51 arrests in wide-scale operation to take down encrypted communication platform used by organised crime groups

Source: Eurojust

Investigations into the communication platform started when authorities were alerted of a new encrypted service being used in Sweden, France, Spain and the Netherlands. Due to servers being located in France, French authorities started investigations into the platform. The platform’s robust encryption made it ideal for criminal networks to use for their activities. It was mostly used for drug trafficking but also for other criminal activities, such as arms trading, homicide, robbery, kidnapping, and money laundering.

The communication platform is a fully anonymised service. Users can purchase the solution without any personal information. The platform uses three encryption standards and offers the option to send a message followed by a specific code that results in the self-destruction of all messages on the target phone. By using multiple private servers around the world, third party or government agencies have difficulty tracking the communication solution.

As servers were found in France and Iceland, the platform was administered from Australia and Canada, and financial assets were located in the United States, a global operation against the phone service started. A joint investigation team (JIT) between authorities from France and the United States was set up at Eurojust, the second-ever JIT with the United States. This allowed them to exchange information and evidence in real time. Authorities from the Netherlands, Sweden, Canada and Australia were also involved in the investigations. Through coordination among the authorities, hosted by Eurojust, a strategy to take down the encrypted phone solution was defined.

To facilitate investigations into the illegal activities using this communication platform, an Operational Taskforce (OTF) was established at Europol in March 2022 involving law enforcement authorities from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden and the United States.

A Joint Operational Centre was also established at Europol’s headquarters, where representatives from the OTF members and Europol’s officers provided support and facilitated the coordination of the simultaneous operational activities taking place around the globe.

The investigations culminated in a number of joint action days taking place across the globe against the phone service. 38 suspects were arrested in Australia, 11 in Ireland, one in Italy and one in Canada. A drug lab was dismantled in Australia and weapons, drugs and over EUR 1 million euro is cash was seized globally so far. Further actions are expected as the investigation progresses.

The following authorities were involved in the actions:

  • France: Cybercrime unit Prosecutor’s office – JUNALCO (National Jurisdiction against organised crime); Gendarmerie Nationale – C3N Cybercrime Unit
  • Netherlands: National Police
  • Sweden: Swedish Prosecution Authority; Swedish Police Authority
  • Australia: The Office of the Director of Public Prosecutions
  • Canada: Public Prosecution Service of Canada
  • Iceland: Director of Public Prosecution; National Commissioner of the Icelandic Police; Reykjavik Metropolitan Police
  • United States: Department of Justice; Federal Bureau of Investigation

Eurojust supports searches into bribery and money laundering

Source: Eurojust

Investigations into corruption, trading and the influencing and bribery of foreign public officials have led to 13 searches across France, Spain and the Netherlands. A multinational company is being investigated for possible corruption and money laundering involving civilian and military equipment.

French authorities have started multiple investigations into the company. The first investigation, opened at the end of 2016, concerns the sale of defence material and the construction of a naval base, around which there are suspicions of corruption.

A second investigation, opened in June 2023, concerns the suspected corruption and influencing of foreign public officials linked to the sale of civilian and military equipment abroad.

As the company has subsidiaries in Spain and the Netherlands that needed to be searched, Eurojust helped connect the French authorities with the Spanish and Dutch authorities. Eurojust ensured swift cooperation between the authorities by organising a coordination centre. The coordination centre was set up for the execution of mutual legal assistance requests sent by France as well as to relay and solve any urgent issues arising amongst the three countries during an action day held on 26 June. The action day led to 15 searches at several of the subsidiaries in France, Spain and the Netherlands. The searches were undertaken by over 80 officers, including 65 in France, 8 in Spain and 12 in the Netherlands.

The authorities involved in the actions were as follows:

  • France: National Financial Public Prosecution Office (PPO); Central Office against corruption and tax fraud.
  • Netherlands: National Office for Serious Fraud, Environmental Crime and Asset Confiscation; Fiscal Information and Investigation Service
  • Spain: Anticorruption Public Prosecution Office (PPO); Central Court number 3 at the Audiencia Nacional; Judicial National Police Unit attached to the Anticorruption PPO

Actions taken to stop Romanian human trafficking network

Source: Eurojust

An ongoing investigation led by the Romanian authorities confirmed that, in order to obtain important material benefits, the OCG members have been committing offences of trafficking in human beings, pimping and money laundering, since at least January 2022.

