivering agile operation support to Member States and contributing further in priority investigations against High Value Targets, such as the suspect arrested in this operation. Also, one of Europol’s priorities is to bring relevant partners together for cross-border cooperation and joint action. This includes Member States, Schengen associated countries and non-EU countries, together with the EU Agencies in the area of Justice and Home Affairs (JHA). Through this approach, Europol aims to strengthen and enhance the fight against all forms of serious international and organised crime, cybercrime and terrorism.Participating authorities:Austria:Directorate State Protection and Intelligence Service (Direktion Staatsschutz und Nachrichtendienst, DSN)Public Prosecutor’s Office in Korneuburg (Staatsanwaltschaft Korneuburg) Czechia:National Counter Terrorism, Extremism and Cybercrime Agency (Národní centrála proti terorismu, extremismu a kybernetické kriminalitě, SKPV) Germany:Federal Criminal Police Office (Bundeskriminalamt, BKA)Attorney General’s Office in Hamm (Generalstaatsanwaltschaft Hamm) Poland:Central Investigation Bureau of Police (Centralne Biuro Śledcze Policji, CBSP)Department of Organized Crime and Corruption of the National Prosecutor's Office in Wrocław (Dolnośląski Wydział Zamiejscowy Departamentu ds. Przestępczości Zorganizowanej i Korupcji Prokuratury Krajowej we Wrocławiu, DWZPZiK) Sweden:National Prosecution Service (Nationella åklagaravdelningen, Riksenheten mot internationell och organiserad brottslighet (RIO))Swedish Customs (Tullverket)Swedish Police (Polismyndigheten)Participating agencies:Europol, Eurojust. 

An EU-wide operation, led by Germany, resulted in the takedown of a large criminal network involved in migrant smuggling, weapons trafficking and document fraud along the so-called Balkan route. The investigation was conducted within the framework of a Europol Operational Taskforce, made up of authorities from Austria, Bosnia and Herzegovina, Germany, the Netherlands, Poland, Serbia, the United Kingdom and other European countries. Over 450 officers were deployed on the ground during the action day. Two experts from Europol’s European Migrant Smuggling Centre supported the operation on the ground in Germany. A Joint Investigation Team, set up by Eurojust, facilitated the judicial cooperation between the countries.The action day on 20 November led to:25 arrests in total (6 in Austria 3 in Bosnia and Herzegovina, 4 in Germany, 5 in Poland, 6 in Serbia, 1 in the United Kingdom);3 High-Value Targets among the arrested. One of them, an Iraqi citizen, suspected leader of a connected smuggling network, was arrested in the United Kingdom following a European Arrest Warrant issued by Poland.31 locations searched (7 in Austria 3 in Bosnia and Herzegovina, 9 in Germany, 1 in the Netherlands (Eindhoven), 5 in Poland, 5 in Serbia, 1 in the United Kingdom);Seizures including: vehicles, electronic equipment and cash.Violence and deaths along the EU borderThe investigation targeted an organised criminal group that was allegedly active since 2021. The criminal network, spread across 20 countries, subcontracted local criminal groups to provide services such as transport and accommodation for their migrant smuggling operation. Composed mainly of Syrian nationals, the criminal network facilitated migrants’ movements from their country of origin to the EU via the so-called Balkan route and the Eastern European route. The final destinations of the irregular migrants, mainly Syrians, were predominantly Germany, the Netherlands and the UK. The criminal network was particularly violent towards the migrants in their care, and was similarly violent in defending its criminal market share from other criminal actors active along the smuggling routes. One journey orchestrated by the network led to the death of two female Syrian migrants in Latvia. This highly sophisticated and dangerous criminal network is also involved in other criminal activities such as money laundering and violent crimes.Over EUR 3.4 million in illegal profitsThe criminal network charged between EUR 4 500 and EUR 12 000, depending on the smuggling service and route. Both the migrants and the smugglers used a hawala operator in Türkiye for money transfers. This main hawala office collaborated with other hawaladars and offices across Europe. The international exchange of operational information linked the smuggling in 2024 of 750 migrants to this criminal network. These criminal activities were connected to 120 investigations. However, additional information from other investigations indicates that this network may have smuggled as many as 2 200 migrants to Germany alone during the time it operated. In total, investigators estimate that the smugglers earned over EUR 3.4 million in illegal profits.Dedicated Europol TaskforceIn April 2024, Europol established an Operational Taskforce in collaboration with Austria, Bosnia and Herzegovina, Germany, the Netherlands, Poland, Serbia, the United Kingdom and other European countries. The information exchanged within this Taskforce, facilitated by Europol, revealed the dynamic operations of the investigated criminal network. Europol’s experts analysed this information, and the international exchange helped clarify the structure of the criminal activities and identify the actors involved in smuggling and the financial activities linked to the network.In 2023, German authorities requested Eurojust to enable contacts with all other countries involved and assist with setting up a Joint Investigation Team, between Germany, Poland, Bosnia and Herzegovina and Serbia, with Austria as an operational partner. The Agency furthermore organised a coordination centre at its premises to support the action day and direct contacts between all authorities on the ground.

