Operation ENDGAME strikes again: the ransomware kill chain broken at its source

Source: Europol

In addition, EUR 3.5 million in cryptocurrency was seized during the action week.This latest phase of Operation ENDGAME follows on from the largest-ever international action against botnets in May 2024. It targeted new malware variants and successor groups that re-emerged after last year’s takedowns, reinforcing law enforcement’s capacity to adapt and strike back – even as cybercriminals retool and reorganise.The…

270 arrested in global dark web crackdown targeting online drug and criminal networks

Source: Europol

The suspects were identified through coordinated investigations based on intelligence from the takedowns of the dark web marketplaces Nemesis, Tor2Door, Bohemia and Kingdom Markets. Many had conducted thousands of sales on illicit marketplaces, using encryption tools and cryptocurrencies to cover their tracks — but law enforcement closed in.This international action follows Operation SpecTor in 2023, which led to 288 arrests….

80 arrests and more than 37 700 cultural goods seized in major art trafficking bust

Source: Europol

Operational highlightsThe Italian Carabinieri Command for the Protection of Cultural Heritage (TPC) in coordination with the Italian Customs and Monopolies agency (ADM) seized a painting attributed to renowned artist Jannis Kounellis during a joint border operation. Upon inspection, it was determined to be inauthentic. Had it been genuine, its estimated value would have been around EUR 100 000. In a…

Europol and Microsoft disrupt world’s largest infostealer Lumma

Source: Europol

This joint operation targeted the sophisticated ecosystem that allowed criminals to exploit stolen information on a massive scale. Europol coordinated with law enforcement in Europe to ensure action was taken, leveraging intelligence provided by Microsoft.Between 16 March and 16 May 2025, Microsoft identified over 394 000 Windows computers globally infected by the Lumma malware. In a coordinated follow-up operation this…

Celebrating 20 years of the Europol Information System

Source: Europol

Its origin goes back to the foundation of the European Police Office by the Europol Convention, which set the legal basis for the establishment of a “computerized information system” (Title II, Article 7), into which EU Member States could directly input data in compliance with their national procedures, and into which Europol could directly input data supplied by third parties…

17 providers of criminal banking services arrested

Source: Europol

The 17 individuals arrested are mostly of Chinese and Syrian nationality and are suspected of providing primarily money laundering services to criminals. This encompasses parallel banking services, illegal hawala banking, cash collection, cash courier services and the exchange of cryptocurrencies for cash. The money launderers were operational in at least two branches: one that catered largely to the Arabic-speaking criminal…

15 migrant smugglers arrested in multi-stage operation

Source: Europol

The German investigation began with a routine immigration check in September 2024. Due to irregularities in a driver’s documentation, he was suspected of attempted illegal entry and taken in for questioning. Investigators then found evidence that the driver may have already smuggled and dropped off three non-EU nationals on the same day.Subsequent investigations gave reason to believe the person was…

International crackdown dismantles multimillion-euro investment scam

Source: Europol

The criminal network lured victims with the promise of high returns on investments through a fraudulent online trading platform. After the victims made initial smaller deposits, they were pressured to invest larger amounts of money, manipulated by fake charts showing fabricated profits. Criminals posing as brokers used psychological tactics to convince the victims to transfer substantial funds, which were never…

DDoS-for-hire empire brought down: Poland arrests 4 administrators, US seizes 9 domains

Source: Europol

The now defunct platforms – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – are thought to have facilitated widespread attacks on schools, government services, businesses, and gaming platforms between 2022 and 2025. The platforms offered slick interfaces that required no technical skills. Users simply entered a target IP address, selected the type and duration of attack, and paid the fee…

Eight countries launch Operational Taskforce to tackle violence-as-a-service

Source: Europol

The exploitation of young perpetrators to carry out criminal acts has emerged as a fast-evolving tactic used by organised crime. This trend was underlined in the European Union Serious and Organised Crime Threat Assessment 2025 (EU-SOCTA), which identified the deliberate use of youngsters as a way to avoid detection and prosecution.Recruitment, manipulation, exploitationViolence-as-a-service refers to the outsourcing of violent acts…