The victims from disadvantaged backgrounds were recruited in Romania and subsequently transported to France for the purpose of sexual exploitation. The recruitment and control of the victims involved various forms of coercion, including threat, force and deception.

The suspects executed most of their activities from Romania, travelling to France only for short periods. Through profiles on a website, they coordinated their activities and were in touch with their clients.

Different short-term rental apartments in France, mostly located in Lyon, were used for their activities. The proceeds of the sexual exploitation were sent to the leaders of the group in Romania and laundered through different investments.

With the support of Eurojust, connections between Romanian and French investigative authorities were made, bringing prosecution to the next phase.

The cooperation between the authorities led to a joint action day on 3 July, coordinated by Eurojust. In Romania, 14 locations were searched and vehicles and money were also seized. Furthermore, bank cards which belonged to victims were found. Of the eight six suspects, six were identified in Romania and two in France. Two of the suspects have been arrested.

Europol facilitated the exchange of information and provided analytical support to the investigation. On the action day, Europol deployed staff to the coordination centre at Eurojust.

Human trafficking for the purpose of sexual exploitation remains the most prevalent form of exploitation in the European Union, with women and girls accounting for 87% of victims. As human trafficking usually takes place across borders, judicial cooperation is key to dismantling the OCGs and bringing them to justice. In 2023, Eurojust assisted in over 300 cross-border human trafficking cases.

The authorities involved in the actions:

  • Romania: Special Operations Directorate, Service for Combating Organized Crime Olt and Gorj; Offices for Combating Organized Crime of Bucharest and Craiova; Mobile Gendarmerie Group “Buzești Brothers” Craiova, Special Intervention Brigade of the Gendarmerie; Prosecution Office of High Court of Cassation and Justice, Directorate for Investigation of Organized Crime and Terrorism, Mehedinti Territorial Office;
  • France: Investigative judge from JIRS Lyon (Interregional Specialised Jurisdiction); Research Section Lyon, Gendarmerie Nationale

Website used for child pornography, prostitution and drug dealing taken down with support of Eurojust

Source: Eurojust

An online platform known for facilitating various crimes was taken down by the French authorities, in cooperation with Bulgaria, Germany Lithuania, the Netherlands and Hungary. The authorities had been investigating the digital platform since December 2023. During an action day on 24 June the servers located in Germany were seized and disconnected and over EUR 5.6 million of criminal funds were frozen.

The website was used for many years to facilitate a range of criminal activities, in particular for child pornography, sexual exploitation, drug dealing, ambushes and even homicides. Criminals were able to send messages and connect with other criminals active in their criminal activities.

Since 2021, more than 23 000 judicial procedures have been initiated involving the online platform. At least 480 victims of the platform have been heard during these judicial procedures. Investigations into the platform were started by French authorities in December 2023. These investigations showed that the platform was concealing and facilitating transactions for organised crime groups and was enabling criminal activities such as pimping and paedophilia.

A coordinated action to take down the website was carried out with the full support of Eurojust. The authorities seized the servers located in Germany, which resulted in the platform being disconnected and the display of a splash page. The Lithuanian and Hungarian authorities ensured the swift execution of freezing orders, which led to the freezing of over EUR 5.6 million in criminal funds.

At the same time, a European Investigation Order (EIO), issued from France, was successfully executed in Bulgaria. All investigative actions have been carried out in presence of French magistrates and officials from the Law enforcement authorities of France upon authorisation by the competent Bulgarian authorities. As part of the execution of the EIO, bank statements were  revealed, searches and seizures were carried out and witnesses were questioned.