Operating under these false pretences, the 57-year-old suspect persuaded numerous investors to entrust him with funds, promising to channel their money into profitable projects. However, investigations have revealed that no such reinvestments occurred. Instead, the suspect allegedly established a complex network of opaque companies and foreign bank accounts to misappropriate the funds, which he used to finance his lavish personal lifestyle.On 17 April 2024, a European Arrest Warrant and an International Arrest Warrant were issued for the suspect.Authorities urge anyone with information, no matter how minor it may seem, to come forward. Tips can be submitted anonymously via the EU Most Wanted website.About EU Most WantedThe EU Most Wanted platform, managed by the European Network of Fugitive Active Search Teams (ENFAST) in collaboration with Europol, publicises Europe’s most sought-after fugitives.The website has a proven track record, with anonymous tips directly leading to multiple arrests. Since its launch in January 2016:454 fugitive profiles have been published;163 fugitives have been apprehended;53 arrests occurred directly due to profiles published on the platform.Fugitive profiles are regularly updated by participating countries.

The investigation, led by the EPPO offices in Milan and Palermo, targeted an organised crime network spanning multiple EU Member States and non-EU countries.Pan-European action dayThe action day mobilised law enforcement across Europe with 160 searches carried out in more than 10 countries. Investigative measures are ongoing in several EU countries, including Bulgaria, Croatia, Cyprus, Czechia, Italy, Luxembourg, the Netherlands, Slovakia, Spain, as well as in non-EU countries.A total of 200 individuals are being investigated, with more than 400 companies involved.A freezing order of over €520 million is in execution to compensate the damage to the EU and the national budgets. In Italy alone, 129 bank accounts are being frozen, and 192 real estate properties have been seized, together with 44 luxury cars and boats. Mafia connections and money launderingThe suspects are believed to have orchestrated a sophisticated value added tax (VAT) carousel fraud, primarily involving electronic goods such as wireless earphones and laptops.A number of the suspects have links to several mafia clans. Mafia methods also seem to have been used to settle conflicts that arose within the criminal syndicate between the members of the different criminal organisations.    VAT carousel fraud takes advantage of EU rules on cross-border transactions between its Member States, as these are exempt from VAT. Based on the evidence gathered by law enforcement, the suspects established companies in Italy and other EU Member States, as well as in non-EU countries. This enabled them to trade the goods through a fraudulent chain of missing traders – who would then vanish without fulfilling their tax obligations. Other companies in the fraudulent chain would subsequently claim VAT reimbursements from the national tax authorities.The investigation was conducted by the Italian Financial Police of Varese (Guardia di Finanza di Varese) and the Italian State Police (Squadra Mobile di Palermo and Servizio Centrale Operativo), under the supervision of the EPPO. The Italian Financial Police of Milano and Palermo also contributed to the investigation.International law enforcement cooperationIn support of the EPPO in its investigation and action day, Europol provided a range of operational services. The Agency conducted comprehensive analytical support, cross-referencing the dataset to help identify connections. Europol also facilitated access to Passenger Name Record (PNR) information on more than 45 targeted individuals to enhance travel intelligence.To support real-time coordination on the ground, Europol set up a Virtual Command Post (VCP) to coordinate the field officers conducting the searches. A Europol specialist was deployed to the Operations Command Centre in Palermo, equipped with a mobile office to conduct crosschecks and manage VCP communications throughout the operation. Europol further coordinated with the European Network of Fugitive Active Search Teams (ENFAST) to aid in locating suspects targeted for arrest.The action day was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats. List of the main national authorities involved:Italian Financial Guard (Guardia di Finanza)Italian State Police (Polizia di Stato) Spanish National Police (Policía Nacional)Czechia Police (Policie České republiky)Luxembourg Judicial Police Service (Service de Police judiciaire)Slovakia Police Corps (Policajný zbor) The Fiscal Information and Investigation Service of the Netherlands (FIOD)Bulgaria National Investigation Service Croatia Police (Ministarstvo unutarnjih poslova)

