Loading story…
Europol said it coordinated its largest-ever Referral Action Day targeting terrorist and extremist audio propaganda, referring 17,298 URLs across 40 online platforms for review. The operation was initiated and co-led by Hungary and Europol’s EU Internet Referral Unit (EU IRU), with investigators from 13 countries participating. The referred material amounted to more than 1,100 hours of content and included speeches by designated terrorist leaders, songs glorifying violence, and nashids commonly used in jihadist propaganda; Europol said 77% of the content had been removed so far.
The action reflects a broader shift of extremist messaging toward audio-sharing platforms, where moderation is more difficult than for video or image content because detection often requires linguistic and contextual expertise. Europol said the campaign targeted propaganda used by actors across the ideological spectrum, including jihadist and violent right-wing extremist networks, and that investigators conducted deconfliction checks before referrals to avoid disrupting ongoing investigations. The case is operationally relevant as it highlights how threat actors continue to exploit less-moderated media formats to sustain online radicalization and propaganda distribution.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-18, Europol reported that 77% of the audio propaganda content referred during the 3 March action had been removed by online service providers. Europol described the operation as its largest referral action to date targeting terrorist and extremist audio material.
On 2026-03-03, Europol and Hungary co-led a large-scale Referral Action Day focused on jihadist and violent right-wing extremist audio propaganda across 40 online platforms. Investigators from 13 countries referred 17,298 URLs containing more than 1,100 hours of speeches, songs, chants, and nashids for service-provider review and removal.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
europol.europa.eu
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Europol said investigators from nine European countries flagged **4,340 URLs** for removal during Referral Action Days aimed at disrupting **The Com**, a decentralized online network tied to nihilistic violent extremism. The operation, organized by Europol’s **EU Internet Referral Unit** and Spain’s **CITCO**, targeted content spread across social media, messaging apps, and gaming platforms that promoted self-harm, suicide, child sexual abuse material, animal cruelty, violent attacks, and guides for grooming, murder, improvised explosives, doxing, and swatting. Authorities said The Com recruits and grooms young people online, often coercing minors through sextortion and pushing them toward both victimization and offending. Europol linked the action to its broader **Project COMPASS** effort, which had already produced arrests, identified suspects, and located victims, and noted that subgroups associated with the network include **764**. That subgroup drew earlier law-enforcement attention after U.S. prosecutors charged alleged leaders of 764 with operating a global child exploitation enterprise, underscoring how extremist online communities are overlapping with organized child abuse and coercion networks.
Jul 31, 2026
A Canadian man from Ontario’s Niagara region was sentenced to 20 years in prison after pleading guilty to terrorism-related offences tied to the **Terrorgram Collective**, an online violent white supremacist network. Authorities said he produced and disseminated propaganda that helped inspire multiple terrorist attacks, marking a significant court outcome against a transnational extremist ecosystem that has been designated as a terrorist entity in several countries. Europol said its **European Counter Terrorism Centre** supported the case by mapping the Terrorgram network from mid-2022 onward, identifying associated individuals across Europe and other regions, and sharing intelligence packages with international partners including the **Royal Canadian Mounted Police**. The case underscores sustained cross-border cooperation between Canadian authorities and Europol to identify, investigate, and disrupt online extremist propaganda networks linked to real-world violence.
Jun 29, 2026
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026