The actions were carried out by the following authorities:

  • France: PPO Paris JUNALCO (National Jurisdiction against organised Crime) Cybercrime Unit; Gendarmerie Nationale – Cybercrime unit; ONAF (Anti Fraud National Office)
  • Bulgaria: Sofia City PPO and General Police Directorate Combating Organised Crime
  • Germany: Public Prosecutor’s Office Limburg; Hessian State Criminal Police Office
  • Hungary: Budapest IX. District Public Prosecutor’s Office
  • Lithuania: Vilnius Regional Prosecutor’s Office
  • The Netherlands: Public Prosecutor’s Office Amsterdam

Eurojust assists in uncovering a high-level corruption scheme

Source: Eurojust

It is believed that with their bribes, the fugitives with a Red Notice attempted to obtain asylum or refugee seeker status in Moldova or other countries in an effort to delete or block a Red Notice. Moreover, the suspects sought information about their INTERPOL Red Notice to try and avoid detection. A Red Notice is a request to law enforcement agencies worldwide to locate an individual for extradition, surrender or other legal action.

Effective and quick international cooperation was key to putting a stop to the corruption scheme. INTERPOL, the International Criminal Police Organization based in France, alerted the French authorities about the possible corruption scheme and the bribes taking place in Moldova. Eurojust’s support was instrumental in ensuring that French and Moldovan authorities were able to work together rapidly.

A joint investigation team was set up at Eurojust between French and Moldovan authorities during a coordination meeting at the Agency. This enabled the authorities to exchange information and evidence, determine the judicial strategy and carry out joint operations. Authorities from the United Kingdom supported the operation by providing important information on the suspects after linking the operation to a separate investigation into an international cybercrime network.

On 4 June, an action day took place in Moldova, during wich search warrants were executed for 12 persons in 33 locations. Mobile phones, laptops, computers and other items and documents were seized during the operation, which received grants from Eurojust’s funding programme for joint investigation teams. Four people were detained for up to 72 hours. On 5 June, a high-level official was arrested for 30 days at the request of the Moldovan prosecutor.

The operation was carried out by the following authorities:

  • France: National Financial Prosecutor’s Office; OCLCIFF (Central Anti-Corruption Office within the French National Police)
  • Moldova: Anti-corruption Prosecution Office
  • United Kingdom: National Crime Agency

Successful operation against cryptocurrency scam coordinated by Eurojust

Source: Eurojust

A coordinated operation to uncover an intricate cryptocurrency scam led to the arrest of a suspect in France. The investigation in Portugal, France, Germany, Italy and Romania, supported by Eurojust and Europol, revealed that the suspects were using a scam method known as ‘rip deals’ that caused losses of EUR 700 000 to Portuguese victims.

Scammers using the ’rip deal’ method trick their victims into exchanging money via a fraudulent money exchange programme, which they then use to steal the victim’s assets.

Investigations revealed that the suspects scammed victims across Europe, including in Austria, Italy, Portugal, Spain and Switzerland. The suspects would approach their victims by expressing an interest in acquiring commercial businesses. After gaining their trust and convincing them to install crypto asset wallets, the suspects would steal the victim’s funds.

In the next phase of the scam, other members of the organised crime group would launder the proceeds of the fraud by moving them through several crypto assets. This made it difficult to trace the proceeds.

The investigation, spanning several years, culminated in an action day supported by Eurojust and Europol. During the operation, carried out simultaneously in France, Germany, Italy, and Romania, one suspect was arrested and several houses were searched. Authorities froze multiple bank accounts and seized material goods such as equipment containing information on the scam.

Eurojust supported the investigation by enabling cooperation between the countries involved in the operation. The coordination meeting at Eurojust helped the authorities to exchange information and prepare for the action day. Additionally, Eurojust supported the execution of European Investigation Orders (EIOs), European Arrest Warrants (EAWs), and freezing orders.

The following authorities were involved in the coordinated operation:

  • Portugal: Regional Department for Criminal Investigation and Prosecution of Coimbra; Judicial Police
  • France: Judiciary Tribunal of Bobigny; National Police 93
  • Germany: Public Prosecutor’s Office Darmstadt; ZK32 at Criminal Directorate Offenbach, Southeast Hesse Police
  • Italy: Public Prosecutor Office in Milan; Italian State Police – Cyber Security Operations Centre “Lombardia” in Milan
  • Romania: Directorate for Investigating Organized Crime and Terrorism – Territorial Structure Timișoara; Romanian Police, Office of Combating Organised Crime Timisoara – Unit Combating Informatics Crimes.