Both the LIBE Committee and the JPSG play a crucial role in supporting Europol’s work, acting as key partners in ensuring the Agency’s accountability, transparency, and alignment with EU legislative priorities. The meeting yesterday also included the European Data Protection Supervisor (EDPS) Wojciech Wiewiórowski and Europol’s Fundamental Rights Officer Dirk Allaerts.Strategic frameworkIn her opening remarks, Europol’s Executive Director welcomed the new delegation and praised the European Commission’s new political guidelines featuring a stronger role for Europol. “Europol fully supports the new Commission in its vision to further develop the Agency, allowing us to increase our operational impact and better serve the Member States,” she said. She highlighted the importance of new resources and frameworks to enable Europol to fulfil its enhanced mission.The Executive Director also presented the Multiannual Programming Document 2025-2027, which was transmitted to the JPSG earlier this year. The document provides a comprehensive roadmap for implementing Europol’s new strategy, Delivering Security in Partnership. Updates included the recent launch of Europol’s External Relations Strategy 2025+ and discussions on closer collaborations with Schengen Associated Countries.Data protection and technological innovationWith the growing role of data-driven policing, she described the Agency’s progress on data security, in close coordination with the EDPS to ensure high standards of data protection. Europol has so far implemented 83% of the EDPS's recommendations and continues to advance secure data processing for operational needs.One of the major developments is the preparation of an operational “Sandbox” by early 2025, aimed at securely processing operational data for the purposes of research and innovation.Operational achievements and future outlookThe Executive Director also provided an overview of Europol’s expanding external partnerships. She highlighted how collaborations with countries and regions such as the Western Balkans, Eastern Partnership, MENA region, and Latin America have become crucial to effectively fight organised crime and terrorism.Europol’s latest report, Decoding the Criminal Networks Active in the EU, was discussed, noting that the Agency had analysed over 800 criminal networks, involving 25,000 members across multiple crime areas and jurisdictions. The report will be updated every two years and its findings have already enhanced information-sharing among Member States.The participants also received a dedicated presentation by Jean-Philippe Lecouffe, Deputy Executive Director for Operations at Europol, on the most recent Europol activities in the wake of the war in Ukraine and the current level of terrorist threat across the EU.In her closing remarks, the Executive Director outlined the challenges ahead, from digital transformation to resourcing. “Lawful access to data, coupled with sophisticated analytical capabilities, will be essential to Europol’s future role in European security,” she noted, expressing on the same occasion Europol’s commitment to working with Commissioner-designate Brunner to bolster EU security.The (JPSG) plays a key role in overseeing Europol’s activities, ensuring accountability and transparency in the Agency's operations. The JPSG is composed of Members of the European Parliament (MEPs) from the LIBE Committee, and its mandate includes scrutinizing Europol’s actions in alignment with EU law and fundamental rights. By reviewing the Agency’s operational and strategic developments, including its budget and work programmes, the JPSG holds Europol to high standards of governance. The JPSG also serves as a vital channel for fostering dialogue between Europol and the European Parliament, enabling informed discussions on future priorities and the Agency’s evolving role in the security landscape. 

