Crime News

During the raid, officers seized the print shop used to counterfeit euro banknotes of various denominations (5, 10, 20 and 50). It was equipped with the tools and materials used to produce highly sophisticated counterfeits. Officers at the scene confiscated printing and cutting machines, as well as raw materials for the banknotes and their security features. Analysis by the European Central Bank confirmed that the forged security features on the banknotes, such as holograms, were of high quality. The Carabinieri also seized the vendors’ electronic devices as well as their online channel used to advertise and sell the fake banknotes.Payment in cryptocurrencies and delivery via postFollowing reports of high-quality counterfeit banknotes in Austria, France, Germany, Italy, Luxembourg and Spain, Europol supported these countries in developing an intelligence picture. Tracing over 170 sales activities, investigators discovered that buyers could order counterfeit euro notes of various denominations via a dedicated communication channel. The producers would accept payment in cryptocurrencies and arrange for the fake bills to be sent via post.In addition to facilitating the information exchange, Europol financed and coordinated several operational activities. Europol also provided analytical support to identify countries where the counterfeit currency was distributed. On the action day, a Europol expert was deployed in Italy to provide technical support and cross-check the operational information against Europol’s databases and the systems of the European Central Bank.Participating countries:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt)France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))Germany: Federal Criminal Police Office (Bundeskriminalamt)Italy: Carabinieri (Arma dei Carabinieri - Comando Carabinieri Antifalsificazione Monetaria (CCAFM))Luxembourg: Grand–Ducale Police (Police Grand-Ducale)Spain: National Police (Policía Nacional)

Encryption represents an important means of securing private communications. However, at the same time, it also enables threat actors to manage their malicious activities below the radar of law enforcement. Understanding the needs and challenges of stakeholders in the Justice and Home Affairs (JHA) community is the foundation of adopting the necessary measures to keep Europe safe, while safeguarding fundamental rights.Today, the EU Innovation Hub for Internal Security publishes its first report on encryption, with contributions from Europol, Eurojust, eu-LISA, the EU Counterterrorism Coordinator as well as the European Commission’s Directorate-General Joint Research Centre (DG JRC) and Directorate-General for Migration and Home Affairs (DG HOME). The report highlights that endorsing the benefits of encryption for privacy while acknowledging the challenges that this technology poses to combat serious organised crime and terrorism is of utmost importance. The objective is to advance a constructive discussion on encryption and to identify a balanced solution to protect individuals and society from malicious actors.Five key conclusions of the report:Introducing legal frameworks for lawful access to data and the use of encrypted communications in judicial proceedings is paramount for achieving the right balance between privacy and security.Further research and monitoring on technologies using cryptography, such as telecommunications (5G, 6G networks), biometrics, DNS, the blockchain, and quantum computing, are needed to ensure both lawful access to data and privacy.Collaboration with academia and private industry is essential for the creation of new tools to both serve law enforcement investigations without compromising the overall security of communications.Artificial intelligence solutions can both help and hinder law enforcement efforts to fight serious and organised crime, requiring a multi-faceted and collaborative approach.While quantum computing can significantly improve investigations, it also poses a significant threat to encryption, requiring a swift transition to post-quantum cryptography. Europol’s recent report on quantum computing can be found here.Europol’s Executive Director, Catherine De Bolle, said:A decade ago, one of our main challenges was the availability of data. Today, one of our main challenges is the accessibility of data. Law enforcement agencies and judicial authorities need lawful access to data to prevent and investigate serious crimes and terrorism, because our citizens and victims of crime deserve better.Privacy and security – the balancing of protectionMost significantly, operations targeting encrypted communications platforms such as EncroChat and SkyECC have uncovered the extent to which large-scale criminal organisations use this technology. The rapid increase of the criminal use of encrypted communication led to the implementation of new legal provisions in a number of EU Member States to allow law enforcement to lawfully access encrypted communication in criminal investigations. However, end-to-end encryption currently being rolled out will stop tech companies from seeing any offending that occurs on their platforms. This is why during an informal meeting on 18 April 2024 in London, European Chiefs of Police have agreed upon a Joint Declaration calling for industry and governments to take urgent action to ensure public safety across social media platforms.The access to encrypted communications and their admissibility as evidence in judicial procedures is instrumental for the functioning of law enforcement and judicial procedures. In that respect, the newly adopted EU electronic evidence package is a step in the right direction towards successful cross-border investigations and prosecution. On 30 April 2024, the Court of Justice of the European Union issued a ruling in which the Court clarified conditions under which EU Member States could request and transmit intercepted data from encrypted communication channels and use as evidence in criminal proceedings. From the technical side, new developments and tools represent both challenges and opportunities for law enforcement. This new report looks into quantum computing, cryptocurrencies, biometric data, telecommunication, artificial intelligence and how the development of these technologies can enable or hinder criminal investigations.The EU Innovation Hub for Internal SecurityThe EU Innovation Hub for Internal Security is a collaborative network of EU internal security actors including CEPOL, Europol, Eurojust, eu-LISA, EMCDDA, EIGE, EUAA, Frontex, FRA, General Secretariat of the Council of the European Union (including the EU Counterterrorism Coordinator’s Office) and the European Commission (DG JRC and DG HOME). Europol hosts the secretariat of the EU Innovation Hub, a multi-agency group of EU agencies’ staff who run its daily operations. The Hub coordinates projects in the wider field of internal security, including border management, criminal justice and the security aspects of migration.Europol’s Innovation LabThe Innovation Lab aims to identify, promote and develop concrete innovative solutions in support of the EU Member States’ operational work. This helps investigators and analysts to make the most of opportunities offered by new technologies to avoid the duplication of work, create synergies and pool resources.The activities of the Lab are directly linked to the strategic priorities as laid out in the Europol Strategy 2020+, which states that Europol shall be at the forefront of law enforcement innovation and research.The work of the Europol Innovation Lab is organised around four pillars: managing projects to serve operational needs of the EU law enforcement community; monitoring technological developments that are relevant for law enforcement; maintaining networks of experts; acting as the secretariat of the EU Innovation Hub for Internal Security.Europol’s European Cybercrime CentreEuropol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU and thus to help protect European citizens, businesses and governments from online crime. The centre focusses on cybercrime committed by organised crime groups, which generate large profits (online fraud), seriously harm victims (online child sexual exploitation) or impact critical infrastructure and information systems in the EU, including cyber-attacks. Since its establishment, Europol’s EC3 has made a significant contribution to the fight against cybercrime: it has been involved in hundreds of high-profile operations and hundreds on-the-spot operational-support deployments resulting in hundreds of arrests.

This year, Europol’s photo competition is open to more entrants than ever before. As well as participants from law enforcement agencies in the EU Member States, we now also invite officers from all countries with agreements and working arrangements with Europol to participate!Three categories showcasing contemporary law enforcementThe 2024 edition of the Europol photo competition will have three themed categories, each emphasising a different aspect of modern law enforcement. While the first category aims to capture the essence of diversity in law enforcement and the communities it protects, another category invites photographers to submit images depicting innovation, cutting-edge technologies and modern approaches to policing. In the true spirit of Europol’s mandate, the third category seeks submissions that showcase the indispensable collaboration across borders in law enforcement.For full details on each category and how to participate, please visit the competition page. The deadline for submissions is Thursday, 15 August 2024.Law enforcement officers are invited to submit up to FIVE photos. Whether you are a professional police photographer or a passionate amateur, we want to see your photography skills in action! So get out there, capture the best moments of law enforcement in action, and show us why they deserve our respect and gratitude.Entries will be used in Europol publications, including calendars, social media and other communication products.

A series of raids were carried out on 21 and 27 May in France, Italy and Romania. They resulted in 11 detentions, including the mastermind behind the money laundering scheme. Law enforcement authorities also carried out 15 house searches and seized several electronic devices, jewellery and cryptocurrencies.The organised crime group under investigation carried out classic ‘rip-deal’ scams, targeting millionaires looking to invest or sell properties. Investigators uncovered how the criminals outsourced the money laundering to two other criminal networks. These networks recruited money mules – people who receive money from a third party in their bank account and transfer it to another account or withdraw it in cash, giving it to someone else in exchange for a commission. Europol warned of this trend in its report Decoding the EU’s most threatening criminal networks.In this case, the main perpetrators of the scam lacked the technical expertise to launder their profits, which exceeded EUR 10 million. That is why they delegated part of the criminal process to external service providers. This crime-as-a-service business model further increased their threat, as all their needs could be met by other criminal actors through financial exchange.An elusive labyrinthLaw enforcement authorities investigated the case for two years, as the criminal scheme was complex and challenging for investigators to unravel. The main criminals running the scam were members of families originally from the Balkans, although most of them were based in France.However, the crypto-tracing analysis performed by the investigators and supported by Europol revealed that two money-laundering rings, involving multiple nationalities and geographical locations to try to hide from law enforcement, were linked to the main group of criminals.The investigation revealed that criminals were running a rip deal scam. In this scam, a suspect lures a victim interested in investing or selling property by pretending to belong to an international investment fund, builds trust and carries out the deception at the time of payment. This time, however, they used cryptocurrencies and different apps to accomplish the scam.The criminals contacted the victims, scheduled an appointment at luxury restaurants or hotels, and instructed them to download applications to manage cryptocurrencies. As soon as the victims installed the app, the criminals used sophisticated technical tools to take control of the crypto wallets. It was only when the payments were made using these applications that the victims realised that all their funds had disappeared from their crypto wallets.As the criminals were targeting millionaires and generating huge profits from their activities, investigators were led down a completely new path – that of the money mules.European coordinationDuring the investigation, Europol provided analytical support to law enforcement authorities by disseminating analytical reports and carrying out crypto tracing for the investigators in the field to help advance the investigations. The agency also brought together the investigators to establish an intelligence picture and prepare the action days.A team of Europol experts was deployed in Italy to facilitate the exchange of information between the countries involved in the investigation and to provide ongoing forensic support on the spot.Eurojust supported the investigation by enabling cooperation between the judicial authorities involved in the operation. The coordination meetings at Eurojust helped the authorities to exchange information and prepare for the Action Day. Additionally, Eurojust supported the execution of European Investigation Orders, European Arrest Warrants, and freezing orders.Money-mule prevention campaignEuropol developed the #DontBeaMule prevention campaign to raise awareness about the use of money mules. The campaign is available in all EU languages and informs the public about how money mules operate, who the most targeted individuals are and how to recognise the warning signs.Law enforcement authorities involved in the investigation:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt);France: French National Police (Police Nationale);Germany: Federal Criminal Police Office (Bundeskriminalamt) and Hessian Police (Hessische Polizei);Italy: Italian National Police (Polizia di Stato);Portugal: Portuguese Criminal Investigation Police (Polícia Judiciária);Romania: Romanian Police (Poliția Română);Spain: Spanish Guardia Civil (Guardia Civil), Spanish National Police (Policía Nacional);Switzerland: Federal Office of Police (fedpol), Zürich City Police (Stadtpolizei Zürich).The list of participating authorities was updated on 31 May 2024 at 15:30 CET.

The international operation began as a Spanish investigation, initiated when car rental and leasing companies in the Málaga area reported missing luxury cars. Investigators soon uncovered a criminal network that was using the driving licences or passports of vulnerable persons to rent or lease prestigious cars. Europol formed an operational task force with France, Spain, Poland and Ukraine to thwart these criminal activities. On the judicial side of the operation, Eurojust launched a joint investigation team with the same countries.Corporate-like criminal enterpriseOver the course of a year and a half, the authorities involved drew up an intelligence picture of the criminal network’s operations across Europe. The organisation, mainly based in Ukraine, hired Ukrainian citizens to travel to the EU to rent or lease luxury cars using their real identities. In other cases, forged identity documents were used. With the criminals arranging flights, hotel rooms and other logistics, each person would rent one to two cars, mainly in Spain or France.Once rented or leased, the cars were handed over to contact persons who arranged for the vehicles to be taken, by land or sea, to various countries, including Lithuania, Germany and Poland. At these processing locations, a separate branch of the organisation, consisting of specialised car mechanics, prepared the cars for export. This included disabling the GPS transmitters installed in the vehicles and the forgery and replacement of licence plates and other numbered parts of the vehicle. In some cases, the cars were completely disassembled for sale on the spare parts market.After the changing of the identification numbers, members of another branch used corrupted officials to legalise the cars and register them under their personal documents. This would enable them to sell the vehicles within the EU and abroad, to countries as far away as the United Arab Emirates or destinations in Asia. The whole process was financed by another branch of the organisation, mainly based in Spain.A High Value Target successfully taken downGiven the scale of the investigation surrounding Operation Matador, as well as the advanced criminal expertise of its members, Europol classified the main leader as a High Value Target (HVT). He was in contact with other organisations specialising in vehicle theft, which could be taken down in the coming weeks. On the action day, one Armenian, one Lithuanian, two French, six Russian and three Ukrainian nationals were arrested, including the HVT.Leading up to the action day, nine in-person and online operational meetings were held between the authorities and agencies involved. Europol created criminal analysis intelligence packages and shared them with the national investigating units. On 21 May 2024, an operational centre was set up in Málaga, Spain, to coordinate the action day at the police level, liaising with the judicial coordination centre that had been established at Eurojust.Participating countries:France: National Gendarmerie (Gendarmerie Nationale)Latvia: Central Criminal Department of the State Police (Valsts policija)Germany: Police (Polizei) Baden-Württemberg, Police (Polizei) North Rhine-Westphalia, Police (Polizei) Niedersachsen, Public Prosecutor’s Office (Staatsanwaltschaft) EssenPoland: The Police Central Bureau of Investigation (Centralne Biuro Śledcze Policji Zarząd w Warszawie), Public Prosecutor’s Office Warsaw (Prokuratura Okręgowa Praga w Warszawie)Spain: National Police (Policía Nacional), Investigative Court no. 1 Málaga; Public Prosecutor’s Office MálagaUkraine: Strategic Investigation Department of the National Police of Ukraine (Департамент стратегічних розслідувань Національної поліції України), Main Investigative Department of the National Police of Ukraine (Головне слідче управління Національної поліції України), Prosecutor General's Office (Офіс Генерального прокурора)Participating agencies:Europol, Eurojust

Overall, the results of the action include:15 313 officers from law enforcement and labour and tax authorities participated in the action165 896 entities checked (including 63 649 persons, 9 564 locations, 20 556 vehicles and 76 670 documents)160 persons suspected of trafficking human beings identified (of which 93 for labour exploitation)51 persons arrested for various crimes (of which 30 for labour exploitation)334 potential victims of human trafficking identified (of which 279 potential victims of labour exploitation)476 new investigations in various crimes launched (of which 80 in labour exploitation)The aim of the week-long activity was for authorities to target the forms of labour exploitation most relevant or prevalent in their respective countries. Countries performed inspections in a broad range of sectors such as catering, gastronomy, food delivery, food and meat processing, beauty services, domestic health services, logistics and distribution, agriculture, construction and mining.Following its previous iterations, the action featured a prominent multidisciplinary approach. The work of national and regional police bodies, border guards, tax authorities, labour authorities and labour inspectorates was coordinated and supported by Europol and the European Labour Authority. Several inspections with enforcement authorities from different countries jointly inspecting companies were facilitated. As a result, the operation benefitted from better flow of information and raised awareness of human trafficking indicators. This close collaboration between various authorities and law enforcement significantly contributed to the success of the action week fighting labour exploitation.Europol supported the Joint Action Days around the clock, with analysts processing data shared by participating authorities. Apart from coordinating operational activities and facilitating information exchange, Europol provided analytical and operational support 24/7. It facilitated real-time exchange of communication between participating authorities and deployed experts to help investigators on the ground.Participating Member States:Netherlands (action leader), France, Italy and Romania (co-leaders), Albania, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Finland, Germany, Greece, Hungary, Ireland, Latvia, Lithuania, Luxembourg, Moldova, North Macedonia, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, Switzerland, Ukraine, United KingdomParticipating agencies:Europol, European Labour Authority

Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down during the action days, facilitated attacks with ransomware and other malicious software. Following the action days, eight fugitives linked to these criminal activities, wanted by Germany, will be added to Europe’s Most Wanted list on 30 May 2024. The individuals are wanted for their involvement in serious cybercrime activities.This is the largest ever operation against botnets, which play a major role in the deployment of ransomware. The operation, initiated and led by France, Germany and the Netherlands was also supported by Eurojust and involved Denmark, the United Kingdom and the United States. In addition, Armenia, Bulgaria, Lithuania, Portugal, Romania, Switzerland and Ukraine also supported the operation with different actions, such as arrests, interviewing suspects, searches, and seizures or takedowns of servers and domains. The operation was also supported by a number of private partners at national and international level including Bitdefender, Cryptolaemus, Sekoia, Shadowserver, Team Cymru, Prodaft, Proofpoint, NFIR, Computest, Northwave, Fox-IT, HaveIBeenPwned, Spamhaus, DIVD, abuse.ch and Zscaler.The coordinated actions led to:4 arrests (1 in Armenia and 3 in Ukraine)16 location searches (1 in Armenia, 1 in the Netherlands, 3 in Portugal and 11 in Ukraine)Over 100 servers taken down or disrupted in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, the United States and Ukraine Over 2 000 domains under the control of law enforcementFurthermore, it has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware. The suspect’s transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained.What is a dropper and how does it work?Malware droppers are a type of malicious software designed to install other malware onto a target system. They are used during the first stage of a malware attack, during which they allow criminals to bypass security measures and deploy additional harmful programs, such as viruses, ransomware, or spyware. Droppers themselves do not usually cause direct damage but are crucial for accessing and implementing harmful softwares on the affected systems.SystemBC facilitated anonymous communication between an infected system and a command-and-control servers. Bumblebee, distributed mainly via phishing campaigns or compromised websites, was designed to enable the delivery and execution of further payloads on compromised systems. SmokeLoader was primarily used as a downloader to install additional malicious softwares onto the systems it infects. IcedID (also known as BokBot), initially categorised as a banking trojan, had been further developed to serve other cybercrimes in addition to the theft of financial data. Pikabot is a trojan  used to get initial access to infected computers which enables ransomware deployments, remote computer take-over and data theft. All of them are now being used to deploy ransomware and are seen as the main threat in the infection chain.Droppers’ operation phasesInfiltration: Droppers can enter systems through various channels, such as email attachments, compromised websites, they can also be bundled with legitimate software.Execution: Once executed, the dropper installs the additional malware onto the victim's computer. This installation often occurs without the user's knowledge or consent.Evasion: Droppers are designed to avoid detection by security software. They may use methods like obfuscating their code, running in memory without saving to disk, or impersonating legitimate software processes.Payload Delivery: After deploying the additional malware, the dropper may either remain inactive or remove itself to evade detection, leaving the payload to carry out the intended malicious activities.Endgame doesn’t end hereOperation Endgame does not end today. New actions will be announced on the website Operation Endgame. In addition, suspects involved in these and other botnets, who have not yet been arrested, will be directly called to account for their actions. Suspects and witnesses will find information on how to reach out via this website.Command post at Europol to coordinate the operational actionsEuropol facilitated the information exchange and provided analytical, crypto-tracing and forensic support to the investigation. To support the coordination of the operation, Europol organised more than 50 coordination calls with all the countries as well as an operational sprint at its headquarters.Over 20 law enforcement officers from Denmark, France, Germany and the United States supported the coordination of the operational actions from the command post at Europol and hundreds of other officers from the different countries involved in the actions. In addition, a virtual command post allowed real-time coordination between the Armenian, French, Portuguese and Ukrainian officers deployed on the spot during the field activities.The command post at Europol facilitated the exchange of intelligence on seized servers, suspects and the transfer of seized data. Local command posts were also set up in Germany, the Netherlands, Portugal, the United States and Ukraine. Eurojust supported the action by setting up a coordination centre at its headquarters to facilitate the judicial cooperation between all authorities involved. Eurojust also assisted with the execution of European Arrest Warrants and European Investigation Orders.National authorities at the core of Operation EndgameEU Member States:Denmark: Danish Police (Politi)France: National Gendarmerie (Gendarmerie Nationale) and National Police (Police Nationale); Public Prosecutor Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Paris Judicial Police (Préfecture De Police de Paris)Germany: Federal Criminal Police Office (Bundeskriminalamt), Prosecutor General's Office Frankfurt am Main – Cyber Crime CenterNetherlands: National Police (Politie), Public Prosecution Office (Openbaar Ministerie)Non-EU Member States:The United Kingdom: National Crime AgencyThe United States: Federal Bureau of Investigation, United States Secret Service, The Defense Criminal Investigative Service, United States Department of JusticeAuthorities involved in local coordination centres for Operation Endgame:Portugal: Judicial Police (Polícia Judiciária)Ukraine: Prosecutor General’s Office (Офіс Генерального прокурора); National Police (Національна поліція України); Security Service (Служба безпеки України)The list of participating authorities was updated on 30 May 2024 at 12:10 CET.The list of private partners was updated on 30 May 2024 at 17:00 CET.

