Europol

Europol is the European Union Agency for Law Enforcement Cooperation, headquartered in The Hague, Netherlands. Established by the Europol Convention of 1995 and overhauled by successive EU Regulations (most recently 2022/991), it supports criminal investigations in EU member states and partner countries by sharing intelligence, hosting operational coordination centres, and providing forensic and analytical services. It has no direct powers of arrest; all enforcement actions are carried out by national agencies acting on Europol coordination. Its REMIT spans serious organised crime, terrorism, cybercrime, trafficking and financial crime. The European Cybercrime Centre (EC3), established within Europol in 2013, is its specialist cybercrime hub and the body that coordinates high-profile infrastructure takedowns including Operation Cronos (LockBit, 2024), Operation Endgame (dropper botnets, 2024), Operation GoldDust (Sodinokibi/REvil, 2022), and the May 2026 Operation Saffron, which seized 33 servers across 27 countries hosting First VPN, a criminal anonymisation service used by at least 25 ransomware gangs since 2014.

EC3 publishes the annual Internet Organised Crime Threat Assessment (IOCTA), the primary EU-wide baseline for cybercrime trends and the evidence base informing enforcement priorities. Europol works jointly with Eurojust (the EU judicial cooperation agency) and with non-EU partners including the FBI, NCA and Australian AFP under bilateral cooperation agreements. Its operational intelligence sits in the Secure Information Exchange Network Application (SIENA), which allows member-state agencies to share classified case data without routing through unprotected channels. The organisation employs roughly 1,800 staff at The Hague campus, with liaison officers embedded in partner agencies globally.

Europol's cyber-infrastructure takedown operations follow a now-established model: multi-country server seizures coordinated in hours, supported by Eurojust judicial warrants, timed to deny operators recovery time. Operation Saffron's 27-country coordination sets a geographic breadth record for criminal-infrastructure seizure. Critics, including RUSI's Cyber research group, note that takedowns of shared dependencies (VPNs, bulletproof hosts, Cryptocurrency exchanges) redirect affiliates rather than reduce the attack volume, because the ransomware ecosystem's constraint is affiliate supply rather than infrastructure. Europol's own IOCTA framing acknowledges this, positioning takedowns as disruption operations that impose friction and generate forensic intelligence rather than permanent suppression.