Data gathered from recent investigations shows that minors are involved in almost all criminal markets.While the recruitment of minors into serious organised crime and terrorism is not new, in recent years it has evolved into a deliberate tactic by criminal networks to evade detection, arrest, or prosecution. The practice has expanded across multiple countries and recruitment methods have shifted, with minors increasingly tasked with violent activities including extortion and murder.Europol’s notification warns that criminal networks now commonly exploit minors by using coded messaging, slang, and even ‘gamification’ tactics to frame criminal tasks as challenges or games. These techniques are designed to draw young people into criminal activity, often making it appear financially attractive or socially rewarding. Social media platforms with encrypted messaging feature are abused by criminals so that they can operate with minimal visibility, enabling interactions that leave no digital trace and therefore reducing the risk of detection.

In a rapidly changing online environment, law enforcement and judicial authorities need support to cope with the complexity and volume of information and to develop their knowledge when obtaining electronic data from service providers based in other jurisdictions. The SIRIUS project, co-implemented by Europol and Eurojust, supports investigators with a variety of services, such as guidelines, trainings and tools, to help with accessing data held by the industry. These services are available to law enforcement and judicial authorities via the SIRIUS restricted platform and mobile application.This year’s conference included a 3-day programme, with the third day reserved for law enforcement and judicial authorities. Attendees benefited from interactive workshops, networking opportunities, and presentations on pressing topics in the field. Presentations included an update on the state of play of the EU Electronic Evidence Regulation from the European Commission followed by insights from government judiciary and service provider representatives. The SIRIUS team gave an overview into the upcoming ‘SIRIUS EU Electronic Evidence Situation Report 2024’, the upcoming UN and Budapest Conventions on Cybercrime was presented offering future opportunities for international cooperation. Workshops explored topics such as audio deep fakes, lawful access to data, the EU AI Act and future AI-related challenges, and digital asset seizures for evidentiary purposes.The SIRIUS project is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence. To this day, SIRIUS serves a community of competent authorities from over 50 countries, representing all EU Member States and a growing number of third countries. Building on its existing expertise and resources on the legal instruments currently in force, SIRIUS will assist law enforcement, judicial authorities and service providers in navigating the increasingly complex legal framework during the third phase of the project, starting next year. The SIRIUS project has received funding from the European Commission’s Service for Foreign Policy Instruments (FPI) under contribution agreement No PI/2020/417-500. 

The criminal network was active in the wholesale distribution of drugs in the EU. The illicit drugs were hidden in containers with exotic fruits on vessels arriving in European ports from South America. On arrival, recovery teams would remove the drugs from the containers and sell them to other criminal networks. The value of the drugs seized during the operation is estimated at EUR 70 million.Since the start of the investigation in November 2021 and leading up to the action day, some members had been arrested while actively committing crimes. During the same timeframe, over 2 000 kg of cocaine, 20 kg of marijuana, and 46 kg of hashish have been seized. Drug shipments would come from South America to the EU, where the criminal network’s local cells would collect and distribute them. To launder the illicit proceeds, the criminals had set up an elaborate money laundering system.Europol’s crucial contributionEuropol’s money laundering experts supported this international investigation since day one. Cross-referencing the data provided by the national investigators, a case specialist and an analyst found a link between ongoing investigations, thus completing the intelligence picture. This allowed for an operational meeting to be launched, which resulted in the action day conducted on 5 November 2024. Apart from deploying a money laundering specialist to the coordination centre established by Eurojust, Europol also provided financial support for two Italian investigators travelling to Albania for the action day.Participating authorities:Albania:Albanian State Police - Policia e Shtetit ShqiptarSpecial Anti-Corruption and Anti-Organised Crime Structure (Struktura e Posaçme Kundër Korrupsionit dhe Krimit të Organizuar)Italy:Guardia di Finanza PisaGuardia di Finanza Central Service against organised crime (Servizio centrale di investigazione sulla criminalità organizzata)Guardia di Finanza Naval Station Livorno (Reparto Operativo Aeronavale - Sezione Operativa Navale Livorno)Public Prosecutor’s Office Florence (Avvocato distrettuale dello Stato di Firenze)Italian Central Directorate for Anti-Drug Services (Direzione Centrale per i Servizi Antidroga)Italian Embassy in Tirana (Ambasciata d'Italia Tirana)Central Service for International Police Cooperation (Servizio per la Cooperazione Internazionale di Polizia)France:Lyon Judicial Police – OFAST Lyon (Police judiciaire de Lyon – Office anti-stupéfiants Lyon)Judicial Court of Lyon – JIRS Lyon (Tribunal Judiciaire de Lyon – JIRS Juridiction inter-régionale spécialisée de Lyon)Spain:Public Prosecutor Specialised Unit in International Cooperation of Tarragona (Fiscalía Unidad Especializada en Cooperación Internacional de Tarragona)Investigative Court no. 6 of Tarragona (Juzgado de Instrucción núm. 6 de Tarragona)Romania:Directorate for Investigation of Organised Crime and Terrorism – Covasna Local Bureau; Covasna Organised Crime Fighting Police Service (Directia de Investigare a Criminalitatii Organizate si Terorism - Biroul Local Covasna, Serviciul de Combatere a Criminalitatii Organizate)Participating agencies:Europol, Eurojust