Europol’s Executive Director, Catherine De Bolle, said:Over the past quarter of a century, Europol has evolved remarkably. Our history is one of constant adaptation and transformation. We have continually adapted to the changing landscape of organised crime and terrorism, to the evolving operational needs of law enforcement in Member States and to the geopolitical trends that impact the operational context of policing. In this complex environment, Europol has transformed into a cornerstone of European security and cooperation. As we celebrate this milestone, we reaffirm Europol’s driving force: every operation we undertake, every partnership we forge, and every innovation we embrace is ultimately aimed at ensuring the safety and security of our communities.The European Commissioner for Home Affairs Ylva Johansson said:25 years Europol, 25 years supporting Member States to fight crime. Increased police cooperation is essential in dismantling criminal networks and to fight terrorism. Europol is the foundation of that cooperation. During this mandate we have equipped the EU with stronger tools to protect European citizens. Today is for discussing how far we come and what more we need to do to meet future threats.Key milestonesAs Europe’s criminal landscape has evolved over the last quarter of a century, so has Europol. The Agency has undergone a significant transformation over the years to ensure that it can always offer cutting-edge support to Member States and their investigations. Some key milestones include:1993: Europol Drugs Unit is established by ministerial agreement. It starts its operations in 1994 in The Hague, the Netherlands2001: Signature of the first cooperation agreements with non-EU Member States (Iceland and Norway)2010: On 1 January, Europol becomes a full EU Agency2011: First annual European Police Chiefs Convention (EPCC)2013: Opening of the European Cybercrime Centre at Europol (EC3)2016: Establishment of European Counter Terrorism Centre (ECTC) at Europol2016: Europol launches the Europe’s Most Wanted Fugitives website2016: Deployment of guest officers to hotspots in Greece and Italy2019: Europol is mandated by the Justice and Home Affairs ministers from all the EU Member States to create an Innovation Lab to support the law enforcement community in the area of innovation2020: Europol supports investigators in France and the Netherlands in blocking the illegal use of EncroChat encrypted communication by large-scale organised crime groups2020: Europol launches the European Financial and Economic Crime Centre (EFECC)2020: Europol extends its global reach as, for the first time, Europol’s agreements with third countries outnumber those with EU Member States2021: Europol supports investigators in Belgium, France and the Netherlands in blocking the illegal use of Sky ECC encrypted communication by large-scale organised crime groups2022: Europol launches its Digital Forensics Unit, significantly enhancing its ability to support Member States in processing and analysing digital evidence for law enforcement investigations2024: The number of law enforcement authorities connected to Europol through SIENA exceeds 3 000, from more than 70 countries and international entities2024: Europol appoints its first Artificial Intelligence Officer to steer the adoption of cutting-edge AI technologies, ensuring they align seamlessly with the Agency's mission, as well as with strong data protection safeguardsA year of celebrationsThroughout the year, a number of events and activities will take place to celebrate Europol’s anniversary.The festivities kicked off on 28 May at the EU versus Crime conference co-organised by Europol and the European Commission. Europol’s Executive Director Catherine De Bolle and the European Commissioner for Home Affairs Ylva Johansson, together with panellists from law enforcement, policymaking and civil society, looked back at the internal security achievements of the last five years.Event: EU versus Crime (including agenda and recording)The events will culminate in September with the European Police Chiefs Convention organised at Europol’s headquarters. Europol has also updated its logo for its anniversary year – it now proudly wears its 25-year badge.Read more about Europol’s history on our website and follow us on social media to learn more about the Agency’s past, present and future.

It will include an opening speech from Commissioner Ylva Johansson and Executive Director of Europol Catherine De Bolle, followed by three moderated panel discussions:Panel I: Serious and Organised Crime: Disrupting Global Criminal Networks - focused on organised crime and the security threat from current high risk criminal networks.Panel II: Shaping the Future: Counteracting Terrorism and Radicalisation in the Digital Age - addressing the evolving landscape of terrorism and radicalisation, particularly in the context of the digital era.Panel III: Data at a Crossroads: Europol as a hub against crime - focused on the security in light of the misuse of technology by criminals and the need for law enforcement to access data to investigate crime and bring justice to victims of crime.The conference will be followed by a Q&A open to the press.WhenTuesday 28 May 2024, 09:30 - 13:10 (CEST)WhereThe conference will be livestreamed.AccreditationIf you would like to ask questions at the press point, please note that you will have to attend physically in order to do so.Media wishing to be accredited for in-person attendance of the Q&A are asked to register. In case of questions, please feel free to reach out to press@europol.europa.eu. 

Such a complex investigation had to be conducted in two phases: in the first, Spanish law enforcement authorities arrested 35 suspects for belonging to a criminal organisation, facilitating illegal immigration and forging documents. Following these arrests, the Spanish police arrested 34 more suspects for allegedly issuing fraudulent documentation to facilitate the legalisation of the migrants. Results of the operation:69 arrests7 luxury vehicles seizedEUR 80 000 in cash seizedSeizure of electronic devices and documentationEuropol provided operational analysis support during throughout the investigation and, on the action day, deployed an analyst on-site to Toledo to provide on-the-spot assistance and forensic expertise.From fake work contracts to sham marriagesThe investigation revealed that the two dismantled organisations were established in Guadalajara, Madrid and Toledo (Spain) but had branches scattered throughout Spain, including Barcelona, Coruña, San Sebastián, Seville and Valencia. They carried out their criminal activities independently, although they occasionally cooperated when necessary.The criminal organisations provided victims with fraudulent work contracts and fake registrations in municipalities where they never lived in order to obtain legal status in Spain. They even arranged sham marriages and provided advice on how to successfully pass the interviews during the application procedures.Several law firms collaborated with the criminals by helping them draft the fake documentation. These firms received between EUR 500 and EUR 1 000 in exchange for each victim.Links to Europe’s largest Chinese prostitution ringThe case is connected to an operation task force that Europol has been supporting since 2020 and which led to the dismantling of Europe’s largest Chinese criminal network involved in trafficking in human beings for sexual exploitation.The case is also linked to an operation targeting a criminal organisation trafficking human beings for the purposes of sexual and labour exploitation in Mallorca (Spain). The operation took place in March 2024 and resulted in 17 arrests and the protection of 13 victims.

Between 29 April and 10 May 2024, over 30 participants from 24 partner countries as well as Europol and INTERPOL took part in the 14 Victim Identification Task Force (VIDTF), hosted at Europol’s Headquarters in The Hague, the Netherlands. The operation focused on supporting the identification of victims and perpetrators present in over 68 million media files containing child sexual abuse material seized by various law enforcement authorities and submitted to Europol.The participants analysed over 404 datasets depicting specific unidentified victims of child sexual abuse. The specialists managed to identify the countries where the crimes were likely to have been executed for over 180 of the datasets analysed during the operation. Europol has already disseminated over 70 of these datasets to the competent authorities while this process is still ongoing. In 15 of the datasets, experts included identification information on the victims or offenders. So far, four of the victims have been identified and safeguarded by the relevant national authorities.During the VIDTF, experts analysed different datasets, including very recently produced child sexual exploitation material, some of which from 2024, but also so-called ‘cold cases’ with pictures and videos made more than five years ago. The images and videos depicted male and female victims of varying ages originating from different countries around the world. The victims abused in images and videos ranged from toddlers (aged three years and younger) to pubescents.Since 2014, Europol has been regularly bringing together victim identification experts from around the world to focus on unsolved cases of child sexual abuse. Over 700 children have been safeguarded and 230 offenders arrested with support from VIDTF operations.The following countries took part of the VIDTF 14:EU Member States: Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Malta, Netherlands, Poland, Portugal, Romania, Spain, SwedenNon-EU Member States: Australia, Colombia, Moldova, Switzerland, the United Kingdom, the United States, UkraineEU agencies and international organisations: Europol, INTERPOLPublic appeal for helpYou can help us identify the origin of certain objects as part of Europol’s Trace an Object initiative. Visit Stop Child Abuse to see if you recognise any identifiable features or individuals in the publicly released images. Europol periodically releases new series of pictures containing non-confrontational details of images extracted from child sexual abuse cold cases in the hope that someone will recognise a detail that will help narrow down the location of the victim. No clue is too small.Note to media:Europol encourages you to use the term ‘child (sexual) abuse material’ and not ‘child pornography’ in your reporting.The use of the term ‘child pornography’ helps child sex abusers as it indicates legitimacy and compliance on the part of the victim, and therefore legality on the part of the sex abuser. By using the phrase ‘child pornography’, it conjures up images of children posing in ‘provocative’ positions, rather than suffering horrific abuse. Every photograph or video captures an actual situation where a child has been abused. This is not pornography.---Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The investigation was led by the Italian State Police (Polizia di Stato), with the support of the Italian Financial Police (Guardia di Finanza) and the Turkish National Police (Emniyet Genel Müdürlüğ).In total, 17 individuals – all Turkish nationals – were arrested.The investigation was initiated in Como, Italy, in October 2023 after three members of a criminal organisation were arrested in possession of firearms. The head of the criminal organisation featured among those arrested.The criminal organisation was involved in multiple illegal activities, including murders across Europe, the transport of migrants, the trafficking of drugs and the smuggling of counterfeit cigarettes.The investigation also revealed how financial flows coming from abroad financed the illegal activities of this criminal organisation in Europe.Europol deployed two experts to Viterbo, Italy, to assist in the analysis of intelligence and the coordination of the actions. Since the end of 2022, Europol has had a new mandate which allows the Agency to focus its activities on violence, including killings connected with serious and organised crime groups.The list of participating countries was updated on 23 May 2024 at 14:34 CET.

Between December 2017 and February 2018, the scammers pretended to have set up a genuine online trading company which had issued a new cryptocurrency. The initial coin offering (ICO) amounted to an offer of 10 million tokens – or respective rights to the new currency. Investors paid them in established cryptocurrencies such as Bitcoin or Ethereum. In order to gain credibility with investors, the Austrian fraudsters also claimed to have developed their own software and a unique algorithm for the sale of the tokens.Suspicious behaviour and exit scamTraditionally, an ICO will build upon transparency and communicate clearly about each team member responsible for it. In this instance, there was a lack of transparency regarding both the team members involved and the algorithm underpinning the cryptocurrency. In February 2018, the perpetrators suddenly closed all the project’s social media accounts and took the fake company’s website offline. Following this exit scam, it became apparent to investors they had been defrauded. At this stage of the investigation, not all victims of this scheme have yet been identified.Collaborative law enforcement effortEuropol’s specialists organised five operational meetings and worked hand-in-glove with the Austrian desk at Eurojust, providing a holistic analysis picture of the investigation. Europol also deployed a specialist with mobile office to Cyprus to support the operational activities and facilitate the exchange of information.Eurojust supported the action day with a coordination centre, enabling real time communication between all judicial authorities involved and the rapid execution of European Arrest Warrants and search warrants. Europol supported the coordination centre with a setup of our core technical operational product, the Virtual Command Post, at Eurojust. Austrian police officers were present on the ground during operations in Cyprus, providing advice on cryptocurrency seizure and supporting the interrogation of the main suspect.Participating authorities:Austria: Criminal Intelligence Service Austria (Bundeskriminalamt - Cybercrime Competence Center (C4)); Specialised Prosecution Office for the Fight Against Economic Crimes and Corruption (Wirtschafts- und Korruptionsstaatsanwaltschaft)Cyprus: Cyprus Police in LarnacaCzechia: Police of the Czech Republic, National Organised Crime Agency (Národní centrála proti organizovanému zločinu – NCOZ)Participating agencies:Europol, Eurojust

The administrator and developer of LockBit, a Russian national, is now subject to a series of asset freezes and travel bans issued by the UK Foreign, Commonwealth and Development Office, alongside the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Australian Department of Foreign Affairs and Trade.Prosecutors in the United States have also unsealed an indictment against him based on his alleged role as the creator, developer, and administrator of the LockBit ransomware variant. Additionally, authorities in the United States are offering a reward of up to USD 10 million for information leading to his arrest and/or conviction.These measures follow a first phase of action in February 2024 which was led by the UK’s National Crime Agency and resulted in the compromise of LockBit’s primary platform and other critical infrastructure. The sanctions form part of a concerted campaign supported by Europol and Eurojust to severely damage the capability and credibility of the LockBit ransomware group.The true impact of LockBit’s criminality was previously unknown, but data obtained from their systems showed that more than 7 000 attacks were built using their services between June 2022 and February 2024. The top five countries hit were the United States, United Kingdom, France, Germany and China.Europol disseminates some 3 500 victim intelligence packagesLaw enforcement is now in possession of over 2 500 decryption keys and are continuing to contact LockBit victims to offer support.Europol has been exploiting the vast amount of data gathered during the investigation and the first phase of action to identify these victims, who are located all over the world. Its European Cybercrime Centre (EC3) has disseminated some 3 500 intelligence packages containing information about Lockbit victims to 33 countries.With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit ransomware.These solutions have been made available for free on the No More Ransom portal, available in 37 languages.NCA-controlled leak siteAfter seizing control in February, the ransomware group’s leak site on the dark web was redesigned by law enforcement to instead host a series of articles exposing the different actions undertaken against LockBit.The NCA-controlled leak site is once again being used to host a range of information exposing the criminal group.It can be accessed via Tor using the below links:lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onionlockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onionlockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid.onionThis investigation continues to identify affiliates – those who used LockBit services and carried out attacks – and ensure they face law enforcement action.Taskforce Operation CronosThe concerted campaign by the international Operation Cronos taskforce to target and disrupt LockBit ransomware is ongoing. The following authorities are part of this taskforce:France: National Gendarmerie (Gendarmerie Nationale – Unité nationale cyber C3N)Germany: State Bureau of Criminal Investigation Schleswig-Holstein (LKA Schleswig-Holstein), Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Team Cybercrime Zeeland-West-Brabant, Team Cybercrime Oost-Brabant, Team High Tech Crime), Public Prosecutor’s Office Zeeland-West-BrabantSweden: Swedish Police AuthorityAustralia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Japan: National Police Agency (警察庁)United Kingdom: National Crime Agency (NCA), South West Regional Organised Crime Unit (South West ROCU)United States: U.S. Department of Justice (DOJ), Federal Bureau of Investigation (FBI) NewarkSwitzerland: Swiss Federal Office of Police (fedpol), Public Prosecutor's Office of the canton of Zurich, Zurich Cantonal Police

Officers from the Guardia Civil, working together with Europol and the US Drug Enforcement Administration (DEA), seized 21 drums of liquid and solid chemicals used to extract and process cocaine after discovering the laboratory near Madrid.The operation, which included searches of 27 properties in the provinces of Pontevedra, A Coruña and Madrid, also led to the seizure of EUR 3 million in cash. An additional EUR 10 million worth of assets were seized, such as luxurious houses, vehicles and recreational vessels.The individuals arrested, of which 19 are Spanish nationals and one is from Colombia, are suspected of having imported tonnes of cocaine and coca leaves from South America to Spain using recreational vessels. They are believed to have chartered sailboats and catamarans from Galicia to South America to transport their illicit cargo into Europe. To carry out this activity, they recruited young men with maritime experience and no criminal record.The cocaine would be smuggled into different entry points on the Galician coast, before being smuggled inland and to other EU Member States using vehicles equipped with sophisticated hidden compartments.In order to maximise their profits, the Galicia-based criminal organisation also allegedly ran a cocaine laboratory, installed in an isolated area in the suburbs of Madrid. There they would extract cocaine from the coca leaves.During the action day, authorities seized large quantities of drugs, including:50 kg of cocaine,1 kg of heroin,1.7 tonnes of hashish,1 kg of Tusi,10 kg of marijuana,750 g of MDMA,10 000 ecstasy pills,700 grammes of amphetamine.In the framework of intelligence activities underway with its operational counterparts, Europol developed reliable intelligence concerning the international drug trafficking activities of this Spanish criminal organisation. Since then, Europol has provided continuous intelligence development and analysis to support the field investigators. During the action day, a Europol specialist was deployed to Spain to assist with the swift analysis of new data as it was being collected during the action.This case confirms a new trend in cocaine trafficking, whereby the unprocessed drug is exported to be chemically processed in clandestine laboratories in destination countries. This allows the criminal organisations to reduce their losses in the event of possible police seizures.

