Europol

Europol is the European Union Agency for Law Enforcement Cooperation, headquartered in The Hague. Established by the 1995 Europol Convention and overhauled by EU Regulation 2022/991, it supports criminal investigations in member states and partner countries by sharing intelligence, hosting coordination centres and providing forensic and analytical services. It has no direct powers of arrest; enforcement is carried out by national agencies acting on Europol coordination. Its European Cybercrime Centre (EC3), established in 2013, coordinates high-profile infrastructure takedowns including Operation Cronos (LockBit, 2024), Operation Endgame (2024) and Operation GoldDust (2022).

In May 2026, EC3 coordinated Operation Saffron, seizing 33 servers across 27 countries hosting First VPN, a criminal anonymisation service used by at least 25 ransomware gangs since 2014; no arrest was announced despite the administrator being located in Ukraine . EC3 also publishes the annual Internet Organised Crime Threat Assessment, the EU-wide baseline for cybercrime trends.

Critics, including RUSI's Cyber research group, note that takedowns of shared dependencies such as VPNs redirect affiliates rather than reduce overall ransomware volume, because the ecosystem's constraint is affiliate supply, not infrastructure. Europol's own IOCTA framing positions such operations as disruption that raises friction and generates forensic intelligence rather than permanent suppression.