International law enforcement dismantled the KillSec ransomware group on September 30, seizing its dark web leak site and servers. The operation, led by German authorities, resulted in three arrests, including a 16-year-old suspected main operator, and the seizure of 110 terabytes of stolen data.
A wave of fast, high‑value museum thefts across Europe—fueled by the Louvre break‑in—targets paintings, jewellery, and portable artefacts; Europol notes rising frequency and more aggressive methods, with experts citing copycat crimes. Museums are upgrading security (surveillance, barriers, integrated alarms), but maintaining open public spaces while deterring thieves remains a major challenge.
EU security officials warn of a new, youth-driven online extremism trend—“nihilistic violent extremism”—where AI-enabled tools and encrypted networks boost recruitment, propaganda, and attack planning; although classic jihadist threats persist, authorities report online networks across Europe have intensified violence-oriented acts and arrests, with many offenders under 18, underscoring the need for digital-era policing.
European security officials warn that online spaces are increasingly fueling real-world threats, as youth-driven extremist networks like 764 recruit and coordinate violence through platforms that amplify propaganda with AI tools and deepfakes; authorities point to European incidents (including a German case) and note that most investigations occur in the digital realm, calling for cross-border cooperation while privacy advocates caution against overreach.
European authorities, led by Spain and Europol, arrested 78 people in Spain and Algeria as they dismantled a cross-border network that moved MDMA from Spain/Portugal to Algeria and used ghost speedboats to smuggle migrants and weapons back to Spain and Ibiza. The cache included 18 fast vessels, firearms, and cash, with migrant profits alone estimated at over €24m. The operation covered 17 locations and linked the group to other crime networks, underscoring a diversified criminal enterprise spanning the Western Mediterranean.
A Spain-led operation with Europol and police from France, Portugal and Poland dismantled one of the Western Mediterranean’s largest migrant-smuggling networks, arresting 78 people (77 in Spain and 1 in Algeria) and seizing assets including 18 high-speed boats. The group operated two-way routes between Europe and Algeria, moved more than 2,000 migrants, and generated over €24 million in profits, charging up to €12,000 per person. The network offered a wide range of services to other criminals—storage, transport, refueling, maintenance, and counter-surveillance—while using informal hawala networks to move funds; authorities described it as among the most complex and dangerous criminal networks detected in the Mediterranean, with 17 locations searched across Spain and high-value targets among the detainees.
European police reveal a 'violence-as-a-service' network called Foxtrot that recruits teenagers via social media to carry out killings across Europe for cash; cases in Sweden and the UK illustrate how young operatives are guided through gamified, game-like instructions and are often caught before payment. Europol's GRIMM taskforce has led to hundreds of arrests across 11 countries, with the leader linked to Iran now based in Tehran, while convictions and extraditions continue in several jurisdictions. The network’s actions and ongoing arrests underscore cross-border cooperation efforts to curb this violent trend.
An international police operation spanning multiple countries has exposed highly organized networks of men who drug and rape their partners and coordinate assaults through encrypted online chat groups. Led by Europol with involvement from German and British authorities and collaborators in the US, Brazil, Canada, France, Hungary, the Netherlands and Spain, the effort—named Project Medusa—has identified more than 150 offenders and victims, opened over 270 leads, and resulted in dozens of arrests (57 reported). The case follows high-profile incidents like Gisèle Pelicot and CNN’s undercover reporting on online networks that teach and enable drugging and rape, highlighting the evolving, cross-border challenge of drug-facilitated sexual violence and the push to take down the platforms that host such material.
European authorities led by France and the Netherlands, with Europol and Eurojust, dismantled the First VPN service used by cybercriminals for ransomware and data theft. Investigators infiltrated the service, seized 33 servers, and arrested its administrator, identifying about 506 users and producing 83 intelligence packages that supported 21 Europol-facilitated investigations. The operation underscored how VPNs marketed as ‘no-logs’ can mislead users who believe they are safe, even as criminal activity relies on such infrastructure.
An international operation led by France and the Netherlands, with Europol/Eurojust support, dismantled the ‘First VPN’ service used by ransomware and data-theft actors. Authorities seized 33 servers across 27 countries, shut down key domains, disrupted infrastructure, and arrested the administrator in Ukraine. Investigators infiltrated the VPN to recover data, with Europol reporting 506 identified users and 83 intelligence packages shared to aid ongoing investigations into ransomware and related crimes. While VPNs have legitimate uses, criminals leveraged this service to hide activity; all identified users have been notified and further legal action may follow.
A two‑week international operation coordinated by Europol disrupted a major cocaine trafficking network moving drugs from Latin America to Europe. Authorities seized over 12 tons of cocaine and about 9.5 tons of hashish, intercepted eight vessels, and arrested 54 people. The effort highlights evolving, offshore multi‑stage transfers in the Atlantic to evade major ports, with focus on the area between the Canary Islands and the Azores, termed the so‑called cocaine highway.
Hungarian national Janos Balla, aka Daniel Takács and listed among Europe’s ten most-wanted fugitives, was arrested in Cancun after Interpol issued a red notice and Europol arrest warrant for his alleged leadership of a cocaine and ecstasy trafficking network from 2014–2015; authorities say he’s being turned over to Mexico’s immigration agency to determine status and pursue deportation to Europe, in a case driven by cooperation between Hungarian security services and Mexican authorities.
An international law enforcement sweep called Operation PowerOFF, coordinated by Europol across 21 countries, has identified more than 75,000 DDoS-for-hire users, shut down 53 domains, and arrested four people, as part of an ongoing effort to disrupt booter services and raise awareness about illegality; previous phases have seized infrastructure and databases with more than 3 million criminal accounts, and the operation is now shifting toward prevention with awareness campaigns, search-engine removals of illegal content, and on-chain warnings tied to illicit payments.
Europol-led Operation PowerOFF, backed by EMPACT, coordinated actions in 21 countries to dismantle DDoS-for-hire networks, sending warning emails/letters to over 75,000 suspected users, seizing 53 domains, issuing 25 search warrants, and making four arrests, while launching prevention and awareness measures.
France’s national cyber unit, with Europol, raided X’s Paris headquarters as part of a probe into alleged algorithm manipulation and Grok, drawing Elon Musk’s claim that the action is a political attack; prosecutors later broadened the case to potential offenses including Holocaust denial content and sexual deepfakes, with Musk and former X CEO Linda Yaccarino summoned to a Paris hearing on April 20, while EU and UK regulators continue examining Grok and X’s data practices.