On 29 and 30 April 2024, experts from law enforcement, prosecution, judiciary, the EU and international organisations gathered at Europol headquarters to discuss the digital aspect of migrant smuggling, the first of a series of meetings as a follow-up to the Global Alliance to Counter Migrant Smuggling launched in November.Over 100 participants from 23 EU Member States and 12 non-EU countries, as well as representatives from the European Commission, Eurojust, the European External Action Service, Frontex, Interpol and UNODC took part in the meeting.The discussions held during the meeting focussed on prevention, response, international cooperation and how to work with the private sector to tackle migrant smuggling activities enabled by the use of online platforms. The objective of the meeting was to identify the most suitable operational responses to this increasing threat, at both EU and global levels.An effective response to tackle migrant smuggling in the digital domainThe criminal market for migrant smuggling activities has continued to grow, alongside existing and new crises worldwide. At the same time, it has become apparent that while offering 'safe trips' online, migrant smugglers are ruthless in their lack of regard for the lives and safety of migrants. Their lack of respect for human life has resulted in a number of tragic deadly incidents while transporting migrants during both sea crossings and on land. Migrant smugglers have quickly adjusted their modus operandi to profit from the opportunities offered by digital technologies to advertise and organise their illegal services and operations.Tackling migrant smuggling in the digital space presents significant challenges for law enforcement and judicial authorities. Migrant smugglers have identified readily accessible digital tools often free of charge, the use of which facilitates their illegal operations. This toolbox used by smugglers is composed of online platforms, including social media applications, encrypted communications and cryptocurrencies.Digitalisation enhances all aspects of this type of crime, such as the recruitment, advertisement and coordination of smuggling activities, as well as the laundering of illegal profits, and enables criminal actors to organise their illegal activities under law enforcement’s radar. Criminal actors are quick to take advantage of the opportunities provided by the online environment, encrypted communication solutions and easily accessible digital tools. Taking advantage of these opportunities offered by the digital world allows criminal organisations to become more efficient, agile and resilient against law enforcement intervention.During the two-day conference, experts discussed the challenges they encounter in criminal investigations and shared knowledge and best practice. The participants identified common needs to tackle more effectively the challenges posed by the online component of migrant smuggling activities.In that context, Europol’s Deputy Director Operations, Jean-Philippe Lecouffe said:As technologies evolve and criminals adapt their business models, we need to stay one step ahead and continue to develop our policy and legislative frameworks, setting the right scene to tackle digital migrant smuggling activities more effectively. Increasing our technical capabilities, creating informal networks of experts and building effective cooperation with the private sector are crucial to combat migrants smuggling networks and prevent them from putting migrants’ lives migrants at risk.Key conclusions of the meetingTo use evidence uncovered in the digital realm more effectively in court, an informal network of experts trained in online monitoring should be created in all EU Member States and non-EU countries. This informal network will share information, good practices, IT solutions in cooperation with the judiciary. Cooperation among law enforcement and judiciary from EU and non-EU countries should be strengthened, with private parties to facilitate online investigations within the legally established framework, giving due respect to privacy.Law enforcement’s technical capabilities should be developed to improve and upgrade online monitoring and evidence-gathering in criminal investigations.Headquartered in The Hague, the Netherlands, we support the 27 EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime. We also work with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Operation PANDORA started with a bank teller in Freiburg, Germany. When in December 2023 a customer asked to withdraw over EUR 100 000 in cash, the bank teller grew suspicious and quickly learned the customer had fallen victim to a ‘fake police officer scam’. He informed the real police, which prevented the victim from handing the money over to the fraudsters.Instead receiving the massive sum of cash, the collectors were arrested by Freiburg Police (Polizeipräsidium Freiburg) officers. Subsequently, surveillance was placed on the victim's phone line. Looking into this individual case, investigators soon realised that the telephone numbers used by the perpetrators could be linked to over 28 000 scam calls in only 48 hours.From fake investment opportunities to shock callsAs the investigation expanded, it was handed over to the Baden-Württemberg State Criminal Police Office (Landeskriminalamt Baden-Württemberg), which was supported by the Federal Criminal Police Office (Bundeskriminalamt) throughout the operation. Early findings showed that the perpetrators, located in a variety of countries, conducted all kinds of telephone fraud. Scam callers would pose as close relatives, bank employees, customer service agents, or police officers. Using a variety of manipulation tactics, they would shock and cheat their victims out of their savings. Ranging from fake promises of lottery pay-outs, investment opportunities, debt collection demands, prepaid card fraud, or shock-calls, scammers relentlessly targeted their next potential victims.To learn more about how to protect yourself from scams such as these, read our cyber scam prevention guide.As the investigation grew in size and complexity, law enforcement experts were closing in on call centres located in Albania, Bosnia-Herzegovina, Kosovo* and Lebanon. The criminal network responsible for the fraudulent calls set up its operation in a coordinated manner, focusing on a different priority in each country. While debt collection fraud was predominantly conducted from Bosnia-Herzegovina, online banking fraud calls were made from Kosovo. Investment fraudsters called mostly from Albania and the criminals specialised in prepaid card fraud sat at desks in Lebanon.Countering call centres with a call centreGerman investigators managed to track the actual conversations coming from the many call centres in real time. From December 2023 on, over a hundred officers were deployed around the clock in the Baden-Württemberg State Criminal Police Office and subsequently secured the content of over 1.3 million nefarious conversations. In consultation with the Freiburg Public Prosecutor's Office (Staatsanwaltschaft Freiburg) and later the Karlsruhe Public Prosecutor's Office (Generalstaatsanwaltschaft Karlsruhe), the aim was to prevent this crime throughout Germany.The posted officers monitored up to 30 conversations of varying lengths at the same time. The State Criminal Police Office had set up its own call centre to counter the international criminal activities. Investigators worked in shifts and had one primary goal: to prevent fraud from happening. As soon as it materialised that anyone who had received a call could fall victim to the scams, the police reached out to warn potential victims.In just four months, over 7 500 calls surpassed the threshold that warrants authorities to initiate criminal proceedings. In total, the deployed officers managed to prevent financial losses for the victims in over eighty percent of these indicted crimes. In total, the potential damages would have amounted to over EUR 10 million.Swooping down on call centresApart from preventing crime, investigators mapped the locations where the calls were coming from. Obtaining information about the phone numbers, the owners, and the technical infrastructure such as servers, the plan was to eventually take down the perpetrators' entire call centre infrastructure. Europol supported this investigation by providing tailored analytical support, thus contributing to the overall intelligence picture.Leading up to the action day, Europol hosted several operational meetings, providing operational coordination and financial support in preparation of the planned raids. When the time came to shut down the criminals’ operation across several countries, Europol hosted the operational coordination centre in its headquarters. Apart from providing operational support on the action day, Europol also deployed officers with mobile offices to locations abroad, thus facilitating the collection and analysis of forensic evidence.Over 60 German law enforcement officers, supported by hundreds of their colleagues in Albania, Bosnia and Herzegovina, Kosovo* and Lebanon, as well as Europol specialists, swarmed dozens of residential and business premises. Apart from arresting 21 persons, officers were able to secure extensive evidence such as data carriers, documents, cash and assets amounting to EUR 1 million. A large number of electronic evidence was also seized, which should enable the investigating authorities to obtain information about possible further call centres and more fraudsters.Participating countries:Germany, Albania, Bosnia and Herzegovina, Kosovo*, Lebanon*This designation is without prejudice to positions on status and is in line with UNSCR 1244/1999 and the ICJ Opinion on the Kosovo declaration of independence

The investigation, initiated in mid-2023 under the General Prosecutor’s Office in Frankfurt, Germany, targeted a criminal network currently going by the name Bandidos. The gang are suspected of trafficking large amounts of cannabis and cocaine from Málaga, Spain, to Germany. The group also smuggled weapons along the same route. The leader of the network, a German national based in Spain, is considered a High Value Target in this investigation. Investigators from the German Federal Police and the Spanish National Police, working jointly on this case, have identified him as a high-ranking member of the outlaw motorcycle gang Hells Angels in Marbella.During the action day on 21 March, officers from the Spanish National Police raided the ring leader’s private villa as well as his car rental business offices. Information exchanged through Europol uncovered that Romanian authorities also had a case opened against the same individual and, as a result of the international cooperation and information exchange, Romania issued a European Arrest Warrant against him in relation to their national case. Following this judicial warrant, Spanish and German officers conducted the joint action day.Europol facilitated the exchange of information and provided support during the course of this joint investigation. Europol also provided analysis and intelligence, and coordinated operational activities. On the action day, Europol deployed an expert in the field to cross-check operational information in real time and provide experts with possible leads.Funding through EU financial mechanismsOfficers from the Spanish National Police, supported by Europol, carried out these joint operations in partnership with Germany and Romania in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem. To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combatting criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.

During the action week, hundreds of law enforcement officers carried out more than 630 house searches and 107 arrests. Nearly 500 converted - or ready to be converted - firearms were recovered during the operation, together with almost 900 firearms. Other weapons, such as air guns or rifles designed to fire metal pellets, were also recovered, along with over 60 000 rounds of ammunition.Results of the action:107 arrests;636 house searches;495 unconverted and converted alarm and signal weapons seized;893 other weapons and firearms seized;60 192 rounds of unconverted, converted, and live ammunition seized;19.5 kg of drugs (heroin, cocaine, cannabis).From legal to lethalWhile 3D-printed weapons are often reported on, law enforcement authorities estimate that converted gas-alarm and signal firearms account for close to half of the illicit weapons in circulation within the EU.Individuals and organised criminal networks often use this type of firearms, as certain models remain easy to modify to discharge live ammunition and convert into lethal weapons.Once they enter the EU, they are usually bought for an affordable price from legitimate marketplaces. The weapons would then be converted and resold in other countries where obtaining, importing, and possessing a handgun requires a license.Converted firearms are dangerous, life-threatening weapons which have been used by criminal organisations in numerous recent deadly shootings in the EU.Europol’s role against firearms traffickingEuropol plays a key role in supporting Member States in the fight against criminal networks involved in illegal weapons trafficking. Europol’s experts and analysts work closely with counter-terrorism specialists on international investigations and combine efforts with Member States to help make Europe safer.Europol coordinated the international operation, analysed the collected data, and drafted intelligence packages to inform the affected countries about potential targets and arms sales. This input helped support the coordinated action days in February. The operation was supported by the European Commission and funded by the European Multidisciplinary Platform Against Criminal Threats (EMPACT).Countries involved in the operation:Belgium, Bulgaria, Germany, Greece, Latvia, Portugal, Romania, Slovenia, Sweden, Albania, Moldova, North Macedonia, Norway, Serbia, Ukraine, United Kingdom.

A joint operation involving law enforcement authorities from France and the United Kingdom, supported by Europol, led to the dismantling of a Vietnamese criminal network smuggling migrants across the English Channel. The network was also involved in sexual and labour exploitation and money laundering.The criminal network smuggled migrants from Poland and Germany through France to the United Kingdom. The main organiser - the right hand of the leader of the criminal network - organised the smuggling activities, while another their accomplice was in charge of collecting the money and organising migrant convoys. Most of the migrants had illegally entered the EU through the use of fraudulently obtained working visas. Some of the irregular migrants were smuggling methamphetamine to the region of Paris, supplying Asian drug trafficking groups based in the area in return for a reduced price for their journey. Other migrants suffered sexual exploitation or labour exploitation in grocery shops and nail salons.Results from 22 April 2024:16 locations searched (12 in France, 4 in the United Kingdom),16 arrests (12 in France and 4 in the United Kingdom),Seizures including: vehicles, luxury goods and watches, synthetic drugs, electronic equipment, documents and the equivalent of over EUR 100 000 in cash in different currencies and EUR 289 000 in bank accounts.Between EUR 15 000 and EUR 18 000 per migrantAnother member of the criminal network was in charge of arranging migrants’ accommodation in the Paris region, before their eventual smuggling to the United Kingdom. The same individual was also in charge of smuggling migrants entering the EU via Poland. After their stay in the region of Paris, the migrants were transported to the region of Dunkerque. Other smugglers then organised their crossing of the English channels using small boats. The investigation suggests that the network may have also organised the transportation of migrants from France to the United Kingdom by trucks. In total, the migrants had to pay between EUR 15 000 and EUR 18 000 to be smuggled to their final destination; the United Kingdom.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to France to cross-check operational information against Europol’s databases and to provide leads to investigators in the field.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Coordinated activities of law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania, Poland and Sweden, supported by Europol, targeted a large criminal network smuggling migrants from Belarus and Russia to the EU via the North Baltic route. During this coordinated action day in the framework of Europol’s Operational Task Force (OTF) Flow II, the efforts of the members of the OTF led to the arrests of High Value Targets and other main suspects in Finland, Germany, Lithuania and Poland as well as checks in Estonia, Latvia and Lithuania.The action days between 22 and 24 April led to:21 arrests of mainly Egyptian, Iraqi and Syrian nationals (4 in Finland, 1 in Germany, 1 in Lithuania and 15 in Poland),24 locations searched (10 in Finland, 8 in Germany, 2 in Lithuania, 1 in the Netherlands and 3 in Poland),The seizures include vehicles, golden jewellery, electronic equipment, forged ID documents, various other documents, money counting machines, drugs, counterfeit cigarettes and more than EUR 80 000 in cash.Between EUR 3 000 and EUR 5 000 to enter the EU from RussiaThe criminal network, composed mainly of Egyptian, Iraqi and Syrian nationals, was very flexible. They adapted their modus operandi and smuggling route quickly, depending on different factors such as visa regulations, natural conditions on the route and taking advantage of the geopolitical situation. The criminal network smuggled the migrants from Iraq via Russia and Belarus to the EU, the main final destination countries were Germany and the United Kingdom. The smugglers used cars, small vans, pickup trucks, and other enclosed vehicles, that are not intended for the transport of people, but exclusively for the transport of goods.The different criminal groups in the network were connected across borders and well positioned along the smuggling routes, forming an efficient smuggling network. They used shared organisers, drivers and other members dealing with the financial flows through the hawala underground banking system. The main organisers operated clandestine financial flows using the hawala network from regional offices in different countries including Germany, Iraq, Syria and Türkiye. The migrants paid between EUR 3 000 and EUR 5 000 per person depending on the illegal service (smuggling route, transportation means and circumstances). They paid the hawala offices directly, also in cryptocurrencies, while the drivers were paid in cash by local members of the criminal network. Investigations into the financial flows suggest that some of the illegal profits were used for the financing of terrorism.Migrant smuggling from Belarus and Russia to the EUIn February 2022, Europol set up OTF Flow with an operational base in Vilnius, Lithuania. The OTF led to the dismantling of a criminal network smuggling migrants from Iraq via Türkiye, Russia and Belarus into the EU and the arrests of 9 out of the 11 High Value Targets identified during this investigation. The successful outcome of the first OTF Flow, known as OTF Flow I, led to the continuation of the taskforce under OTF Flow II. New investigations have been launched via OTF Flow II, with the operational planning being adapted to current challenges, changes in smuggling routes and geopolitical developments affecting the criminal landscape. The investigations focused on 12 High Value Targets, the main organisers of the migrant smuggling activities.OTF Flow is composed of representatives from law enforcement authorities from Estonia, Finland, Germany, Latvia, Lithuania and Poland, as well as Europol experts. Previous investigations led to increased cooperation with the Netherlands, Sweden and the United Kingdom. This special set-up was created specifically to support national authorities in combatting the increase in migrant smuggling activities across the EU-Belarus border. Through OTF Flow, Europol supports the coordination of joint investigative and operational activities, and facilitates the information exchange between the involved law enforcement authorities. The OTF was created following the Joint Investigative Cell (JIC), set up by Lithuania in June 2021, to tackle the newly-emerged phenomenon of migrant smuggling across the North-Eastern EU border.Law enforcement authorities involved:Estonia: Estonian Police and Border Guard Board (Politsei- ja Piirivalveamet);Finland: Finnish Border Guard (Rajavartiolaitos);Germany: German Federal Police (Bundespolizei);Latvia: State Border Guard (Valsts robežsardze);Lithuania: State Border Guard Service (Valstybės sienos apsaugos tarnyba) and National Police (Lietuvos policija);Netherlands: National Police (Politie);Poland: Border Guard (Polska Straż Graniczna);Sweden: The Swedish Police Authority (Polismyndigheten).Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

Straightforward yet sophisticated modus operandiIn 2022 and 2023, the criminal group managed to steal rare books from national and historical libraries in Czechia, Estonia, Finland, France, Germany, Latvia, Lithuania, Poland and Switzerland. The thieves would target rare books by mainly Russian writers, such as first editions authored by the likes of Alexander Pushkin or Nikolai Gogol.When visiting libraries, the thieves would request to check the antique books in person, feigning a specific such as academic interest. On this occasion, they would meticulously measure the books and take photographs before handing them back. Several days, weeks, or months later, the perpetrators would return and ask to access the same books, this time returning counterfeit versions. Experts have established that the copies were of outstanding quality.In other cases, the perpetrators relied on a more crude approach and simply broke into libraries. In preparation of the thefts, they would typically visit libraries and research the books they later stole.International effort to tackle cultural goods theftThe international investigation came to life after France sent a SIENA message to Europol, which prompted further partners to confirm they had identified similar modi operandi in their territories. With reports of rare and historical books being stolen across Europe, Europol facilitated the information exchange between the affected countries and helped to identify the main suspects, three of which were swiftly apprehended. Europol’s analysis on this case helped to create links, identify leads and even uncover a theft that had not yet been discovered. Developing this investigation from the very beginning, Europol’s experts reached out to law enforcement in the affected countries to register the stolen antiques in the relevant databases. Leading up to the action day, two operational meetings were held in the Europol headquarters in The Hague, Netherlands.In Georgia, authorities opened an investigation to identify and locate several members of the organised crime group. Supported and funded by Eurojust, a joint investigative team involving France, Georgia, Lithuania, Poland, Switzerland as well as Europol was formed. A coordination centre was established at Eurojust on the action day.Joint investigation team:France, Georgia, Lithuania, Poland, SwitzerlandParticipating countries:Czechia, Estonia, Finland, Germany, LatviaParticipating agencies:Europol, Eurojust

