Europol

Europol, formally the European Union Agency for Law Enforcement Cooperation, works from The Hague. The 1995 Europol Convention created it, and EU Regulation 2022/991 extended its mandate. Europol shares intelligence, runs coordination centres and lends forensic and analytical staff to national forces, but its officers cannot arrest anyone. Its European Cybercrime Centre (EC3), opened in 2013, writes the yearly Internet Organised Crime Threat Assessment and has coordinated Operation GoldDust, as well as Operation Cronos against LockBit and Operation Endgame, both in 2024.

Three 2026 actions set the agency's cyber tempo. In Operation Saffron, French and Dutch investigators working with Europol took apart the 33 servers behind First VPN on 19 and 20 May; Europol passed intelligence on 506 of the service's users to partner countries, and Ukrainian police searched and interviewed its administrator. On 2 September Europol announced the US-led sinkholing of Sality, a peer-to-peer botnet tied to more than 11 million IP addresses. On 30 September it joined Hamburg's state police against KillSec, a gang investigators link to about 500 successful attacks.

Europol's results depend on national partners. France and the Netherlands led Saffron, and Germany led KillSwitch. BlackFog still counted 102 publicly disclosed ransomware attacks by 31 groups in June 2026, the month after the First VPN action.