Network of luxury car thieves dismantled with support of Eurojust

Source: Eurojust

A large-scale ring of luxury car thieves has been dismantled with the support of Eurojust and Europol. Using straw men and underprivileged people, the criminals hired or leased luxury vehicles, which they later registered in their own names through corrupt connections in official institutions.

The cars were resold outside the EU, including in the United Kingdom and the United Arab Emirates. In a series of recent coordinated actions in Spain, France, Germany, Latvia, Poland and Ukraine, 13 suspects were arrested for fraud, forgery and money laundering.

© – Ukrainian National Police

Through a coordination centre at Eurojust, over sixty places were also searched by national authorities. Several luxury vehicles, communication equipment and documents were seized, as well as over EUR 100 000 in cash.

The Spanish authorities launched their investigation in 2022 following reports of luxury cars going missing from legitimately operating car rental and lease companies in and around Malaga. These investigations revealed that dozens of vehicles were ultimately stolen across Europe by a network of linked criminals. They exploited around fifty vulnerable and underprivileged people by using their documents, such as driving licences and passports, to hire or lease luxury cars.

Through corrupt contacts in official institutions, they managed to register the hired vehicles on to their personal documents, so they could sell them in the European Union and beyond, including Ukraine, the United Kingdom and the United Arab Emirates. Some of the stolen vehicles were transported in containers to conceal the cars.

Investigations were later also started in France, Poland and Ukraine, which revealed links between different criminal groups using the same modus operandi. In March of this year, with the support and funding of Eurojust, authorities in France, Spain and Ukraine set up a joint investigation team into the car thefts. Eurojust also organised two preparatory coordination meetings to prepare for the recent action day week and set up the coordination centre.

Europol assisted the operations against the criminal network by producing criminal intelligence packages. It also provided an operational coordination centre to support the actions at police level.

Operations on the ground were carried out at the request of and by the following authorities:

  • Spain: Investigative Court no. 1, Málaga; Public Prosecutor’s Office, Málaga; Spanish National Police
  • France: Judiciary Tribunal, Grasse; National Gendarmerie, Central Office against Roving Crime (OCDLI)
  • Germany: Public Prosecutor’s Offices Essen and Osnabrück; Police Departments of Essen and Osnabrück
  • Latvia: 3rd Unit International Cooperation Department State Police
  • Poland: Public Prosecutor’s Office, Warsaw
  • Ukraine: Prosecutor General’s Office; Main Investigation Department and Department of Strategic Investigations of National Police

Major operation to take down dangerous malware systems

Source: Eurojust

In an unprecedented operation against aggressive and dangerous computer malware, authorities in the European Union and beyond have taken actions against droppers including IcedID, Pikabot, Smokeloader, Bumblebee and Trickbot, which infiltrated computers via emails. The measures focused on disrupting criminal services through arresting suspects, the freezing of illegal proceeds, and taking down botnets, coordinated by Eurojust. The operation, which was carried out this week with support of Europol, is a follow up to the successful takedown of the Emotet malware system in 2021.

During actions carried out simultaneously in Germany, the Netherlands, France, Denmark, Ukraine, the United States and United Kingdom, 4 suspects were arrested, who offered the malware as a professional blackmail service to other criminal actors. Some of the suspects were involved in operating Emotet in the past.

Via so called ‘sinkholing’ techniques or the use of tools to access the systems of operators behind the malware, investigators managed to block and take down the botnets. Malware droppers are types of malicious software which downloads viruses, ransomware or spyware on computers. They are generally installed via mails with infected links or Word and PDF attachments, such as shipping invoices or order forms, to get access to personal data and or bank accounts of computer users.

Mainly enterprises and national authorities and institutions were made victims of the series of malware systems which now have been taken down. Users are warned to be careful when opening links and attachments to mails and check the origin of mails.

The investigations, which have been ongoing since the takedown of Emotet, also focused on the running of that malware itself as their operators did create the new botnets mentioned. During the coordinated actions 16 places were searched.

In total over 100 servers were taken down or disrupted and over 2 000 domains are under control of law enforcement authorities.

Furthermore, investigations showed that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure for the deployment of ransomware. The transactions are constantly being monitored and legal permission to seize these assets instantly through future actions has already been obtained.