A cross-border investigation led by the Romanian Police (Poliția Română), supported by Europol and involving the Austrian Police (Landeskriminalamt Salzburg) and the Italian Carabinieri Corps (Arma dei Carabinieri), has resulted in the dismantling of an organised crime group involved in migrant smuggling. The group arranged the illegal arrival in Romania of migrants via fraudulently obtained work visas, before facilitating their further illegal movements towards other EU countries.Results from 24 April 202429 locations searched (2 in Austria, 6 in Italy and 21 in Romania),12 arrests in Romania,Seizures including: luxury cars, electronic equipment, documents and the equivalent of over EUR 146 000 in cash in different currencies.Visa fraud to enable smuggling of migrants from Pakistan to the EUThe criminal network was composed mainly of Romanian and Pakistani nationals, who had established companies in Romania. The suspects allegedly brought Bengali, Egyptian and Pakistani nationals to Romania with work visas, fraudulently obtained by misleading the competent authorities. The investigation identified other Romanian companies, managed by Romanian nationals cooperating with the criminal network, which were also used for fraudulently acquiring work permits and visas. The criminal network requested 509 work permits in total from Romania and acquired permits for 102 migrants. The migrants used these fraudulently obtained visas to illegally enter Romania. Investigative leads suggest that 76 migrants who arrived in Romania using these fraudulent documents have then made secondary movements to other EU countries. During the investigation, 26 migrants were detected in Romania, Italy and Austria. The criminal network charged between EUR 5 000 and EUR 6 000 per person to arrange the arrival to Romania and another EUR 2 000 to EUR 5 000 per migrant for the secondary movement to another EU country. The criminal network is believed to have gained at least EUR 1 million illegal profits.Members of the network based in Pakistan were responsible for the local recruitment of migrants who wanted to reach the EU. Other members of the criminal network arranged the accommodation of migrants in different locations in Brasov and Bucharest before further transporting them to the area of Timisoara. From there, other accomplices picked up the migrants and transported to the Romanian-Hungarian border, where the migrants illegally crossed green borders on foot or hidden in various means of transport. National authorities detected a number of migrants smuggled by this network while they were crossing the borders or directly in the territory of other EU states, mostly in Italy and Austria. In one of the cases in Italy, the Italian authorities detected 45 irregular migrants on foot along the Italian-Slovenian border.Cross-border cooperationEuropol supported the investigation within the framework of the operational plan signed with Romania in regards to the Ukrainian crisis. Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed one analyst to Italy and one to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field.A joint investigation team (JIT) was set up between the Italy, Romania and Europol with the support of Eurojust in April 2024. Eurojust gave additional cross-border judicial support during the action day.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

The primary objective of operation codenamed “Black Tie” was to indict and prosecute a Bosnian-Herzegovinian/Dutch national considered a High Value Target by Europol and the Netherlands. In 2023, the suspect was sentenced to seven years in prison for drug trafficking by Dutch authorities. Another operational objective was to disrupt the entire criminal organisation under the command and control of the High Value Target. This joint international investigation was comprised of Belgian, Bosnian-Herzegovinian, French, and United States law enforcement, supported by Europol.Despite his arrest in November 2022, the investigation showed that the High Value Target continued to steer drug trafficking from source countries in South America such as Brazil, Colombia, and Peru, to Europe and Australia from his base in Dubai, United Arab Emirates. Cooperating with other top-tier international drug traffickers in Dubai, with whom he jointly invested in multi-ton cocaine trafficking ventures, the Bosnian-Herzegovinian/Dutch national became a powerful figure in control of the massive cocaine supply towards Europe and other destinations. Furthermore, the High Value Target is also suspected to be responsible for the production of synthetic drugs in the EU.Targeting the drug kingpin’s ‘inner circle’Among the 23 persons arrested yesterday are not only accomplices, but also corrupt officials identified as facilitators of the network’s criminal activities. Leading up to this action, Bosnian-Herzegovinian authorities already arrested two suspects and seized EUR 55 000 in cash, 8 firearms, 11 police radios and money-laundering documentation. On the action day, law enforcement seized further cash, cars, laptops and other evidence.Following an information request received in June 2023 from Bosnia and Herzegovina, Europol supported the Bosnian-Herzegovinian authorities in the investigation against a core group, or ‘inner circle’, of trusted members of the High Value Target’s criminal organisation. Amongst other criminal offences, the national judicial case was centred on serious crimes such as large-scale drugs trafficking, money laundering and related organised crime in Bosnia and Herzegovina.Europol’s roleEuropol deployed two specialists with mobile offices to Bosnia and Herzegovina in order to gather and cross-check intelligence and assist in further coordinating activities. In addition to the support provided leading up to yesterday’s action, Europol has been supporting the overall investigation with intelligence and coordination. Since early 2021, Europol’s experts have developed and shared over 30 intelligence packages related to the high-value target and his criminal network.Participating law enforcement agencies:Belgium: Federal Judicial Police Antwerp (Federale Gerechtelijke Politie Antwerpen);France: National Police (Police Nationale - Office anti-stupéfiants (OFAST));Bosnia and Herzegovina: Ministry of Interior of Canton Police Sarajevo (Ministarstvo unutrašnjih poslova Cantona Sarajevo, Policija Kantona Sarajevo);United States: Drug Enforcement Administration (DEA); Federal Bureau of Investigation (FBI).

Privacy measures currently being rolled out, such as end-to-end encryption, will stop tech companies from seeing any offending that occurs on their platforms. It will also stop law enforcement’s ability to obtain and use this evidence in investigations to prevent and prosecute the most serious crimes such as child sexual abuse, human trafficking, drug smuggling, homicides, economic crime and terrorism offences.The declaration, published today and supported by Europol and the European Police Chiefs, comes as end-to-end encryption has started to be rolled out across Meta’s messenger platform.Joint Declaration of the European Police Chiefs (pdf)Europol’s Executive Director Catherine De Bolle, said:Our homes are becoming more dangerous than our streets as crime is moving online. To keep our society and people safe, we need this digital environment to be secured. Tech companies have a social responsibility to develop a safer environment where law enforcement and justice can do their work. If police lose the ability to collect evidence, our society will not be able to protect people from becoming victims of crime.This Joint Declaration was agreed upon at an informal meeting of the European Chiefs of Police in London hosted by the National Crime Agency on 18 April.Police Chiefs of all EU Member States and Schengen Associated Countries were invited, alongside Europol’s Executive Director.Earlier that week, Catherine De Bolle met in with Graeme Biggar, Director of the UK National Crime Agency, as part of regular, strategic exchanges on cooperation between Europol and the United Kingdom following the country’s departure from the European Union.

Between Sunday 14 April and Wednesday 17 April a total of 70 addresses were searched across the world, resulting in the arrest of 37 suspects. This includes the arrest of 4 individuals in the United Kingdom linked to the running of the site, including the original developer of the service.The LabHost platform, previously available on the open web, has been shut down.This international investigation was led by the UK’s London Metropolitan Police, with the support of Europol’s European Cybercrime Centre (EC3) and the Joint Cybercrime Action Taskforce (J-CAT) hosted at its headquarters.Europol has supported this case since September 2023. An operational sprint was organised at its headquarters with all the countries involved so that the national investigators could identify and develop intelligence on the users and victims in their own countries. During the action phase, a Europol specialist supported the Dutch National Police with their enforcement actions.Commoditising phishing attacksCybercrime-as-a-service has become a rapidly growing business model in the criminal landscape whereby threat actors rent or sell tools, expertise, or services to other cybercriminals to commit their attacks. While this model is well established with ransomware groups, it has also been adopted in other aspects of cybercrime, such as phishing attacks.LabHost had become a significant tool for cybercriminals around the world. For a monthly subscription, the platform provided phishing kits, infrastructure for hosting pages, interactive functionality for directly engaging with victims, and campaign overview services.The investigation uncovered at least 40 000 phishing domains linked to LabHost, which had some 10 000 users worldwide.With a monthly fee averaging $249, LabHost would offer a range of illicit services which were customisable and could be deployed with a few clicks. Depending on the subscription, criminals were provided an escalating scope of targets from financial institutions, postal delivery services and telecommunication services providers, among others. Labhost offered a menu of over 170 fake websites providing convincing phishing pages for its users to choose from.What made LabHost particularly destructive was its integrated campaign management tool named LabRat. This feature allowed cybercriminals deploying the attacks to monitor and control those attacks in real time. LabRat was designed to capture two-factor authentication codes and credentials, allowing the criminals to bypass enhanced security measures.Easily accessible, yet still a crimePlatforms such as LabHost make cybercrime more easily accessible for unskilled hackers, significantly expanding the pool of threat actors.Yet, however user-friendly the service portrays itself to be, its malicious use constitutes an illegal activity – and the penalties can be severe.A vast amount of data gathered throughout the investigation is now in the possession of law enforcement. This data will be used to support ongoing international operational activities focused on targeting the malicious users of this phishing platform.The following authorities have taken part in the investigation:Australia: Australian Federal Police-led Joint Policing Cybercrime Coordination Centre;Austria: Criminal Intelligence Service (Bundeskriminalamt);Belgium: Federal Judicial Police Brussels (Police judiciaire fédérale Bruxelles/ Federale gerechtelijke politie Brussel);Finland: National Police (Poliisi);Ireland: An Garda Siochana;Netherlands: Central Netherlands Police (Politie Midden-Nederland);New Zealand: New Zealand Police;Lithuania: Lithuania Police;Malta: Malta Police Force (Il-Korp tal-Pulizija ta’ Malta);Poland: Central Office for Combating Cybercrime (Centralne Biuro Zwalczania Cyberprzestępczości);Portugal: Judicial Police (Polícia Judiciária);Romania: Romanian Police (Poliția Română);Spain: National Police (Policía Nacional);Sweden: Swedish Police Authority (Polisen);United Kingdom: London Metropolitan Police;United States: United States Secret Service (USSS) and Federal Bureau of Investigation (FBI);Czechia: Bureau of Criminal Police and Investigation Service;Estonia: Estonian Police and Border Guard Board;Canada: Royal Canadian Mounted Police.The list of participating authorities was updated on 18 April 2024 at 12:14 CET.

The crackdown was the result of a long-running investigation led by the Spanish Police and Spanish Regional Catalan Police, supported by Europol and also involving Portuguese authorities. During the action days, law enforcement officers carried out 13 searches that led to the seizure of:EUR 156 000 in cash,gold bars worth EUR 35 000,more than 50 vehicles,jewellery and over 30 luxury watches worth a total of EUR 500 000,electronic devices, such as mobile phones, and a weapon.More than 100 bank accounts and 10 real estate properties worth over EUR 3 million were also blocked as a result of the operation.Europol supported the investigation since September 2021 by providing operational analysis, technical expertise and operational coordination. On the action days, a money laundering specialist with a mobile office was deployed in Spain.An investigation triggered by a cocaine seizureThe investigation began in 2018, when the police seized 1 400 kilos of cocaine hidden in a shipment from Brazil at the facilities of a company located in Sant Boi de Llobregat (Barcelona). The subsequent operation led to the arrest of several members of an illegal drug trafficking network in 2019 and 2020.With the support of Europol, law enforcement authorities discovered that the seized shipment was part of an international drug-trafficking operation aiming at distributing the drugs not only in Spain but across the EU. The high capacity for drug distribution uncovered the necessary economic network that made it possible to finance the drug shipments.Numerous hard-to-trace methods to launder moneyThe investigation revealed that the shipments were carried out by a large group of people and companies based mainly in Almería, Andalucía, Catalunya and Madrid. Authorities also uncovered that the criminals were using several complex methods to launder money, which allowed them go unnoticed for years. The most common of these was the use of money mules. The gang divided large amounts of cash into multiple small transactions made by several money mules (a practice known as ‘smurfing’). The deposits made in this way were small enough to remain under regulatory reporting limits, thus avoiding detection.The criminals also injected money into a network of companies they controlled, simulating business relationships to justify transfers of funds. At the same time, they had frontmen for registering ownership of assets in South America and used cars with hidden compartments to transfer cash, usually on the route Barcelona – Madrid – Lisbon.More potential arrestsThe criminal organisation had been active for more than eight years. Following a meticulous three-year investigation, Spanish and Portuguese authorities coordinated this joint operation in Andalucía, Aveiro, Catalunya, Lisbon and Madrid that led to the dismantling of the gang and the arrest of its leaders. 7 of the 20 arrested have already been imprisoned; 1 in Venezuela, another in Portugal and the rest in Spain. Some of the criminals linked to the gang were already imprisoned for other drug trafficking-related crimes.The operation is ongoing and law enforcement authorities do not rule out more arrests in the future.Participating authorities:Portugal: Portuguese Judicial Police (Policia Judiciária);Spain: Spanish National Police (Policía Nacional); Spanish Regional Catalan Police (Mossos d'Esquadra).Participating agencies:EuropolEurojustINTERPOL

According to judicial estimates, the total damages resulting from fake investments in the advertised cannabis cultivation crowdsourcing platform amount to a staggering EUR 645 million, but actual and unreported damages could be significantly higher. In total, an estimated 550 000 participants worldwide, most of them European citizens, were registered as online investors. Using bank transfers or cryptocurrencies, around 186 000 participants actually transferred funds into the elaborate Ponzi scheme active from early 2020 to July 2022.JuicyFields and its fake cannabis investment opportunitiesThe suspects, of mainly Russian but also Dutch, German, Italian, Latvian, Maltese, Polish, Jordanian, United States and Venezuelan nationality, used advertisements on social networks to lure victims to their websites. These platforms offered promising crowdsourcing investment opportunities in the cultivation, harvesting and distribution of cannabis plants to be used for medicinal purposes.With a minimum initial investment of at least EUR 50 in this so-called ‘e-growing’ opportunity, investors were promised to be linked with producers of medical cannabis. Upon the purchase of a cannabis plant, the platform assured investors – also referred to as e-growers – they could soon collect high profits from the sale of marijuana to authorised buyers. While the company pledged annual returns of 100 percent or more, they did not reveal exactly how they would accomplish this, let alone be able to guarantee it.The legalisation of cannabis cultivation or the expansion of permissible THC content in cannabis products for personal, recreational, and therapeutic purposes is a significant subject of public debate within the EU. This discourse is further fuelled by the reality that cannabis stands as one of the most widely consumed illicit substances both within the European Union and globally. As seen in other contexts, criminal networks are particularly adept at applying new narratives to existing criminal practices, particularly in periods of changes in regulatory frameworks, which may open up a window of opportunity for fraudsters to advertise low-risk, high-profit investment opportunities.A classic “too good to be true” Ponzi schemeA Ponzi scheme is a type of investment scam where criminals promise high returns with little or no risk to investors. Instead of actually generating profits through legitimate business activities, the scammers use money from new investors to pay returns to earlier investors. This creates the illusion of a profitable enterprise, but in reality, the scheme collapses when there aren't enough new investors to sustain the pay-outs, leaving most investors with losses.As an example, the average - even cautious - investor would make an initial investment of EUR 50 and receive a pay-out doubling their money soon after. Motivated by these financial gains, many investors would raise the stakes and pay in hundreds, thousands, or in many cases even tens of thousands of euros. The platform feigned credibility as it was not only represented in the digital world, but upheld the image of a trustworthy legal business structure with physical offices, staff and representation at cannabis industry events. Initially, the more than 500 000 e-growers were receiving their investment returns. In July 2022 however, the criminals behind the scheme abruptly removed company profiles from social media networks and stopped users from logging in to their accounts, thus freezing cash withdrawals.Complex investigation following elaborate fraud schemeThe widespread occurrence of police reports across Europe prompted Europol to initiate a coordinated approach for investigations involving multiple EU and non-EU countries. This law enforcement focus on JuicyFields and related investment platforms was followed by the establishment of a joint investigation team at Eurojust, led by German and Spanish Police, French Gendarmerie and supported by Europol, the National Crime Agency of the United Kingdom and other law enforcement from numerous Member States. After painstakingly piecing together breadcrumbs of digital evidence, investigators had drawn up a joint intelligence picture that allowed police forces across Europe to initiate this wave of arrests.One of the primary High Value Targets in this investigation was traced to a residence in the Dominican Republic. The Russian national, suspected to be one of the main organisers of the fraudulent scheme, had a property he was residing at searched by the Dominican Republic authorities with officers from the Spanish investigation team along with a Europol specialist deployed on site to assist with coordination.Europol’s roleEuropol supported this massive cross-border investigation from the very start, taking the lead in operational coordination and providing tailored analytical support. Furthermore, Europol shared results of financial investigations as well as other intelligence with the involved countries. On the action day, Europol deployed officers with mobile offices to various locations around the globe. Eurojust ran a coordination centre, staffed by senior police officers from the various investigation authorities, prosecutors and Europol staff, to assist with the coordination of legal coercive measures in multiple countries in multiple time zones. Avoid falling victim to online fraudAs with many things in life, if an online investment opportunity seems too good to be true, it probably is. Learn how to identify the most common cyber scams and how to avoid falling victim to them.Joint Investigation Team:France: National Gendarmerie (La Gendarmerie Nationale)Germany: Criminal Investigation Department Berlin (Landeskriminalamt Berlin); Berlin public prosecutor's office (Staatsanwaltschaft Berlin)Spain: National Police (Policía Nacional - Unidad de Delincuencia Económica y Fiscal (UDEF))Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Dominican Republic, Estonia, Finland, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovak Republic, Slovenia, Switzerland, United Kingdom, United StatesParticipating agencies:EuropolEurojustThe list of participating countries was updated on 12 April 2024 at 16:14 CET.

The platform enables the swift exchange of operational and strategic information among Europol, EU Member States and partner countries with which Europol has cooperation agreements or working arrangements. This service is available 24 hours a day, 7 days a week.In a world where threats can materialise at a moment’s notice, and criminals operate across borders with unprecedented speed and sophistication, the timely exchange of information facilitated by SIENA is essential for law enforcement at local, national and international levels to respond swiftly and decisively.In 2023, the number of messages exchanged via SIENA grew to a historical high of 1.79 million, reflecting the role of SIENA as the preferred European communication channel for law enforcement. That same year, over 151 000 cases were initiated via SIENA. The most commonly indicated crime areas were drug trafficking, fraud and illegal immigration. The expansion of SIENA to encompass more countries will ultimately benefit European citizens, as the intelligence picture of criminal threats affecting the European Union will be significantly enriched the more law enforcement authorities are connected.Europol’s Deputy Executive Director for Capabilities, Andrei Linta, stated: “One of Europol’s strategic priorities is to continue to provide Member States with access to a growing number of partners and sources of information. SIENA is at the core of these efforts. In an increasingly globalised world, access to real-time information from all corners of the EU and beyond enables law enforcement authorities to have a more comprehensive picture of the criminal activities, allowing them to protect their communities more effectively.”In May 2023, SIENA received a “legislative home” in the shape of the Directive 2023/977 of the European Parliament and of the Council on the exchange of information between the law enforcement authorities of Member States (IED), which requested that all competent law enforcement authorities that might be involved in exchanges of information should be directly connected to SIENA.

