Loading story…
German authorities, backed by Europol and law enforcement partners in 23 countries, launched Operation Alice against a major dark web fraud network built around the platform "Alice with Violence CP". Investigators said a 35-year-old man in the People’s Republic of China operated more than 373,000 onion domains that falsely advertised child sexual abuse material and cybercrime-as-a-service, took payment in Bitcoin, and failed to deliver the promised content. The investigation began in mid-2021 and examined activity spanning November 2019 through July 2025.
Between 9 and 19 March 2026, authorities shut down more than 373,000 dark web sites, seized 105 servers and multiple electronic devices, and identified the alleged operator along with 440 customers worldwide. Officials estimate the scheme generated more than EUR 345,000 from roughly 10,000 customers, while German authorities issued an international arrest warrant and said investigations continue against more than 100 individuals. Europol added that the operation also supported child protection efforts, including immediate interventions where children were found to be at risk and intelligence development on suspects seeking severe CSAM.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
A French cybersecurity startup executive was implicated in the Alice with Violence CP investigation and is due to appear before the Nanterre judicial court in early September 2026. His lawyer said the three cryptocurrency transactions at issue were test purchases made about four years earlier for research purposes, and investigators reportedly found no evidence he downloaded or possessed illicit content.
Authorities said evidence from Operation Alice could support the prosecution of about 600 offenders and users linked to the fraudulent dark web network. The update expanded the expected enforcement impact beyond the previously disclosed 440 identified customers and more than 100 ongoing investigations.
German authorities issued an international arrest warrant for the suspected operator, who investigators said earned more than EUR 345,000 from about 10,000 customers worldwide. Authorities also said investigations remain ongoing against more than 100 individuals.
Between 9 and 19 March 2026, authorities shut down over 373,000 onion domains tied to the fraudulent network and seized 105 servers along with multiple electronic devices. The takedown was part of coordinated action by 23 countries.
During the operation, investigators identified the suspected operator and 440 customers worldwide connected to the network. Europol said the case also generated child protection interventions and intelligence on suspects seeking severe CSAM.
On 9 March 2026, German authorities, supported by Europol and partners from 23 countries, launched Operation Alice targeting one of the largest fraudulent dark web platform networks. The action focused on the operator of “Alice with Violence CP.”
German authorities opened an investigation in mid-2021 into the fraudulent dark web platform network later linked to a 35-year-old man based in the People’s Republic of China. The probe ultimately examined activity spanning November 2019 through July 2025.
The platform network known as “Alice with Violence CP” began activity by November 2019, advertising child sexual abuse material and cybercrime-as-a-service offerings and taking Bitcoin payments without delivering the promised content.
6 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourceitpro.com
Open sourceeuropol.europa.eu
Open sourcedatabreaches.net
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities in seven countries arrested 28 men in a coordinated crackdown on child sexual exploitation linked to dark web forums hosting child sexual abuse material, with operational support from **Europol** and **Eurojust**. Investigators said the suspects, aged 22 to 54, allegedly used cryptocurrency payments — including **Monero** — to buy access to the forums, and the operation led to the safeguarding of three children and the seizure of more than 460 items, including electronic devices, cryptocurrency wallets, drugs, and large quantities of doping substances. Norway’s Kripos said a cryptocurrency-tracing method developed in 2025 helped identify alleged buyers and two suspected sellers outside Norway, marking a notable development in investigations involving privacy-focused digital currency. Authorities said one suspect used artificial intelligence to generate illegal material, while some victims were members of another suspect’s immediate family; the investigation remains ongoing and officials expect further arrests.
Jul 11, 2026
An international law-enforcement operation dubbed **Operation Lightning** disrupted **SocksEscort**, a paid “residential proxy” service that routed criminal traffic through compromised home/small-business routers and IoT devices to provide anonymity for fraud and other cybercrime. Authorities from the US and multiple European countries (including Austria, France, and the Netherlands), supported by **Europol** and **Eurojust** and assisted by private-sector partners **Lumen’s Black Lotus Labs** and the **Shadowserver Foundation**, reported the botnet had leveraged exploited vulnerabilities in edge devices and was powered by **AVRecon** (Linux) malware. Officials said SocksEscort advertised access to roughly **369,000 IP addresses** since 2020, with Europol stating the infrastructure compromised **369,000+** routers/IoT devices across **163 countries** and offered customers tens of thousands of proxies; reporting also noted that, as of February 2026, the service listed about **8,000 infected routers**, including roughly **2,500 in the United States**. During the coordinated action, authorities **seized 34 domains and 23 servers** across **seven countries**, replaced the service’s website with a seizure notice, and the US froze approximately **$3.5 million in cryptocurrency** tied to the operation; officials also cited the service’s payment platform receiving about **$5.8 million** from customers. SocksEscort was described as enabling a wide range of downstream criminal activity—including large-scale fraud, account takeovers, identity theft, business email compromise, password spraying, and, per Europol, facilitation of **ransomware**, **DDoS**, and distribution of **CSAM**—with US reporting citing specific victim losses (including a **$1M** cryptocurrency theft and additional six-figure fraud impacts). Investigators indicated the seized infrastructure and customer data (reported as roughly **124,000 users**) will be used to pursue follow-on investigations into both operators and customers of the proxy service.
Jun 29, 2026
German and Spanish authorities dismantled the relaunched **Crimenetwork** criminal marketplace and arrested its suspected operator in Mallorca, according to Germany’s Federal Criminal Police Office (BKA) and subsequent reporting. Investigators identified the suspect as a 35-year-old German national accused of rebuilding the platform shortly after the original Crimenetwork was shut down in December 2024, then operating it as a major German-speaking underground market for stolen data, narcotics, forged documents, and other illicit services. Authorities said the platform had more than **22,000 users** and over **100 vendors**, processed payments in cryptocurrencies including **Bitcoin**, **Litecoin**, and **Monero**, and generated more than **€3.6 million** in revenue. The operation was led by the **BKA**, the Frankfurt am Main Public Prosecutor’s Office’s **ZIT**, and the Spanish National Police; investigators also preliminarily seized about **€194,000** in assets and obtained user and transaction data that is expected to support follow-on investigations into vendors, buyers, and related criminal activity.
Jun 29, 2026