Eurojust set up a coordination centre on its premises to manage simultaneous actions in all countries concerned. The Agency also assisted national authorities in the preparation and execution of European Arrest Warrants, European Investigation Orders and requests for Mutual Legal Assistance, and organized five coordination meetings.

The following national authorities were involved in the operations on the ground:

  • Germany: Prosecutor General’s Office Frankfurt am Main – Cyber Crime Center; Federal Criminal Police Office (Bundeskriminalamt)
  • The Netherlands: National Prosecution Service; National Police
  • Austria: Public Prosecutor’s Office of Salzburg; Criminal Intelligence Service Austria (Bundeskriminalamt)
  • Denmark: National Special Crime Unit (NSK)
  • France: Prosecutor’s Office JUNALCO (National Jurisdiction against Organised Crime) Cybercrime Unit; Gendarmerie Nationale C3N
  • Ukraine: Prosecutor General’s Office; Main Investigation Department of National Police of Ukraine; Cyber Department of the Security Service of Ukraine
  • United Kingdom: National Crime Agency
  • United States: United States Department of Justice, Federal Bureau of Investigation, The Defense Criminal Investigative Service

Eurojust supports arrest of nine human traffickers in France and Spain

Source: Eurojust

An organised crime group (OCG) active in human trafficking and sexual exploitation has been exposed, and suspected members were arrested with the support of Eurojust and Europol. The arrest of nine suspects in France and Spain has stopped the structured human trafficking network in its tracks. Six victims of the human traffickers were taken to safety.

After French authorities discovered an apartment that was used for prostitution in 2022, an investigation was launched that exposed the network’s activities in human trafficking and sexual exploitation in France and Spain. The victims, mostly from Latin America, the Caribbean and Romania, were taken to France and then moved around the country to engage in prostitution in apartments rented for short periods by the OCG. Members of the network used the internet to advertise paid sexual services.

Following the operation and arrests of the suspects, six victims in France were offered assistance and shelter by a dedicated non-profit organisation.

To prepare for the action day, Eurojust organised a coordination meeting between the French and Spanish authorities, ensuring smooth cooperation for the coordinated actions. Eurojust also assisted in the execution of several European Investigation Orders, freezing orders and European Arrest Warrants.

These actions were carried out by the following authorities:

  • France: JIRS Nancy (Interregional Specialised Jurisdiction) and OCRTEH (Central Office against human trafficking)
  • Spain: Audiencia Nacional (Central Investigative Courts num 1 & 2 and PPO) at judicial level and UCRIF (Policía Nacional) at police level

Eurojust coordinates searches of offices of international car tyre manufacturer

Source: Eurojust

Eurojust has assisted the authorities in France, Belgium and Luxembourg with a series of coordinated searches of premises and offices of an international tyre manufacturer. These searches took place this week at the request of the judicial authorities in Besançon in France, in the context of investigations into involuntary manslaughter linked to technical failures that led to tyre explosions.

The investigations in France concern a series of accidents between 2011 and 2016, which allegedly led to the death of three lorry drivers. The investigations are looking into whether the tyre producer was aware of potential failures and whether the company had addressed the technical issues or not.

Eurojust was asked by the French authorities in 2023 to provide legal advice on the cross-border aspects of the investigations and to coordinate judicial actions in various EU Member States. For this purpose, the Agency has set up a coordination centre at its premises in The Hague to assist the authorities concerned with the investigations and simultaneous searches in France, Belgium and Luxembourg.

Investigations into the case are ongoing and the Agency stands ready to assist the authorities concerned with any future requests for cross-border judicial cooperation.

The operations that took place this week were carried out by:

  • France: Public Prosecutor’s Office (PPO) of Besançon; Gendarmerie Nationale – Criminal Investigation Department Amiens, National Cyber Support and Intervention Section, Criminal Investigation Department Versailles
  • Belgium: Investigative Judge at Court of First Instance of Antwerp, section Turnhout; PPO Antwerp, section Turnhout; Federal Judicial Police Antwerp
  • Luxembourg: Investigative Judge at District Court of Luxembourg; Grand Ducal Police – Police Judiciaire