The investigation was initiated by Carabinieri anti-counterfeiting investigators in January 2023, who received support from Europol. The aim of the investigation was to take down the Naples-based criminal group. The group was mostly active in France, Spain, Germany, Belgium and the Netherlands, but they sold their counterfeit banknotes across Europe.Europol facilitated the information exchange and financed and coordinated several operational activities. Europol also provided analytical support to identify countries in which the banknotes were distributed. During the action day, Europol deployed an expert to Italy to provide technical support and cross-check the operational information against Europol’s databases and the European Central Bank’s systems.Participating authorities:Italy: Carabinieri (Comando Carabinieri Antifalsificazione Monetaria (CCAFM))France: National Police (Police Nationale - Office central pour la répression du faux-monnayage (OCRFM))

Europol’s new report, published today, entitled “Decoding the EU’s most threatening criminal networks”, delves into the characteristics of the criminal networks that pose the highest threat. This Europe-wide analysis focuses on criminal actors in a first-of-its-kind mapping of the most threatening criminal networks. It describes, in detail, how the most threatening criminal networks are organised, which criminal activities they engage in, and how and where they operate. It also assesses which of their characteristics increase the threat posed by these networks.This mapping report is one of the key deliverables of the Belgian presidency of the Council of the European Union which strongly encouraged the efforts of Europol in this respect. It will be an essential tool to fight organised crime, a top EU priority, as outlined in the recent roadmap presented by the European Commission.Speaking at a press conference on the occasion of the presentation of the main findings of the report, Europol’s Executive Director, Catherine De Bolle, said:Criminals thrive in secrecy, but we are changing that. This Europol report is the most extensive study on key criminal networks ever undertaken at the European level by law enforcement. Thanks to the collaboration of all EU Member States and 17 Europol partner countries, we are shining a light on the activities of the most threatening criminal networks in the EU. This data, now centralised at Europol, will give law enforcement agencies the edge they need to better target and conduct cross-border criminal investigations.The Belgian Minister of Home Affairs, Annelies Verlinden, said:We are introducing a new tool in the battle against serious and organised crime – a testament to the power of unity and innovation within the European Union. This report represents a significant milestone for our Belgian Presidency, and indeed, for the entire European community, reflecting our unwavering commitment to safeguarding the safety and security of our citizens. While this report is a very important achievement in itself, it is just the beginning. Considerable work and further steps are required in the coming months and years.The Belgian Minister of Justice, Paul Van Tigchelt, said:Combating organised crime is an absolute priority for the Belgian Presidency and this is an important new weapon in that fight. We now have, for the first time, all crucial data on the most threatening criminal networks in one location - with Europol. The next step is for the various police forces of the Member States to continue to enrich this centralised information so we can further prosecute and dismantle these networks.The European Commissioner for Home Affairs, Ylva Johansson, said:Organised crime is one of the biggest threats we face today, threatening society with corruption and extreme violence. We need to know what we’re fighting – that’s why mapping organised crime is a key objective of our EU organised crime strategy and the roadmap I launched last October. The result is this important report showing the criminal threat posed by over 800 criminal networks with tens of thousands of members. I congratulate Europol on this important report.The European Commissioner for Justice, Didier Reynders, said:The impact of these findings will have significant implications for justice systems across the EU and the rule of law. Judges and prosecutors can only fight organised crime if they are free from intimidation, threats or attempts to influence their professional integrity. We must assure that this is the case. As the most threatening criminal networks run borderless criminal operations, cooperation between experts is vital. This is why the Commission will be supporting proposals for a new EU judicial network, to be placed at Eurojust, with a focus on organised crime, including High Value Targets.A unique datasetThis analysis is based on a unique dataset which was shared with Europol specifically for this purpose, and complemented with additional information already shared with Europol as the European hub for criminal information.All EU Member States and 17 of Europol’s partner countries contributed data to identify the most threatening criminal networks in Europe. This resulted in a unique dataset of 821 highest-risk criminal networks, with extensive information on all aspects that describe them and help assess their threat.These criminal networks, whose membership exceeds 25 000 individuals, were selected based on criteria around the threat they pose. These networks are active in a range of crime areas, from drug trafficking to migrant smuggling, property crime and others.Trends around the most threatening criminal networks were identified by Europol through the analysis of the full dataset of 821 networks.The ABCD of the most threatening criminal networksThrough a comprehensive analysis of 821 criminal networks, an ABCD framework was developed, shedding light on their fundamental characteristics. By categorising key aspects of these groups into four distinct dimensions—A for Agile, B for Borderless, C for Controlling, and D for Destructive—the ABCD framework offers valuable insights into their modus operandi, structures, and operational patterns.The most threatening networks are:Agile: They exhibit a remark agility to adapt their criminal business processes to opportunities and challenges, including those challenges posed by law enforcement. They are able to extensively infiltrate and misuse legal business structures. This helps their criminal businesses thrive, allows them to launder their criminal profits and shields them from detection. 86 % of the most threatening criminal networks make use of legal business structures, the vast majority in the EU.Borderless: The most threatening criminal networks run borderless criminal operations. Their activities touch upon many countries in the world, and their composition is very international, with network members from many countries in the EU and the world. A total of 112 nationalities were represented among the members of the 821 most threatening criminal networks, with 68% of the networks composed of members of multiple nationalities. However, looking at the locations of their core activities, the vast majority maintain a strong geographical focus and do not extend their core activities too broadly.Controlling: The highest-risk criminal networks exert strong control and focus over their criminal operations. They tend to specialise in one main criminal business; truly polycriminal networks are the exception rather than the norm. The leadership of 82% of the most threatening criminal networks is settled either in the main country of activity, or the country of origin of the key members.Destructive: The criminal activities and corruptive practices of the most threatening criminal networks are inflicting significant damage to the EU’s internal security, rule of law and economy. Half of the most threatening criminal networks are involved in drug trafficking as the/a main criminal activity. More than 70 % of networks engage in corruption to facilitate criminal activity or obstruct law enforcement or judicial proceedings. 68% of networks use violence and intimidation as an inherent feature of their modus operandi.The threat posed by these networks is pervasive and complex. There is a need for a concerted, sustained, multilateral response and joint cooperation.The ABCD of criminal networks highlights important elements to guide policy and operational action. It is a starting point for future analysis of criminal actors and will be further elaborated in forthcoming Europol analytical products, such as the EU Serious and Organised Crime Threat Assessment 2025.This data, now centralised at Europol, will assist national law enforcement authorities to better target and conduct their cross-border criminal investigations.

The report is the first of its kind to analyse in depth the characteristics that make criminal actors particularly threatening to the EU’s internal security.All EU Member States and 17 third countries contributed data for this analysis, resulting in a unique dataset over 800 criminal networks. The assessment will help law enforcement and policymakers to identify measures to disrupt them.The press conference will start with opening remarks, followed by a Q&A.WhoEuropol’s Executive Director Catherine De BolleBelgian Minister of Home Affairs Annelies VerlindenBelgian Minister of Justice Paul Van TigcheltEuropean Commissioner for Home Affairs Ylva JohanssonEuropean Commissioner for Justice Didier ReyndersWhenFriday 5 April at 08:30 CESTWhereResidence Palace – Room Polak, Rue de la Loi 155, 1040 Brussels, BelgiumThe press conference will also be livestreamed.Questions will only be taken from the media attending in person.AccreditationMedia wishing to be accredited for in-person need to send their details (name of the journalist + name of the media) to press@europol.europa.eu by Thursday, 4 April, at 17:00.The conference room will be available for media to set up as from 07:45 CEST. Everything must be pre-set by 08:20 CEST.NOTE: Material for media will be made available on Europol’s website on the day at 08:30 CEST.

This Working Arrangement not only brings together CBI and Europol but also links the law enforcement authorities in the Republic of India with law enforcement authorities of the Member States of the European Union, as well as third countries and organisations associated with Europol. It establishes clear mechanisms for communication, cooperation, and collaboration, ensuring that respective law enforcement agencies can seamlessly collaborate, share best practices, and support each other.The cooperation may, in addition to the exchange of information, include the exchange of specialist knowledge, general situation reports, strategic analysis results, and training activities. The Working Arrangement also allows for the provision of advice and support in individual criminal investigations. The Director of the CBI, Mr Praveen Sood, said:This working arrangement is an outcome of years of negotiation between CBI and Europol to reach this common ground. This moment marks a significant milestone in our ongoing efforts to combat crime and enhance cooperation between our agencies.” He further highlighted that “The international dispersal of crimes, criminals and proceeds of crimes have necessitated need for expeditious international cooperation. Criminal networks operate across borders, exploiting differences in jurisdictions and taking advantage of modern technologies to evade detection. The arrangement we are signing today reflects our shared commitment to address these challenges through enhanced cooperation and mutual assistance.Europol’s Executive Director, Ms Catherine De Bolle, said:In an increasingly globalised world, the security of the European Union starts abroad. Security challenges have become more complex and multidimensional. Nowadays there is a strong link between what happens outside of the EU’s borders and security within Europe. The Working Arrangement which Europol has signed today with the CBI underscores the interconnected nature of security threats and the necessity of international cooperation to effectively address them. By joining forces with India, Europol further solidifies the EU's commitment to proactive and comprehensive security measures, recognising that safeguarding our citizens requires a coordinated effort on a global scale.After entry into force of the Arrangement, this new level of cooperation will be important for tackling priority crime areas affecting both the European Union and the Republic of India.

The criminals’ technique was as unsophisticated as it was effective. Operating in gangs of three to five members, one accomplice would stake out potential victims in establishments such as fine-dining restaurants or upper-scale hotels. Once they had identified a person wearing an expensive wristwatch, the victim would be observed and followed by a gang member in anticipation of the ideal opportunity. Acting fast and, when necessary, with violence, the other gang members would assault the watch owner, detach the expensive timepiece from the owner’s wrist and typically flee on a scooter.Europe-wide pattern identified at EuropolAn almost exponential increase in the price of luxury watches in recent years has incentivised criminals to increase targeted robberies. Certain rare timepieces have a market price that far exceeds the retail price, which regularly lies in the four or five digits. Typically, these types of robberies would be investigated at local level. However, with incidents of ruthless watch robberies being reported across Europe, national law enforcement authorities shared this information with Europol, where a pattern of organised crime was identified.After sharing analytical findings with its partners, Europol invited investigators from the Naples Squadra Mobile and other involved law enforcement authorities for operational meetings to discuss the gathered intelligence picture. Based on the information at hand, the partners issued European Arrest Warrants for the remaining 8 Italian suspects based in Naples. Europol coordinated the international action day against the criminals and deployed staff to Italy during the raids. The investigation and the action day itself were supported by the @ON Network funded by the EU Commission, led by the Italian Antimafia Investigation Directorate (DIA).Participating authorities:Austria: Criminal Intelligence Service (Bundeskriminalamt); Criminal Police Vienna (Landeskriminalamt Wien);France: National Police (Police Nationale – Brigade de Répression du Banditisme à Paris (BRB PARIS)); Judicial Police (Police Judiciaire Paris);Germany: Federal Criminal Police Office (Bundeskriminalamt); Berlin Police (Polizei Berlin, Direktion 2); Munich Police (Polizei München, Kommissariat 21);Italy: Central Operations Service of the National Police (Servizio Centrale Operativo della Polizia di Stato); Mobile Squad of the Naples Police Headquarters (Squadra Mobile Napoli) with the cooperation of the "Decumani", "Montecalvario" and "Dante" police stations as well as the Naples Air Border Police Office (Polizia di Frontiera Aerea);Spain: National Police (Policía Nacional);Switzerland: Federal Police (fedpol) and various Cantonal Police Forces.Participating agencies:Europol

During the operation on 19 March, law enforcement authorities also conducted 22 house searches in Sibiu and Vâlcea, Romania, where the gang was located. The group operated internationally and had branches in Spain.The operation led to the seizure of:over EUR 174 000 and RON 41 000 in cash55 g of goldelectronic devices, including 135 mobile phones, 29 laptops, 5 tablets, 23 memory sticks, and 326 SIM cards, among others.Europol’s European Cybercrime Centre supported the investigation by providing extensive analytical support. In response to the scale of the crime, Europol brought together national investigators from Romania and Spain. The investigators worked together to establish a joint strategy and prepare the final phase of the investigation. The information exchange was facilitated by the Joint Cybercrime Action Taskforce (J-CAT), hosted at Europol’s headquarters. On the action day, a Europol analyst was deployed to Romania to assist with the investigative measures.A professional and systematic criminal networkThe criminals operated in a sophisticated professional structure comprised of three groups, each with a specific task. One group was responsible for coordinating the gang, while another was in charge of posting fake advertisements on both genuine selling sites and fraudulent phishing platforms. A third group recruited money mules to launder profits acquired from the illegal activities.Although most of the published advertisements listed holiday rentals, criminals would also publicise second-hand cars and electronic devices. According to authorities, the amount spent per victim ranged between EUR 200 and EUR 10 000.The criminal organisation also conducted a type of phishing scam called a Business Email Compromise. The criminals would use malware to intercept victims’ emails and mislead them into sending funds to accounts owned by the criminal network.Romanian and Spanish police believe that the number of victims impacted by this scam could exceed one thousand. The police also noted that the victims were mainly from Spain. Through all of these illegal activities, the criminal organisation garnered profits estimated to amount to millions of euros.Fake online advertisements ruin holidaysHoliday fraud happens when a victim pays a travel agent, private entity or agency for rental services offered online, such as accommodation, transport tickets, rental cars or complete holiday packages to then find out that the service does not exist.To help prevent people from falling for holiday scams, Europol has published a full prevention guide "Protect yourself from holiday and ticket fraud".

A joint operation between the Spanish National Police (Polícia National) and the Spanish Civil Guard (Guardia Civil), supported by Europol, has led to the arrests of two men and a woman in Cádiz and Granada. The suspects carried out migrant smuggling activities, which resulted in deaths. The presumed members of the smuggling network allegedly facilitated the travel of migrants, in boats, between Kenitra (Morocco) and Cádiz (Spain). The joint investigation between the Spanish National Police and the Civil Guard resulted in the discovery of the precise location of the boat and the identification of the itinerary of this smuggling activity. On the action day, the officers carried out searches at the suspects’ addresses in the city of Granada and the towns of Algeciras and San Roque (Cádiz) and arrested them.  The investigation led to the identification of three suspects, allegedly responsible for the death by drowning of five migrants who were thrown into the sea in November 2023. The three suspects allegedly forced the migrants - through violence and intimidation - to jump off of a high-speed boat into the water. They threatened them with machetes, forcing their passengers to jump into the sea, knowing that there were strong currents active and that many of the migrants were not able to swim. A boat crew, which was in the area at the time, managed to save five migrants out of the 37 on board, all of whom were forced to jump into the water. Later on, national authorities recovered the bodies of five migrants, who were also travelling on this boat. The migrants had paid between EUR 3 000 and 12 000 for this risky journey between Kenitra and Cádiz.Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed two analysts to Spain to support the national authorities with technical expertise, to cross-check operational information against Europol’s databases, and to provide leads to investigators in the field. Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

A cross-border investigation led by the Romanian Border Police (Poliția de Frontieră), supported by Europol and involving the Bulgarian General Directorate Combating Organised Crime (Главна Дирекция Борба с организираната престъпност) and the German Police (Bundespolizeiinspektion Waidhaus), has resulted in the dismantling of an organised crime group involved in migrant smuggling. The group were smuggling migrants from Bulgaria to Romania, across the Danube river, and then toward Western Europe. Results from 12 March 202433 locations searched (18 Calafat, 11 Timișoara, 4 Argeș),42 arrests,Seizures including:7 cars,passports,weapons,electronic equipment,EUR 32 000, LEI 75 000 and GBP 7 500 in cash.Up to EUR 5 000 from the Danube river to GermanyThe investigative activities established that the criminal network, composed mainly of Bangladeshi, Iraqi and Romanian citizens, was formed in the beginning of 2023. The suspects recruited migrants from Middle-East who wanted to reach Western European countries, especially Germany.The criminal network smuggled the migrants in two phases. In the first phase, the suspects picked migrants up from Bulgaria and transported them in boats across the Danube river. The migrants would then be taken in groups of 20-30 via cargo transport to the western part of Romania, mainly the areas of Timișoara/Arad and Caraş Severin. The smugglers also used off-road vehicles, but mainly transported groups of 13-17 migrants in 5-seat vehicles. This particularly dangerous means of transportation resulted in the hospitalisation of migrants following a traffic accident in July 2023.Once in the western Romania, the second phase would take place. The suspects would place migrants in clandestine accommodation for several days, before transporting them hidden between goods in trucks across the Hungarian border to Western Europe, mainly Germany. The migrants paid between EUR 3 500 and 5 000 per person to be smuggled from the Danube river to their final destination. The investigation identified 20 transportations across Romania of a total of about 500 migrants.Cross-border cooperationEuropol supported the investigation within the framework of the operational plan signed with Romania in regards to the Ukrainian crisis. Europol facilitated the exchange of information and provided operational coordination and analytical support. On the action day, Europol deployed an analyst to Romania to cross-check operational information against Europol’s databases and to provide leads to investigators in the field. Europol also facilitated the deployment of investigators from Bulgaria and Germany to support the Romanian officers involved in the operational actions in the field.Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organised crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.

During the action day on 12 March, authorities also conducted 26 searches in Belgium, Israel, Netherlands and Slovakia, resulting in the seizure of: 165 luxury watches with certificates, jewellery and other counterfeit products;200 diamonds;EUR 209 000 in cash;Crypto ledgers;Weapons;14 kg of drugs;Multiple electronic devices, including phones and computers;Credit cards and financial documentation.Additional involvement in drug traffickingThe investigation started in 2022, when the police intercepted a package containing 600gr of cocaine in Brussels destined for Israel. Thanks to a subsequent investigation, it was revealed that a large criminal organisation which engaged in drug trafficking also counterfeited luxury items. According to law enforcement authorities, the criminal network manufactured fake luxury watches outside the EU by mixing original parts with fake components to mislead potential customers. Once the watches were produced, they would import them to Belgium and introduce counterfeit diamonds and watches into the market. Besides confusing buyers, this modus operandi also undermines the reputation of Antwerp’s “Diamond District” and calls into question the unique certification applied to these luxury items in which customers place their trust.The suspects also trafficked cocaine and synthetic drugs across the world. They also laundered money through complex schemes, including cryptocurrencies, illegal banking systems and reinvestments in real estate, notably in Portugal.Europol’s role in the investigationEuropol deployed specialists with expertise in cryptocurrencies and OSINT capabilities to Antwerp on the action day. The agency supported the investigation by fostering the exchange of information, organising operational meetings, and providing operational coordination and analytical support.The operation was supported by the @ON Network, funded by the EU Commission and led by the Italian Anti-mafia Investigation Directorate (DIA).Law enforcement authorities involved:Belgium: Antwerp Police Department (Politiezone Antwerpen), Belgian Federal Police (Federale Gerechtelijke Politie, DSU), General Administration of Customs and Excise (Algemene Administratie van de Douane en Accijnzen), Federal Economic Inspection (FOD Economie).Netherlands: Police Amsterdam (Politie Amsterdam), Investigators District East Amsterdam (District Oost Amsterdam), International Legal Assistant United Amsterdam (Internationaal Rechtshulp Centrum).Portugal: Judicial Police (Polícia Judiciária), Asset Recovery Office-ARO (Gabinete de Recuperação de Ativos-GRA).Slovakia: National Crime Agency of the Police Force Presidium (Národná kriminálna agentúra Prezídia Policajného zboru)Israel: National Unit for serious and International crimes (Yahbal), NCB Jerusalem (MATAM). 