German investigators had an initial breakthrough with the arrest and detention of two Romanian nationals following a series of break-ins in bakeries in Wallersdorf. Over the course of the investigation conducted by the Landshut Criminal Investigation Department, evidence emerged that one of the suspects, with the help of one other accomplice, was involved in the break-in at the Wallersdorf logistics company. The investigation also yielded concrete information on the whereabouts of the stolen vehicle parts in Bulgaria, upon which the Landshut investigators contacted Europol.Europol was responsible for facilitating the information exchange between German and Bulgarian law enforcement, and arranged a meeting to prepare the action day. In addition to deploying a specialist to Bulgaria to perform cross checks on the spot, Europol also financed the deployment of German law enforcement officers. Eurojust facilitated the judicial cooperation between the involved authorities. On 15 October 2024, officers from the Landshut Criminal Investigation Department, a representative of the Landshut Public Prosecutor's Office and a Europol specialist participated in the raid conducted by the Bulgarian authorities, where almost all of the stolen car parts were recovered.Participating authorities:Bulgaria:General Directorate National Police (Главна Дирекция "Национална Полиция")Prosecutor's Office Sofia (Софийска градска прокуратура)Germany:Landshut Criminal Investigation Department (Kriminalpolizeiinspektion Landshut)Landshut Public Prosecutor's Office (Staatsanwaltschaft Landshut) 

During the operational phase, 174 parcels containing counterfeit currency were seized, triggering 144 new police investigations into the criminal networks responsible. A total of 148 130 counterfeit items were intercepted, including 134 949 euro banknotes and coins, 9 186 British pounds, and 3 595 US dollars.The vast majority of the seized items were altered-design banknotes, often referred to as ‘movie money’. These reproductions have a similar shape and colour to real banknotes, but include a small disclaimer indicating they are fakes. However, these disclaimers are often overlooked, allowing criminals to pass them off as genuine currency.The most frequently seized denominations were the EUR 50 banknote, followed by the EUR 20 one.The success of Operation DECOY was built on close cooperation between customs and police agencies. Criminal organisations frequently exploit the differences between enforcement authorities, particularly when using postal services to distribute counterfeit currency. Customs officers were pivotal in detecting counterfeit banknotes and coins, while police forces conducted the necessary investigations to track down the perpetrators.This collaborative approach ensured that counterfeit currency was intercepted at key points of entry, and extensive investigations were launched to pursue the organised crime groups operating behind the scenes.The operation saw participation from Austria, Bulgaria, Croatia, the Czech Republic, France, Germany, Greece, Ireland, Italy, the Netherlands, Poland, Portugal, Romania, Serbia, Spain, Türkiye, the United Kingdom, and the United States.Europol and OLAF supported the operation by facilitating intelligence-sharing, helping to detect suspect parcels, and refining risk indicators for future efforts to combat counterfeit currency distribution.

