Loading story…
European and international law enforcement agencies dismantled nine organized crime groups and arrested 29 suspects in Operation KRATOS 2, a seven-month crackdown on illegal IPTV and unauthorized streaming services coordinated by Bulgaria with Europol support. The operation ran from September 2025 to April 2026 and involved authorities from 13 countries, targeting not only piracy websites but also the wider criminal and technical infrastructure used to host, manage, and conceal the services across borders.
Investigators identified more than 18,000 IP addresses, 4,370 piracy-linked domains, nearly 400,000 URLs flagged for suspension or removal, and over 126,000 infringing objects, while taking down more than 27,000 illegal streaming URLs. The action also led to 148 house searches, 59 judicial referrals, 72 additional criminal investigations, and the identification of 86 suspects. Europol said the operation focused on the broader ecosystem behind piracy services and warned that users of illegal streaming platforms also face cybersecurity risks including malware, spyware, and data theft.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Authorities identified 86 suspects, carried out 148 house searches, referred 59 cases to judicial authorities, and pursued 72 additional criminal investigations linked to the piracy ecosystem. These actions extended the impact of the crackdown beyond the initial takedowns and arrests.
As a result of Operation KRATOS 2, law enforcement agencies arrested 29 suspects and dismantled nine organized crime groups involved in illegal streaming. The action also led to more than 27,000 illegal streaming URLs being removed.
Operation KRATOS 2 ran from September 2025 to April 2026 across 13 countries, with support from private-sector partners. Investigators identified over 18,000 IP addresses, 4,370 piracy-linked domains, nearly 400,000 URLs for suspension or removal, and more than 126,000 infringing objects.
An international law enforcement operation coordinated by Bulgaria with Europol support began to disrupt criminal networks running illegal IPTV and unauthorized streaming services. The seven-month effort focused on the broader technical and criminal infrastructure behind piracy platforms, not just the websites themselves.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcescworld.com
Open sourceeuropol.europa.eu
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Justice announced the seizure of three **U.S.-registered domains** used by Bulgaria-based piracy sites—**`zamunda.net`**, **`arenabg.com`**, and **`zelka.org`**—alleged to have distributed thousands of pirated movies, TV shows, video games, and other copyrighted works. Authorities said the sites drew **tens of millions of visits annually** (with at least one frequently ranking among Bulgaria’s top 10 most-visited domains), generated significant advertising revenue, and enabled **millions of illegal downloads** with an estimated retail value in the **millions of dollars**. The domains now display seizure banners warning that copyright infringement is a crime; the investigation involved U.S. agencies alongside Bulgarian law enforcement and **Europol** support. In parallel, European law enforcement actions highlighted a broader, coordinated crackdown on piracy infrastructure. Italy-led **Operation “Switch Off”**—coordinated with **Europol, Eurojust, and Interpol**—reported the seizure of infrastructure supporting **industrial-scale illegal IPTV services** that allegedly redistributed content from major broadcasters and streaming platforms (including **Sky, DAZN, Mediaset, Amazon Prime, Netflix, Paramount, and Disney+**) to **millions of end users**. Italian authorities said they identified **31 suspects** tied to a transnational organized crime group and noted the use of **anonymization and financial obfuscation tactics** such as cryptocurrency payments and shell companies; industry group ACE publicly named seized services including *IPTVItalia*, *migliorIPTV*, and *DarkTV*.
Jun 29, 2026
U.S. authorities seized more than 1,000 domains allegedly used to illegally stream World Cup 2026 matches in an enforcement campaign known as **Operation Offsides**, led by Homeland Security Investigations and the National Intellectual Property Rights Coordination Center. The Justice Department said earlier actions in June had already targeted nearly 400 domains and related infrastructure tied to Bulgaria and Peru, while partner agencies in Latin America and Europe blocked thousands of additional piracy sites during the broader crackdown. The international investigation also led to the arrest in Colombia of four suspected members of **Los Ciberinfiltrados**, a group accused of illegally accessing telecommunications systems since 2024 and selling pirated streaming services using fraudulent credentials, VPNs, intercepted security codes, and manipulated corporate profiles. Colombian authorities also carried out search-and-seizure operations tied to counterfeit sports apparel, resulting in 11 arrests and convictions, while U.S. officials warned that illicit streaming platforms can expose users to **malware**, scams, and payment or data theft.
Jul 22, 2026
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Jun 29, 2026