The suspects were arrested in Madrid, Palma, Barcelona and Poland during an action day on 14 November 2023. Seven house searches were also carried out, with six in Palma and one in Barcelona, leading to the seizure of electronic devices, documentation, and EUR 15 000 in cash.The criminal network also profited from the sale of sexual invigorates, so that male customers would spend more time using their illicit services. The network channelled these profits through a catering company owned by the leader of the organisation.Lured through a messaging appThe victims were lured into being trafficked by compatriots via a messaging app. The criminals charged victims EUR 15 000 for travel to Europe, which would be paid by the trafficker who received them in Poland. On occasions, this same individual would further extort the victims by forcing them to pay an extra EUR 400 per month.From Poland, the victims would be transferred to Mallorca and promised a good job there. However, they were actually forced into prostitution in order to pay off the criminal network.According to Spanish law enforcement, the victims lived under a regime of slavery where they had to be available 24 hours, 7 days a week, and were under permanent surveillance by the criminal organisation. They could keep only half of the benefits acquired from their sexual services and could not reject any clients.Europol’s role in the investigationEuropol supported the operational activities, facilitated the exchange of information and provided analytical support. On the action day, Europol deployed one expert to Palma to cross-check operational information in real time, support investigators on the ground, and perform forensic extractions of the mobile phones used by the suspects.The investigation benefited from funding from the European Multidisciplinary Platform Against Criminal Threats (EMPACT).

Overall results of the two action days:The leader of the network (High Value Target), a woman from Bosnia and Herzegovina, was arrested in Bosnia and Herzegovina18 significant criminal organisation members arrested (9 in Bosnia and Herzegovina and 9 in Croatia)10 locations searched (in Bosnia and Herzegovina and Croatia)Seizures include vehicles, electronic equipment and about EUR 65 000 in cashShift in migration routes in the Western Balkans regionBack in 2023, the Bosnia and Herzegovina-Croatia border was the second most used crossing point for smugglers in Balkans. In 2024 criminals have further intensified their activities on the route Bosnia and Herzegovina – Croatia - Slovenia. Consequentially, this border section is now on the route, which is mostly used to smuggle migrants from the Balkans to Western Europe.The criminal network targeted by these action days used a very dangerous modus operandi. They transported the migrants between Bosnia and Herzegovina and Croatia, hiding them in concealed sections in modified wagon cars. The migrants were placed in hide out under car floors, which made the transportation extremely dangerous. During the investigation and before the action days, Croatian authorities arrested 28 suspected smugglers. Authorities have detected smuggling incidents connected to this network. During these interceptions, more than 360 migrants were found.The migrants were then led to cross the EU borders mainly on foot. After the migrants had crossed the border, the smugglers would then transport them further by car, van or in the back of a lorry. The investigation led to the identification of several networks operating in the region. The leaders of these networks are believed to reside in surrounding countries, but also in Germany and Türkiye.The leaders are suspected of coordinating different cells operating at local level to ensure temporary accommodation and then transferring migrants along the route to their final Western European destination. Operational intelligence suggests that approximately 40 networks are active in the region, which are attracting different individuals potentially playing various roles in the smuggling activities.Regional OTF at Europol to address the criminal networksThe Balkan region is a key transit area for secondary movements, where criminal networks proactively offer their services to irregular migrants. To provide a concerted response to this criminal phenomenon, in March 2023 Europol has set up a regional OTF involving Bosnia and Herzegovina, Croatia, Germany and Slovenia. The OTF focuses on tackling criminal networks involved in migrant smuggling along the main Western Balkan migration routes.Europol established a dedicated financial instrument to facilitate such high-profile investigations. Europol supported the overall coordination of the investigative activities, while also organising operational meetings of the members of the OTF. During the length of the investigations, Europol facilitated the exchange of information and provided analytical support to the national authorities involved. During the action days, Europol deployed experts to Bosnia and Herzegovina and Croatia to assist the national authorities to cross-check in real time operational information against Europol’s databases, perform digital forensics and support the investigators in the field with new leads.

Overall results of the four action days:11 arrests (3 Palestinians, 3 Latvians, 2 Iranians, 2 Syrians, 1 Lebanese),4 print shops dismantled,Seizures including:4 650 illegal documents,electronic equipment,10 high-end laser printers and other equipment/material for the production of false documents,over EUR 20 000 in cash.Up to EUR 1 200 for a false IDThe investigation identified that the criminal network was active since September 2023. The suspects used sophisticated equipment (laser printing devices, software and document scanners) to produce high-quality false travel and identification documents, which were especially difficult to detect as fraudulent. The costs of false documents ranged from EUR 400 to EUR 1 200, depending on its type and country of origin.The large number of seizures made during the action days shows the particularly intense activity of the network. The documents seized during the raids alone held an estimated market value of EUR 600 000. In addition to producing and disseminating false documents, the suspects also allegedly organised smugglings by air, for which they used their own forged documents and charged EUR 6 000 per person for the full criminal service including the flight tickets.The documents found during the raids were predominantly forgeries of EU documents (for example imitating Belgian, Dutch, Danish, Finish, Greek, German, Italian, Hungarian, Slovenian, Spanish, Swedish, Norwegian, as well as Colombian and Ukrainian documents). The forgers, who were running independent print shops, collaborated with each other on a case-by-case basis, mainly in the exchange of raw materials or in the preparation of specialised documents. The forgers avoided direct contact with customers, irregular migrants or members of other migrant smuggling networks, instead using intermediaries who were concluding the deals and delivering the false documents on their behalf.The outcome of this operation confirms migrant smugglers’ increasing use of fraudulent documents in order to facilitate illegal entry into the EU. The smugglers also provided false documents which would enable migrants to change their residence status within the EU. The operational information contributed to Europol indicates that document fraud is present in many migrant smuggling cases. Enhancing international cooperation and Europol’s support to national authorities will be crucial for increasing the effectiveness of investigations into the production and dissemination of false documents.Europol’s supportEuropol supported this investigation by facilitating information exchange, coordinating operational activities and providing tailored operational analytical support. During the action days, Europol deployed two experts to Greece to support the field activities by crosschecking the operational information collected in real-time. Europol also provided operational analysis to help deliver possible leads to investigators on the ground.

Officers learned how to carry out targeted investigations against perpetrators suspected of abusing their own children or at least possessing and distributing material depicting the sexual abuse of children. During the action, over 100 000 illegal files were seized. As the forensic examination of the seized digital devices is still ongoing, investigators estimate that a final total of more than one million images and videos will be found and confiscated.The training was held by expert investigators and focused on how various file-sharing networks can be used to search for perpetrators who possess and distribute material depicting the sexual abuse of children. Another aim was to find out whether perpetrators are in possession of text-based material such as paedophile manuals about grooming or the sexual abuse of children.Suspects from all walks of lifeThe men arrested in this action for downloading and disseminating child sexual abuse material using peer-to-peer (P2P) networks stem from all walks of life. Aged  between 23 and 72, on average the perpetrators are 49 years old. Four of the suspects are school teachers and one suspect works with disabled children, which renders this successful law enforcement effort even more meaningful.Europol classifies perpetrators who possess or distribute material depicting the sexual abuse of children, and simultaneously possess manuals about committing sexual abuse, as High Value Targets. They are assumed to be the most likely to physically abuse children. The 57 national investigations into the crimes committed by the arrested persons will also be a starting point for further law enforcement action, with more arrests and seizures to be expected across Europe. Europol facilitated the information exchange between all the countries involved, and further enhanced the operational picture by cross-checking the seized data and providing intelligence packages to continue the investigative work.Potential and actual victims safeguardedThe overall ultimate strategic goal of operations such as this one is to eliminate the risk of children being sexually abused. Every child counts, and for every child saved this means a world of difference. Some of the arrested suspects had direct access to children via their profession, while ten suspects have children of their own. At least one child was saved from ongoing physical abuse, the other children can be considered as safeguarded from potential abuse.Law enforcement awareness campaignsEuropean law enforcement, in collaboration with relevant partners via EMPACT, focuses on combatting the distribution and possession of abuse material on file sharing networks. Through the Police2Peer initiative, files appearing as child abuse material are made available to those seeking it, dispelling the illusion of ‘safety in numbers’ on peer-to-peer networks. These files, though they appear to contain illicit content, are clear warnings or feature police officers from partner countries, emphasising that users sharing abuse material are neither safe nor untraceable. Additionally, Europol's ‘Say No!’ prevention campaign, disseminated in over 30 countries, educates parents, children, and teachers on online risks and provides guidance on reporting and prevention measures.Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark (project leader), Estonia, Finland, France (action co-leader), Germany, Greece, Hungary, Italy, Latvia, Lithuania, Malta, Poland (action co-leader), Romania, Slovakia, Slovenia, Sweden, Iceland, North Macedonia, Norway, Switzerland, Ukraine

Who was involved?This year's exercise brought together law enforcement representatives involved in applying both the EU Crisis Protocol and Regulation (EU) 2021/784, online service providers, the Global Internet Forum to Counter Terrorism (GIFCT), as well as policymakers from governments and EU bodies.A rapid, coordinated response to terrorist content onlineThe EU Crisis Protocol, adopted by the Justice and Home Affairs Ministers in October 2019, is a voluntary mechanism that allows EU Member States and online platforms to respond rapidly and in a coordinated manner to the dissemination of terrorist content online in the event of a terrorist attack, while ensuring strong data protection and fundamental rights safeguards.The development of the Protocol came about in the aftermath of the terrorist attack in Christchurch, New Zealand in 2019, whereby leaders from governments, tech industry, civil society and the European Commission agreed on the ‘Christchurch Call for Action’. Since then, other crisis mechanisms have been developed both at a national level and by the tech sector.The practical implementation of the Protocol is tested annually through tabletop exercises. Following several tabletop exercises and the activation of the Protocol in 2020, the EUCP was revised in 2023 to integrate lessons learned. Main changes in the update include the clarification of the relationship between the voluntary EU Crisis Protocol and the Regulation (EU) 2021/784, in particular Art. 14(5), refined activation criteria, greater focus on interoperability with other crisis response mechanisms, stronger protection of fundamental freedoms, among other through debrief processes, and guidance on the response to bystander footage.Europol has undertaken a central role in the EU Crisis Protocol implementation by managing the coordination of information exchange and communication among relevant stakeholders in a rapid and secure manner.  Recent acts of terrorism in France (Arras, Paris), Belgium (Brussel) and the October 7 terrorist attack by Hamas against Israel have further demonstrated the importance of disrupting the dissemination of terrorist and violent extremist propaganda during, and in the aftermath of, terrorist attacks, while at the same time supporting investigations. Europol hosts targeted tabletop exercises in order to enhance cross-sector collaboration and further advance the EU Crisis Protocol processes.

The new report offers a strategic and top-level summary of the EU drug market, based on a robust understanding of the current drug landscape and emerging threats. It also provides an overview of key developments by drug and outlines actions to address current threats and increase preparedness.The report is the final module of the broader EU Drug Markets: In-depth analysis from the two agencies, their fourth comprehensive overview of illicit drug markets in the EU since 2013.A multifaceted drug market in a globalised worldThe EU retail drug market is estimated to be worth more than EUR 30 billion annually, making it a major source of income for organised crime. Europe occupies a central position in drug supply and trafficking, as evidenced by the large-scale production of cannabis and synthetic drugs within the EU and the huge volumes of cocaine arriving from Latin America.The EU drug market also intersects with other crime areas, such as the trafficking in firearms and money laundering. Some EU Member States are currently experiencing unprecedented levels of drug market-related violence, including killings, torture, kidnappings and intimidation. This often takes place between criminal networks, although innocent people are also victims, increasing the perception of public insecurity.Corruption is also a key threat in the EU, as criminal networks rely on it across all levels of the drug market to facilitate their activities and mitigate risks. Corruption has a corrosive effect on the fabric of society, undermining governance, security and the rule of law.An additional concern is the fact that criminal networks operating in the EU drug market are highly adaptable, innovative and resilient to global crises, instability and significant political and economic changes. Recent examples of such shocks include the COVID-19 pandemic, Russia’s war on Ukraine and the Taliban’s rise to power in Afghanistan. In response, criminal networks have adapted, changing trafficking routes and diversifying their methods.Tackling current threats and boosting resilienceThe new report highlights key areas for action at EU and Member State level to respond to the current threats of the illicit drug market. These include improving monitoring and analysis of drug market-related violence, further prioritising operational activities that dismantle criminal networks, boosting international cooperation, increasing the human and financial resources devoted to operational and strategic response and strengthening policy, public health and safety responses, among others.Ylva JohanssonCommissioner for Home AffairsDrugs damage our health and our society. Drugs cause addiction, overdose and death. And the organised criminal networks trafficking the drugs undermine society with corruption and violence. To counter this dual threat, the EMCDDA and Europol have joined forces in this new report to offer key insights on the EU drug market to inform policy and practice. One critical drug market threat today lies in the exploitation of key logistical infrastructure, particularly seaports. In response, the EU has launched the European Ports Alliance to protect ports from drug trafficking and criminal infiltration and strengthen their resilience. This is just one example of actions under the EU Roadmap to fight drug trafficking and organised crime.Catherine De BolleEuropol’s Executive DirectorCriminal networks infect the very core of our communities, weaving through the fabric of our democracy and economy. They erode trust, fuel violence, and create cycles of addiction and poverty. A vigilant, unified response is needed to safeguard our citizens and society from the omnipresent influence of this invisible enemy. Using Europol, EU Member States can pool resources, exchange criminal intelligence, and coordinate actions to tackle the illegal distribution of drugs.Alexis GoosdeelEMCDDA DirectorViolence and corruption, long witnessed in more traditional drug-producing countries, are now increasingly seen within the EU. Violence can occur at all levels of the market. It is both a by-product and facilitator of the drugs trade – a trade that is often secured through fear and force. Drug-related violence may be driven by organised crime, the personal struggles of users and wider socio-economic issues. We are now at a critical juncture. We need a holistic European approach to tackle this problem through strengthening our communities, building resilience and preventing the recruitment of young people into crime, providing them with long-lasting alternatives.

The EU retail drug market is estimated to be worth at least EUR 30 billion annually and is a major source of income for organised crime. The large-scale production of cannabis and synthetic drugs taking place in the EU or the drug flows of particularly cocaine arriving from Latin America, are examples of how Europe takes a central position in drug production and trafficking.The new Europol and EMCDDA report offers a strategic and top-level summary of the EU drug market, based on a robust understanding of the current drug landscape, organised crime and emerging threats. It is targeted at decision-makers, who develop and implement policies and actions in Europe, as well as at practitioners working in the drugs field and the general public. The report will be the last module of the broader EU Drug Markets: In-depth analysis from the two agencies, their fourth comprehensive overview of illicit drug markets in the EU since 2013.The press conference is open to press, policymakers and stakeholders. It will take place from 15:00-16:00 CET. (14:00-15:00 local time in Portugal). Press conference recording

The action day in mid-February led to the arrests of eight suspects in Belgium and Hungary. Officers in Belgium arrested four Belgian, one French and one Hungarian, while officers in Hungary arrested one Belgian and one Hungarian national. During the raids, authorities seized 16 high-end vehicles, luxury goods including jewellery and luxury watches, digital equipment, and mobile phones, as well as EUR 40 000 in cash. The raid in Belgium led to the identification of three potential victims. Similarly, during the operational activities in Hungary, officers identified and brought several other potential victims of this network to safety. Europol facilitated the exchange of information and provided support during the course of this investigation. Europol also provided operational analysis, operational intelligence and coordinated the operational activities. During the action day, Europol deployed two of its experts to Belgium and one to Hungary to provide analytical and technical support to the national authorities.The case was opened by Eurojust in February 2023 at the request of the Belgian authorities. A Joint Investigation Team was set up between the Belgian and Hungarian authorities with the support of Eurojust in May 2023. One coordination meeting was hosted by the Agency to facilitate judicial cooperation.

According to Spanish authorities, the criminal network fixed football, tennis and table tennis matches in more than 20 countries, including Romania, Bulgaria, Ukraine, Russia and Bolivia. The suspects sold their personal data and betting platform account details to the criminal network. With this information, the kingpins of the organisation would bet massively on predetermined results, defrauding betting houses and obtaining great economic benefits. The investigation unveiled that the criminal organisation had control of over more than 1 500 betting accounts and amassed winnings of an estimated value of EUR 2 million.In parallel, the criminals used sophisticated technology to manipulate livestreams by intercepting satellite signals and capturing feed content. This allowed them to access the live signal ahead of the betting houses and place massive winning bets. The criminal network had also created a complex system to launder the money acquired from gambling. The suspects are now charged with being members of a criminal organisation, defrauding gambling operators and money laundering.Europol deployed two experts in the field to provide on-the-spot assistance, and provided operational coordination and support to the investigation.The operation is the second phase of an investigation that started in 2020 and had already led to the arrest of 22 suspects, including both leaders of the criminal organisation. In total, it has now led to:75 suspects arrested (22 arrests in the first phase and 53 in the second phase);4 house searches;Seizures of EUR 13 000 in counterfeit banknotes, 2 large satellite dishes and signal receivers, 47 bank accounts, 80 telephone terminals, electronic devices, documentation, and cash, as well as parabolic antennas, signal receivers and IT equipment.

Over 180 searches were carried out simultaneously in Albania, Austria, Cyprus, Croatia, Czechia, Estonia, Germany, Hungary, Italy, Malta, the Netherlands, Poland, Portugal, Slovakia, Slovenia, Sweden and the United Kingdom.  Over 680 tax and police investigators supported the investigative measures. During the searches, law enforcement seized vast quantities of smartphones, worth more than EUR 15.3 million, as well as a yacht, worth EUR 3 million, and EUR 1.2 million in cash and cryptocurrency. Several cars were seized, including a Rolls Royce, a BMW and a Range Rover. Jewellery, luxury watches and 2.5 kilograms of gold were also found in the suspects’ residences.   The investigation revealed that the suspected organisers of the VAT fraud scheme created a complex criminal ecosystem, which allowed them to defraud up to EUR 195 million through several criminal schemes involving the sale of small electronic devices, such as smartphones.It is understood that the suspects used fraudulent chains of missing traders, which would vanish without fulfilling their tax obligations.In 2020, the same organisers of these VAT fraud schemes are believed to have entered the market for protective face masks. The company managed by the suspects is understood to have bought them from a missing trader, and channelled them through several buffer companies to disguise their final destination.On paper, their company was based in Hong Kong, but the face masks were actually in a warehouse in Germany, and remained there until the German Federal Ministry of Health purchased them from the company ostensibly based in Hong Kong. According to the investigation, neither the company at the beginning of the supply chain, nor the Hong Kong-based company, reimbursed the VAT they had received upon the sale of the face masks to the Ministry.The arrests are the result of years of special investigative measures carried out by a number of German Tax Investigation Offices in Berlin, Bielefeld, Cottbus, Münster and Nuremberg. This extensive undertaking also counted on the support of Europol and Eurojust. In Germany, these included Police Headquarters (Polizeipräsidium) from Nordhessen and Brandenburg, as well and State Criminal Police Offices (Landeskriminalamt) from Brandenburg and Berlin. Leading up to the action day, Europol provided analytical support to the partners in this investigation. Furthermore, Europol supported the action day by providing over 100 secure communication channels (VCP-Virtual Command Post), deploying a specialist with a mobile office to the operational command centre at EPPO’s headquarters in Luxembourg. The case was opened at Eurojust in 2021 at the request of the German European delegated prosecutor. Seven coordination meetings were hosted by the Agency to facilitate judicial cooperation between the EPPO and national authorities involved in the case. Eurojust facilitated the exchange of information and the execution of several European Investigation Orders and European Arrest Warrants.