The first fugitive, a senior cocaine broker linked to the Camorra syndicate, was apprehended in Medellin, Colombia, on 8 October. Having been in hiding for years, he was wanted on an Italian arrest warrant for his leading role in international drug trafficking operations spanning South America and Europe.The second fugitive, a high-ranking Camorra member, was arrested on 24 October, also in Medellin. Having been on the run since December 2020, he was included in the list of dangerous fugitives of the Italian Ministry of Interior, and had an existing 18-year prison sentence for international drugs trafficking, adding to the urgency of his arrest.As members of a prominent criminal network, the suspects were involved in large-scale drug trafficking operations from South America to Europe, primarily targeting th e port of Antwerp, Belgium, where their organisation had a strong presence. The criminal network specialised in smuggling vast quantities of cocaine by concealing narcotics within maritime cargo, often with the help of front companies, particularly within the fruit industry.Europol initiated the multi-agency operation by disseminating critical intelligence, including details on the fugitives’ hiding places, multiple addresses, hotels, and counterfeit identification documents. Europol also provided intelligence on the criminal network itself, with information such as members’ roles in drug trafficking. This was further enriched by Italian authorities, enabling Colombian law enforcement to track down and capture the fugitives. Officers from the Italian State Police (Polizia di Stato) were deployed to Colombia to assist with their arrest.The fugitives, found in possession of counterfeit documents, maintained a substantial support network across Colombia, Belgium, the Netherlands, and Italy, aiding their escape and providing resources for their families. Both fugitives now face extradition to Italy, where they will be prosecuted for their roles in a vast drug trafficking enterprise.The following authorities took part in this investigation:Colombia: National Police (Policía Nacional de Colombia - DIPOL-GRAOS 1)Italy: Judicial authorities of Naples (DDA Napoli),  State Police (Polizia di Stato - Squadra Mobile di Caserta), Naples Service for Combating Organised Crime (SISCO Napoli), Central Operations Service in Rome (Servizio Centrale Operativo) 

The clan leader was apprehended in Barcelona on 18 October, followed by the arrest of his lieutenant on 22 October. Both were wanted for charges including murder, attempted murder and kidnapping of rival gang members in Serbia, Austria, Germany and Spain.The clan leader was considered one of Europe’s most wanted and dangerous fugitives.The " VračarClan", a sub-clan of the “Kavač” one, has been involved in a violent feud with the rival "Škaljari Clan" since 2014, resulting in over 60 deaths. This conflict began following the seizure of a large cocaine shipment at the Port of Valencia.Europol played a key role in the operation, focusing on intelligence development and operational support. Its experts collaborated with Austrian, German, and Serbian authorities to analyse the suspects' encrypted communications, leading to their identification and eventual capture. As part of this effort, Serbian police officers were deployed to Europol in 2021 to work on these targets.In the past month, Europol, with the support of the European Network of Fugitive Active Search Teams (ENFAST), coordinated the efforts of law enforcement agencies in Austria, Germany, Slovenia, Spain, Croatia, Serbia, and Bosnia and Herzegovina, which ultimately led to the arrests.Both suspects now face extradition and are expected to be prosecuted for their involvement in several high-profile murders.The following authorities took part in this investigation:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt)Bosnia and Herzegovina: Ministry of Interior of the Republic of Srpska (Ministarstvo unutrašnjih poslova Republike Srpske)Croatia: Ministry of Interior of the Republic of Croatia (Ministarstvo unutarnjih poslova Republike Hrvatske)Germany: Federal Criminal Police Office (Bundeskriminalamt)Serbia: Ministry of Interior of the Republic of Serbia, Criminal Investigations Directorate, Service for Combating Organized Crime and FAST (Ministarstvo unutrašnjih poslova Republike Srbije, Uprava kriminalističke policije, Služba za borbu protiv organizovanog kriminala i FAST)Spain: National Police (Policía Nacional)Slovenia: Criminal Police Directorate (Uprava kriminalistične policije)