A third main suspect, leading another organised crime group (OCG), was arrested in the same operation for defrauding the Italian authorities of EUR 15 million in public funds. These funds were laundered via the same web of myriad enterprises, centred around the financial institution in Lithuania.During an action day on 27 February, around 250 judicial representatives and law enforcement officers were active on the ground. In total 18 persons have been arrested, including the 3 main suspects. In total 55 locations were searched and over EUR 11.5 million in assets and bank accounts have been frozen. Eurojust and Europol played pivotal roles in facilitating and coordinating the international activities.The financial institution offered money laundering as a service to thousands of criminals across the EU by making fictitious financial transactions via the web of enterprises, which were run by strawmen. It advertised its alleged consultancy services online and was set up in Lithuania in 2016 by an Italian-based OCG.The financial institution was led by the two main suspects, who resided in Lithuania and Latvia. The OCG laundered the proceedings of a range of criminal activities, including tax evasion, cyber fraud, fake bankruptcy and organised crime such as drug trafficking. Part of the proceeds were injected into the Latvian and Lithuanian economies via the purchase of real estate and luxury vehicles.The laundered money included the EUR 15 million from unlawfully obtained so-called building bonuses, provided by the Italian national authorities. These bonuses were given for renovation and insulation works and other energy-saving measures of existing buildings. In reality no repairs took place, and the applicants were not the owners or the buildings did not even exist. The main perpetrator of this fraud was a practising tax consultant, who arranged the awarding of bonuses for 72 other individuals who were aware of the abuse.Investigations into the OCG were initiated in 2021 by the Public Prosecutor’s Offices of Naples and Lecce in Italy, involving their counterparts in Latvia and Lithuania in 2022 via Eurojust.In 2022, the financial and judicial authorities in Lithuania already closed down the electronic payment institution. Its banking licence was revoked and bankruptcy procedures were started for non-compliance with money laundering prevention regulations. A rapid reaction of Latvian and Lithuanian authorities to reports on suspicious transactions led to the identification and freezing of millions in funds, real estate properties and luxury vehicles, which now can be confiscated.During the same year, Eurojust supported the setting up and funding of a joint investigation team between all national authorities involved. Eurojust also set up a coordination centre to support the simultaneous actions in the three countries.Furthermore, Eurojust organised eight coordination meetings to prepare for the simultaneous actions of the Italian, Latvian and Lithuanian authorities. These preparations also prevented potential conflicts of jurisdiction. Eurojust has also already facilitated the restitution to Italy of over EUR 3 million of the illegally obtained public funds, which have been frozen by the Lithuanian authorities.Europol has been supporting the case since January 2022, working closely with the national investigators to uncover the magnitude and complexity of the activities carried out by the OCG. During the action day, two Europol experts were deployed to Latvia to support the authorities with their investigative measures. A third Europol specialist was deployed to the coordination centre at Eurojust, with an analyst on hand at Europol’s headquarters to handle the contributions shared via Europol’s secure communication channels.The operations against the OCG are the result of long-term intensive cooperation across Europe of the three countries involved.The Head of Europol’s European Financial and Economic Crime Centre at Europol, Mr Burkhard Mühl, commented: Europol firmly believes that the 'follow the money' approach, coupled with close cooperation between EU law enforcement agencies and Europol, constitutes the most powerful strategy for combatting transnational criminal threats and frauds related to public funds. By pooling resources, expertise, and intelligence, we can effectively disrupt illicit financial flows and dismantle criminal networks.The actions in the three countries were carried out at the request of and by the following authorities:Italy: Public Prosecutor’s Offices of Naples and Lecce; Guardia di Finanza of Naples and LecceLatvia: Prosecutor General’s Office, Rīga Judicial Region Prosecution Office; 1st Unit of the Economic Crime Enforcement Department of the Central Criminal Police Department of the State PoliceLithuania: Vilnius Regional Public Prosecutor’s Office; Vilnius County Police Headquarters

Their Majesties the King and Queen of the Belgians have visited Europol today in The Hague, the Netherlands, where they heard about the Agency’s work in helping EU Member States fight serious and organised crime across Europe.Europol’s Executive Director Catherine De Bolle welcomed their Majesties, who were accompanied by the Belgian Minister of the Interior Annelies Verlinden.Their Majesties and the delegation toured Europol’s Operational Centre, which provides round-the-clock support to over 2 600 law enforcement authorities connected to Europol’s secure channels.Their Majesties were briefed on Europol’s latest investigations into Europe’s most threatening criminal networks. In 2023, Europol supported 3 155 investigations into high-level organised crime and produced over 23 000 operational reports.The King and Queen of the Belgians also heard about the challenges associated with investigating child sexual abuse online. Europol emphasised that sustainable solutions must be found to facilitate the flow of information to prevent this heinous crime. Their Majesties visited Europol’s forensic cybercrime laboratory.Finally, the King and Queen of the Belgians met with the Belgian community at Europol. Some fifty Belgian nationals are currently working across the organisation. Belgium is holding the Presidency of the Council of the European Union until 30 June 2024. The Belgian Presidency has put forward different priorities that are of direct importance to the work of Europol. Tackling large-scale organised crime networks is one such priority. 

The action day on 21 February led to:19 arrests in Germany (7 under Belgian judicial order and 12 under French judicial order)5 High Value Targets (the leader and the main organisers) arrested28 locations (19 houses and 9 storage places) searched in GermanySeizures include: 24 inflatable boats, 175 life vests, 81 flotation devices for children, 60 air pumps, 13 outboard mounts, 14 engines, almost 60 electronic devices, arms and several thousand euros in cashThe investigative activities, initiated at the end of 2022, identified the structure and modi operandi of this large criminal network, made up of Iraqi and Syrian nationals of Kurdish origin. The suspects, all based in Germany, organised the purchase, storage and transportation of inflatable boats for their subsequent use to smuggle migrants from the beaches near the French city of Calais towards the UK. The migrant smuggling network was highly professional. The suspects had set up their own logistical infrastructure with specific branches in charge of organising the delivery of large amounts of nautical equipment to the EU.Drivers, who were typically active members of the criminal network, transported up to 8 boats at a time. During the transportation from Germany to France, a forerunner car secured the vehicle charged with boats, aiming to avoid police detection. The drivers were located in rest areas in Belgium before they drove the equipment to the spot at the time of departure. The investigative activities identified that the criminal network was able to facilitate up to 8 departures per night depending on the weather conditions.Between EUR 1 000 and EUR 3 000 for a spot in a boatThe smugglers used low quality boats, mainly originating from China, transported via Turkey to Germany. The legal purpose of these boats may include fishing or sailing on rivers and city canals. When used legally, such boats would not be suitable nor safe for the transportation of more than 10 individuals. However, on average, smugglers put around 50 migrants in one of these boats. In total, the investigators have gathered evidence linking at least 55 departures that were facilitated solely by this smuggling network. The suspects collected between EUR 1 000 and EUR 3 000 per migrant for a place on the dangerous vessel. Further investigative activities are ongoing into the individuals managing the financial and money laundering activities for the criminal network.Migrant smuggling; a continuously deadly threatThe migrant smuggling activities via small boats have continuously increased since 2019, before becoming in 2021 the most commonly used modus operandi for smuggling migrants from the EU to UK, surpassing smuggling in lorries. The criminal networks involved in the phenomenon remain extremely active, and are becoming increasingly violent while adapting their activities through the implementation of new crossing techniques. In parallel, the strengthened law enforcement measures led to a significant decrease of over 30% fewer incidents and migrants smuggled in the 2023 in comparison to 2022. In 2023, law enforcement authorities detected almost 61 000 (as compared to about 79 000 in 2022) irregular migrants attempting to cross the English Channel in small boats. However, during the same year, 30,000 irregular migrants (compared to over 47 000 in 2022) and 600 boats (compared to 1 100 in 2022) managed to reach the UK. Dedicated Task Force at Europol to connect the dotsFollowing the successful outcome of the Operational Task Force Dune in July 2022, which led to the dismantling of the largest (at the time) network smuggling migrants from France to the UK via small boats, Europol set up a second Operational Task Force. OTF Wave targets migrant smuggling activities across the English Channel, a criminal phenomenon putting migrants’ lives at great risk. OTF Wave, coordinated by Europol, involves Belgium, France, Germany, the Netherlands and the UK. OTF Wave targets the full chain of smuggling activities – from the recruitment of migrants through to the logistical cells and up to the main organisers. The investigative activities focused on five High Value Targets, as the prosecution of these suspects is instrumental in dismantling the criminal organisation as a whole. The dedicated Europol experts, who were fully involved in the work of the OTF, contributed to the identification of criminal connections between several national investigations.The work of the national authorities’ members of OTF Wave was also enabled by the dedicated investigation cell (URO/CIC), set up by France and the UK, to specifically target migrant smuggling via small boats. Europol has a permanent deployment attached to this cell since its creation, in the aftermath of the tragedy unfolding in the English Channel in November 2021.Europol has established a dedicated financial instrument to facilitate such high-profile investigations. Under OTF Wave, Europol made over EUR 120 000 available to the participating countries to manage various aspects of their investigative work. Europol managed the overall coordination of investigative activities, while also organising over 10 operational meetings between the members of the taskforce.During the action day, Europol facilitated the deployment of 10 investigators from Belgium and 33 from France to several locations in Germany. In addition to these coordination activities, Europol deployed two Europol experts to the coordination centre in Cologne to assist the German authorities in cross-checking, in real time, operational information against Europol’s databases. The experts also performed digital forensics and supported the investigators in the field.Active judicial cooperation by Eurojust to ensure compliance of legal procedureEurojust enabled the cross-border judicial cooperation. Three coordination meetings were organised to compile and exchange the existing information, to explore how to best cooperate without jeopardising each other's investigations and to prepare for the joint action day. With the support of Eurojust National Desks, judicial authorities exchanged European Investigation Orders and European Arrest Warrants, and they carefully ensured that all legal instruments were in place to take action.During the action day, the agency set up a coordination centre to facilitate the rapid cooperation between the judicial authorities. At the coordination centre, each participating country was represented by a member of its National Desk. Coordination centres provide a central hub for the real-time exchange of information during an operation, including the results of searches and interceptions. They also facilitate the quick resolution of any complex legal issues that may arise during the action.Law enforcement authorities involved in the action day:Belgium: Federal judicial Police of West-FlandersFrance: French Border Police (OLTIM-Antenne de Coquelles)Germany: German Federal Police (Bundespolizei)Judicial authorities involved in the action day:Belgium: Investigative Judge of West-Flanders, section Bruges; Federal Prosecutors’ OfficeFrance: JIRS Lille (Interregional Specialised Jurisdiction) - Court of LilleGermany: General Public Prosecutor`s Offices Düsseldorf, Hamm, Köln, Naumburg; Public Prosecutor`s Office Bonn.For media inquiries:Europol: 24/7 media line: +31 (0)70 302 5001; press@europol.europa.euEurojust:Eurojust Press Team, + 31 70 412 55 00media@eurojust.europa.euBelgium: Federal PPO, Eric Van der Sypt, federal magistrate+32 485 53 25 20 ; FPF.press@just.fgov.beFrance: Court of Lille (Tribunal Judicaire de Lille)+33 6 18 17 81 58 ; presse.pr.tj-lille@justice.frGermany:Jens Floeren, +49 (0) 173 5425845  +49 (0) 2241 / 238 – 5555; bpold.sanktaugustin.oea@polizei.bund.

A large-scale operation involving law enforcement and judicial authorities from Belgium, France and Germany and coordinated by Europol and Eurojust, has led to the dismantling of one of the most active networks involved in the smuggling of migrants across the English Channel in small boats. The investigation focused on an Iraqi-Kurdish network suspected of smuggling middle-Eastern and East African irregular migrants from France to the UK with the use of low quality inflatable boats. German authorities raided houses and storage spaces. This resulted in the arrest of more than 15 individuals under Belgian and French judicial orders following a year and a half long joint investigation under Europol’s OTF Wave. The full press release about the case will be published on 22 February.Involved law enforcement authorities:Belgium: Federal judicial Police of West-Flanders France: French Border Police (OLTIM-Antenne de Coquelles)Germany: German Federal Police (Bundespolizei) Involved judicial authorities:Belgium: Investigative Judge of West-Flanders, section Bruges; Federal Prosecutors’ Office France: JIRS Lille (Interregional Specialised Jurisdiction), Court of LilleGermany: General Public Prosecutor`s Offices Düsseldorf, Hamm, Köln, Naumburg; Public Prosecutor`s Office Bonn.

Three individuals, suspected of being the ringleaders of the fraud scheme, were arrested in Germany. During the searches, carried out in several locations across Germany (including Munich, Cologne and Rostock) and Italy, over 40 expensive vehicles and a luxury apartment in Munich were seized. In addition, several bank accounts, valuing over EUR 1.2 million were frozen. Law enforcement seized cash in several currencies, as well as luxury watches, jewellery and several luxury bags found in the suspects’ residences. Officers on the scene found a robot used to print signatures in invoices and discovered a weapon. The suspects are believed to have used German companies to fraudulently export cars – both used and new – from Germany to other EU Member States. To that end, they allegedly relied on an intra-community VAT ‘carousel’ fraud. This complex criminal scheme takes advantage of EU rules on cross-border transactions between Member States, as these are exempt from value-added tax (VAT). VAT fraud, or Missing Trader Intra-Community (MTIC) fraud, is a highly profitable crime that results in billions of euros in annual tax losses for Member States.According to the evidence, the suspects purchased vehicles on a large scale from various German car dealers, and then used a network of shell companies and forged invoices to simulate that the cars were being sold in other Member States so as to evade the payment of VAT. There are reasonable grounds to believe that the vehicles were delivered to missing trader companies, often located in Italy. According to the investigation, more than 200 of the companies that appeared on invoices as buyers of the vehicles are in fact missing traders who do not fulfil their tax obligations in their country. In some instances, it is also suspected that the vehicles were being kept in Germany.The investigation counted on the support of Europol, Germany’s Tax Investigation Offices in Munich (Finanzamt München – Steuerfahndungsstelle) and Hagen (Finanzamt für Steuerstrafsachen und Steuerfahndung Hagen), the Police of Hagen and the Italian Financial Police (Guardia di Finanza) in Prato, Tuscany. The searches, carried out simultaneously in Germany and Italy, were conducted by hundreds of officers from the Tax Investigation Offices in Germany, the Bavarian and North Rhine-Westphalian police forces, including a special police command (SEK) and the Italian Financial Police. Leading up to the action day, Europol provided analytical support to the partners in this investigation. Furthermore, Europol supported the action day by providing over 80 secure communication channels (VCP-Virtual Command Post), deploying four Universal Forensics Extraction Devices (UFEDs) to the action sites, and deploying a specialist with a mobile office to the operational command centre in Germany.

During the action day, over 460 police officers were deployed to carry out the searches. Germany also deployed four officers to support the investigations and searches in Latvia and Malta. In addition to the arrests, various bank accounts and properties were seized.The Maltese financial institution laundered at least EUR 4.5 million in proceedings from criminal activities since end of 2015. The total sum of laundered money could amount to tens of millions of euros. The financial institution and organised crime group (OCG) behind it offered money-laundering services via a network of fake enterprises and individuals who were registered directors, without performing any real business activities. The OCG operated mainly from Riga and Berlin. Investigations were initiated in 2021 by the Latvian authorities after they noticed unusual money transfers from Latvia to the Maltese financial institution. Simultaneously, the German authorities had started investigations into suspicious money flows involving the same financial institution.On the action day, Europol deployed a money laundering expert to Latvia and set up a mobile office at Eurojust’s coordination centre to support the operation. Since December 2021, Europol has been supporting the investigation by providing operational and financial analysis and operational expertise. The agency also supported the joint investigation team and provided financial support to the case. Eurojust supported yesterday’s concerted action by setting up a coordination centre and establishing and funding a joint investigation team between the German and Latvian authorities. The agency also organised five dedicated coordination meetings to prepare for the action day and assisted with the execution of European Investigation Orders in the countries involved. The operations were carried out by the following authorities:Estonia: Office of the Prosecutor General of the Republic of Estonia, Estonian Police and Border Guard BoardFrance: Public Prosecutor’s Office and Investigative Judge – Judicial Court of Nice; National Police (DIPN) Alpes-Maritimes Division (Judicial Police Nice; Research and Intervention Brigade; Financial Brigade) - Border PoliceGermany: Public Prosecutor‘s Office Berlin (Staatsanwaltschaft Berlin), State Office of Criminal Investigations Berlin (Landeskriminalamt Berlin)Italy: Public Prosecutor’s Office Rome, Guardia di Finanza, Financial Police Unit Rome (Nucleo Polizia Economica e Finanziaria di Roma)Latvia: Rīga Northern Prosecution Office, Rīga Judicial Region Prosecution Office, 1st Unit of the Economic Crime Enforcement Department of the Central Criminal Police Department of the State PoliceMalta: Malta Police Financial Crimes Investigations Department, Asset Recovery Bureau 

LockBit is widely recognised as the world’s most prolific and harmful ransomware, causing billions of euros worth of damage.This international sweep follows a complex investigation led by the UK's National Crime Agency in the framework of an international taskforce known as ‘Operation Cronos’, coordinated at European level by Europol and Eurojust.The months-long operation has resulted in the compromise of LockBit’s primary platform and other critical infrastructure that enabled their criminal enterprise. This includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States and the United Kingdom.In addition, two LockBit actors have been arrested in Poland and Ukraine at the request of the French judicial authorities. Three international arrest warrants and five indictments have also been issued by the French and U.S. judicial authorities.Authorities have frozen more than 200 cryptocurrency accounts linked to the criminal organisation, underscoring the commitment to disrupt the economic incentives driving ransomware attacks.The UK's National Crime Agency has now taken control of the technical infrastructure that allows all elements of the LockBit service to operate, as well as their leak site on the dark web, on which they previously hosted the data stolen from victims in ransomware attacks.At present, a vast amount of data gathered throughout the investigation is now in the possession of law enforcement. This data will be used to support ongoing international operational activities focused on targeting the leaders of this group, as well as developers, affiliates, infrastructure and criminal assets linked to these criminal activities. The world’s most harmful ransomware LockBit first emerged at the end of 2019, first calling itself ‘ABCD’ ransomware. Since then, it has grown rapidly and  in 2022 it became the most deployed ransomware variant across the world.The group is a ‘ransomware-as-a-service’ operation, meaning that a core team creates its malware and runs its website, while licensing out its code to affiliates who launch attacks.LockBit’s attack presence is seen globally, with hundreds of affiliates recruited to conduct ransomware operations using LockBit tools and infrastructure. Ransom payments were divided between the LockBit core team and the affiliates, who received on average three-quarters of the ransom payments collected.The ransomware group is also infamous for experimenting with new methods for pressuring their victims into paying ransoms. Triple extortion is one such method which includes the traditional methods of encrypting the victim's data and threatening to leak it, but also incorporates Distributed Denial-of-Service (DDoS) attacks as an additional layer of pressure.The gang's move to triple extortion was partly influenced by a DDoS attack they themselves experienced, which impeded their ability to publish stolen data. In response, LockBit enhanced their infrastructure to resist such attacks.This infrastructure is now under law enforcement control, and more than 14 000 rogue accounts responsible for exfiltration or infrastructure have been identified and referred for removal by law enforcement.Europol’s coordinating role With countries involved on either side of the world, Europol – which hosts the world’s biggest network of liaison officers from EU Member States – played a central role in coordinating the international activity.Europol’s European Cybercrime Centre (EC3) organised 27 operational meetings, and four technical one-week sprints to develop the investigative leads in preparation of the final phase of the investigation.Europol also provided analytical, crypto-tracing and forensic support to the investigation, and facilitated the information exchange in the framework of the Joint Cybercrime Action Taskforce (J-CAT) hosted at its headquarters. In addition, three Europol experts were deployed to the command post in London during the action phase.In total, over 1 000 operational messages have been exchanged on this case via Europol’s secure information channel SIENA, making it one of EC3’s most active investigations.The case was opened at Eurojust in April 2022 at the request of the French authorities. Five coordination meetings were hosted by the Agency to facilitate judicial cooperation and to prepare for the joint action.Decryption tools available on No More Ransom With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit Ransomware.These solutions have been made available for free on the ‘No More Ransom’ portal, available in 37 languages. So far, more than 6 million victims across the globe have benefitted from No More Ransom which contains over 120 solutions capable of decrypting more than 150 different types of ransomware.  Report it to the policeThis investigation shows that law enforcement has the capabilities to disrupt high harm cybercriminals and reduce the ransomware threat. However, continued victim and private sector engagement is key to us continuing this work.The first step to putting cybercriminals behind bars is to report cybercrime when it happens. The earlier people report, the quicker law enforcement is able to assess new methodologies and limit the damage they can cause.Reporting cybercrime can be as simple as clicking a button on a web browser. Europol has compiled a list of the reporting websites in EU Member States.Robust cybersecurity measures are also key. Europol has put together some tips and advice on how to prevent ransomware from infecting your electronic devices. Taskforce Operation CronosThis activity forms part of an ongoing, concerted campaign by the international Operation Cronos taskforce to target and disrupt LockBit ransomware. The following authorities are part of this taskforce: France: National Gendarmerie (Gendarmerie Nationale – Unité nationale cyber C3N)Germany: State Bureau of Criminal Investigation Schleswig-Holstein(LKA Schleswig-Holstein), Federal Criminal Police Office (Bundeskriminalamt)The Netherlands: National Police (Team Cybercrime Zeeland-West-Brabant, Team Cybercrime Oost-Brabant, Team High Tech Crime) & Public Prosecutor’s Office Zeeland-West-BrabantSweden: Swedish Police AuthorityAustralia: Australian Federal Police (AFP)Canada: Royal Canadian Mounted Police (RCMP)Japan: National Police Agency (警察庁)United Kingdom: National Crime Agency (NCA), South West Regional Organised Crime Unit (South West ROCU)United States: U.S. Department of Justice (DOJ), Federal Bureau of Investigation (FBI) NewarkSwitzerland: Swiss Federal Office of Police (fedpol), Public Prosecutor's Office of the canton of Zurich, Zurich Cantonal PoliceThe successful action was made possible thanks to the support of the following countries:Finland: National Police (Poliisi)Poland: Central Cybercrime Bureau Cracow (Centralne Biuro Zwalczania Cyberprzestępczości - Zarząd w Krakowie)New Zealand: New Zealand Police (Nga Pirihimana O Aotearoa)Ukraine: Prosecutor General`s office of Ukraine (Офіс Генерального прокурора України), Cybersecurity Department of the Security Service of Ukraine (Служба безпеки України), National Police of  Ukraine (Національна поліція України)

On 6 February, a Spanish-led investigation involving Ecuador and supported by Europol, resulted in a major hit on a high-risk drug trafficking network supplying cocaine to the EU. To support the field activities on the action day, Europol deployed two experts to coordination centres set up in Marbella, Spain and Quito, Ecuador. Europol also funded the deployment of two Spanish investigators to Ecuador to enable further coordination between the national authorities on the ground in Ecuador and Spain.The joint action day in Spain and Ecuador led to:31 arrests (13 in Spain and 18 in Ecuador);2 High Value Targets arrested;66 location searches (22 in Spain and 40 in Ecuador);Seizures included: 25 vehicles, 10 firearms, electronic equipment estimated at about EUR 13 million and almost EUR 3 million cash in various currencies, including euros;Property frozen for a total value of about EUR 48 million (EUR 12 million in Spain and EUR 36 in Ecuador).Tonnes of cocaine shipped under fruit coverLaw enforcement authorities initiated an investigation into an Italian businessman of Argentinian origin residing in Marbella. Further investigations revealed that these companies were used to conceal both criminal activities and financial transactions. Authorities identified the businessman's criminal association with an Albanian national based in Ecuador. The Albanian national orchestrated the importation of cocaine from Colombia to Ecuador and its subsequent distribution to the EU. Operational information indicates that the businessman had a contractual agreement with Colombian suppliers to receive 4 tonnes of cocaine monthly in Ecuador.The organisation employed Ecuadorian fruit companies as a front to import cocaine into the EU, utilising various shipping methods. Frequently, smaller quantities of cocaine were concealed within banana shipments, ranging from 15 to 40kg. Despite the varying quantities, the company consistently denied any involvement in the trafficking activities. The organisation arranged the transportation of the large cocaine shipments from the port of Guayaquil towards the port of Algeciras and other European ports.During the course of the investigation, law enforcement authorities in Albania, Belgium, Ecuador, Netherlands and Turkey seized several sizable shipments of cocaine totalling 3.2 tonnes. The leader of the criminal network played a pivotal role in laundering the criminal assets through investing in legal businesses in Spain. He managed several companies, including one focused on the production and importation of bananas from Ecuador to the EU, as well as sports centres in Marbella, commercial centres in Granada, and multiple bars and restaurants. Many of his main associates had strong ties to the Western Balkans and handled the distribution network, which was widespread across Europe.The operation targeted the two leaders (High Value Targets) of this criminal network. Both leaders had been orchestrating the drug trafficking and laundering the substantial criminal proceeds into the legal economy through the purchase of property, luxury vehicles and goods. So far, investigators have connected the targets to financial transactions totalling EUR 48 million across Ecuador and Spain.Europol facilitated the exchange of information and provided support during the course of this joint investigation. Europol also provided operational analysis, operational intelligence and coordinated operational activities. Europol’s Executive Director Catherine De Bolle said:Cocaine trafficking is a threat, not only to the health of Europeans and our economy, but also to the security of our neighbourhoods, as gang violence is becoming increasingly visible in our communities. This joint action day is a textbook example of how an international coalition of law enforcement agencies, coordinated by Europol, can successfully disrupt global and organised criminal activities. In October, I signed a Working Arrangement with Ecuador to increase our information exchange, especially in the area of cocaine trafficking. Today’s joint operation between Ecuador and Spain, supported by Europol, is a firm statement of our shared determination to take down the drug cartels from their local operating cells to their core.     Europol initiated this cooperation with Ecuador, one of the main transit hubs for cocaine shipments to the EU. The common efforts to combat these large-scale criminal activities resulted in the signature of a Working Arrangement between Europol and Ecuador in October 2023. This new framework enhances the cooperation between law enforcement authorities from EU Member States and their Ecuadorian counterparts in the joint fight against multinational drug cartels. Funding through EU financial mechanismsOfficers from the Spanish National Police and Spanish Customs, supported by Europol, carried out these joint operations in partnership with Ecuador in line with the EU Security Union Strategy. The EU Security Union Strategy focuses on four main points: a future-proof security environment, tackling evolving threats, protecting Europeans from terrorism and organised crime, and a strong European security ecosystem. To reach these goals, the European Commission’s DG HOME, EU agencies and dedicated EU funding including the Internal Security Funds, support EU Member States in tackling criminal threats through coordinated operations that target criminal networks and their business models. The actions conducted within this framework have received co-financing from the European Union as part of the support provided to EU Member States in combating criminal networks posing the most significant threats to the safety and security of EU citizens and the EU as a whole.  High-value fugitive arrested | Update 23 June 2025A high-value fugitive, on the run since the action day in February 2024, was arrested in Abu Dhabi in May of this year. He is believed to be the leader of the criminal organisation.His arrest was made possible through close cooperation between the Spanish National Police and the authorities of Ecuador and the United Arab Emirates, with support from Europol and INTERPOL.The fugitive is suspected of personally coordinating the group’s drug trafficking operations — maintaining direct contact with Colombian cocaine suppliers and overseeing the transport and safekeeping of the illicit goods from Colombia to Ecuador. There, his associates, who held influence at the port of Guayaquil, loaded the drugs into containers operated by fruit-exporting companies under his control.Once the drug-laden containers reached European ports, the fugitive allegedly resumed command, instructing trusted contacts to extract the cocaine, store it, and arrange its onward distribution to final buyers.Spanish judicial authorities have now requested his extradition so that he can face proceedings in Spain.

Europol supported this wide-reaching operation with several operational meetings and the deployment of specialists with mobile offices offering analytical and forensic support. Operation SHIELD’s 2023 edition was led by a steering group composed of Italian, French, Greek and Spanish law enforcement authorities.  The trafficking of pharmaceuticals is a growing issue in the European Union and beyond. The investigations under SHIELD IV have highlighted a pattern of large scale trafficking which is highly lucrative for organised crime, which in turn incentivises more criminal groups to enter the trade. This crime area inflicts significant costs for the health and social care systems of EU Member States, as well as alarming effects on public health.Illegal vendors continue to advertise doping substances on social media, mostly targeting non-professional athletes and members of restricted or private sport groups. Along with performance-enhancing products, medicines for erectile dysfunction are offered via dubious channels online and remain among the most seized counterfeits by law enforcement. Unregulated use of medicines and doping substances, especially of counterfeit products, can cause serious and irreversible bodily harm.Results of Operation SHIELD IV1 284 individuals charged (296 arrests and 988 under prosecution) 52 organised crime groups investigatedTotal seizures worth above EUR 64 million, including: 636 263 illegal packages of illegal pharmaceuticals69 255 kilograms of powders and raw material11 551 litres of active ingredient121 503 vials and ampoules over 12 million tablets and pills 4 underground labs dismantled92 websites shut down3 935 inspections carried out4 321 anti-doping “in competition” controls carried out3 659 anti-doping “out competition” controls carried outHighlights of Operation SHIELD IVTrafficking of unauthorised pharmaceuticals and medical devices targeted in GreeceGreek authorities dismantled a criminal network which had been trafficking unauthorised pharmaceuticals and medical devices since 2019. The products included counterfeit botox and vitamin acid preparations used in cosmetic surgery. The criminals’ customer base of these counterfeits covered various regions of the country. The seized products were imported via couriers or transported by a member of the group from Turkey and Poland.San Marino underground lab uncovered by Italian authoritiesThe Italian authorities searched the logistical base of a criminal group operating from San Marino. Investigators identified a rural underground lab set up for the production, labelling and packaging of doping products. Police seized vast quantities of doping substances in the form of vials, tablets, capsules, bottles and packaging, all intended for sale in Italy as well as around EUR 180 000 in cash. The suspect allegedly imported pure Nandronole, an anabolic steroid classified as a narcotic drug in Italy. His trafficking routes spanned all over Europe and as far as China.Misuses of medicinesThe consumption of medications beyond medical oversight remains a persistent social issue. The reasons for use vary from psychotropic and recreational purposes to performance-enhancing effects. Some users disregard medical prescriptions and inject non-injectable products (such as sublingual pills, patch contents, or eye drops) or resell medicines prescribed for medical treatment.The excessive consumption of medications nurtures a demand that cannot be satisfied through legal means, leads to diversion from the regulated supply chain. Counterfeit medicines are circulated among those diverted from the legitimate chain. Authorities have seen these counterfeit medications re-enter the legal supply chain through the parallel market. One increasing trend is the traffic of sedatives and the use of counterfeit or illegal medicines for diabetes.Medicines are often counterfeited in underground laboratories without any regulation or safety measures in place. Counterfeit products created under such circumstances do not produce the desired effect; in the best case scenario the patient remains untreated, however such products can cause serious health issues or be potentially lethal.Operation SHIELD IV Steering Group:Italian Carabinieri Anti-Adulteration and Public Health Units (Nuclei Antisofisticazione e Sanità dell’Arma dei Carabinieri) French Law Enforcement Directorate for Environment and Public Health (Commandement pour l'Environnement et la Santé - CESAN) Hellenic Police - Financial Police Division (oικονομική υπηρεσία της ελληνικής αστυνομίας) Spanish Civil Guard (Guardia Civil) Participating countries:Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, France, Germany, Greece, Hungary, Ireland, Italy, Lithuania, Poland, Portugal, Romania, Slovak Republic, Slovenia, Spain, Albania, Bosnia Herzegovina, Colombia, Georgia, Iceland, North Macedonia, Norway, Serbia, Switzerland, United Kingdom, United StatesParticipating agencies:EUIPO, Eurojust, Europol, Frontex, INTERPOL, OLAF, WADA

On 7 February, two suspects were arrested in Malta and Nigeria in the framework of the operation. The suspects are accused of selling the malware and supporting cybercriminals who used the malware for malicious purposes. Europol provided analytical support to the investigation which led to the operation involving Australia, Canada, Croatia, Finland, Germany, Malta, the Netherlands, Nigeria, Romania and the United States. These countries provided valuable assistance securing the servers hosting the Warzone RAT infrastructure. The Warzone RAT malware, a sophisticated Remote Access Trojan (RAT), was on sale via internet domains. The RAT malware enabled cybercriminals to browse victims’ file systems, take screenshots, record keystrokes, steal victims’ usernames and passwords, and watch victims through their web cameras, all without the victims’ knowledge or permission.Avoid RAT-ingThe public and businesses can follow simple steps to help protect themselves from malware:Update your software, including anti-virus software;Install a good firewall;Don’t open suspicious email attachments or URLs – even if they come from people on your contact list;Create strong passwords.Find out how to protect yourself against Remote Access Trojans.

The Carabinieri Anti-Money Counterfeiting Command of Rome initiated the investigation into this criminal network in September 2020. This uncovered that the suspected members had allegedly facilitated illegal immigration through the production and dissemination of fake driving licences, registration documents, and national identification documents. The criminal network is also suspected of forging and trafficking foreign currency banknotes.Faking EU IDs and Congolese francsThe criminal group was particularly active in Italy and Malta, where they disseminated large quantities of blank false passports to irregular migrants from sub-Saharan and Middle Eastern countries. The forged documents, which were of particularly high quality, enabled the migrants to board flights from Malta and Italy towards a number of destinations in Western Europe. Authorities seized many of these forged documents in Belgium, Switzerland, France and Italy.The investigation also uncovered that the criminal group was involved in a number of other criminal activities, including the concealment of stolen vehicles and the production of large quantities of counterfeit 20 000 Congolese franc notes. It is estimated that counterfeit banknotes with a total value of 54 million Congolese francs (about EUR 18 000) were produced with the intention of being introduced into the in the financial system of the Democratic Republic of the Congo.Europol’s supportEuropol supported this investigation by facilitating information exchange, coordinating operational activities and providing tailored operational analytical support. During the action day, Europol deployed two experts to Italy – one specialist in migrant smuggling and one in currency counterfeiting – to support the field activities by crosschecking the operational information collected in real-time. Europol also provided operational analysis to help deliver possible leads to investigators on the ground. 

Initial investigations against the OCG were launched in 2019 by the Public Prosecutor’s Office (PPO) of Florence – District Antimafia Directorate. From January 2020, the Italian and Albanian authorities of the Special Anti-Corruption Structure (SPAK) in Tirana contacted Eurojust to coordinate cross-border judicial cooperation against this complex network. It operated from both Albania and Italy, transporting drugs by car to Spain and Germany, while other suspects were based in the Netherlands and the United Kingdom. Judicial cooperation with Albania is facilitated by Eurojust, as it is one of the 11 countries outside the EU that has a Liaison Prosecutor at the Agency. At request of the Italian and Albanian authorities, Eurojust supported the creation of dedicated joint investigation teams between the PPO of Florence and SPAK and provided financial, logistic and operational support.The Agency organised coordination meetings to prepare for today’s major action. It also set up a coordination centre to enable judicial cooperation with all national authorities involved during the action day. Europol has been supporting the case since 2020. Its experts provided extensive analytical support and expertise on Albanian organised crime, enabling the identification of key targets and the mapping of their criminal activities across Europe. Two Europol officers were deployed on the ground in Albania and Italy during the action day to support the national authorities in their investigative measures. The operation was carried out on the ground at the request of and with support from the following authorities:Italy: Public Prosecutor’s Office of Florence; Carabinieri Corps with the support of the Italian Ministry of Internal Affairs – International Police Cooperation Service (SCIP) Albania: National Public Prosecutor’s Office – Special Anti-Corruption Structure (SPAK); Albanian State Police, General Directorate Germany: Public Prosecutor General's Office in Naumburg; Public Prosecutor’s Office in Dessau-Roßlau; State Criminal Office MagdeburgSpain: Antidrug Public Prosecutor’s Office at Audiencia Nacional; Central Court num.4 at Audiencia Nacional in collaboration with Investigative Court num.2 of Barcelona; FAST Spain of Policia NacionalUnited Kingdom: The National Extradition Unit (NEU) of the Joint International Crime Centre’s (JICC)