Loading story…
Authorities in seven countries arrested 28 men in a coordinated crackdown on child sexual exploitation linked to dark web forums hosting child sexual abuse material, with operational support from Europol and Eurojust. Investigators said the suspects, aged 22 to 54, allegedly used cryptocurrency payments — including Monero — to buy access to the forums, and the operation led to the safeguarding of three children and the seizure of more than 460 items, including electronic devices, cryptocurrency wallets, drugs, and large quantities of doping substances.
Norway’s Kripos said a cryptocurrency-tracing method developed in 2025 helped identify alleged buyers and two suspected sellers outside Norway, marking a notable development in investigations involving privacy-focused digital currency. Authorities said one suspect used artificial intelligence to generate illegal material, while some victims were members of another suspect’s immediate family; the investigation remains ongoing and officials expect further arrests.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Investigators said one suspect involved in the international child exploitation case used artificial intelligence to generate illegal child sexual abuse material. Authorities also found that some of the victims were members of the suspect’s immediate family.
The international operation led to the arrest of 28 men aged 22 to 54 across seven countries. Authorities also safeguarded three children and seized more than 460 items, including electronic devices, cryptocurrency wallets, drugs, and large quantities of doping substances.
Authorities from seven countries, supported by Europol, carried out a coordinated law enforcement operation targeting child sexual exploitation between late May and mid-June 2026. Investigators said suspects used cryptocurrency, including Monero, to pay for access to dark web forums hosting child sexual abuse material.
Norwegian law enforcement said it developed a cryptocurrency-tracing method in 2025 that was later used to help identify alleged buyers linked to dark web child sexual abuse forums. Authorities said the method also helped identify two suspected sellers outside Norway.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcedarkwebinformer.com
Open sourceeuropol.europa.eu
Open sourceeuropol.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities, backed by Europol and law enforcement partners in 23 countries, launched **Operation Alice** against a major dark web fraud network built around the platform **"Alice with Violence CP"**. Investigators said a 35-year-old man in the People’s Republic of China operated more than **373,000** onion domains that falsely advertised child sexual abuse material and **cybercrime-as-a-service**, took payment in **Bitcoin**, and failed to deliver the promised content. The investigation began in mid-2021 and examined activity spanning November 2019 through July 2025. Between 9 and 19 March 2026, authorities shut down more than **373,000** dark web sites, seized **105 servers** and multiple electronic devices, and identified the alleged operator along with **440 customers** worldwide. Officials estimate the scheme generated more than **EUR 345,000** from roughly **10,000 customers**, while German authorities issued an international arrest warrant and said investigations continue against more than **100 individuals**. Europol added that the operation also supported child protection efforts, including immediate interventions where children were found to be at risk and intelligence development on suspects seeking severe CSAM.
Jun 29, 2026
Romanian authorities, acting on a request from the UK, investigated two Romanian nationals suspected of operating a **hitman-for-hire** marketplace designed to conceal identities and payments. Prosecutors said the platform relied exclusively on **cryptocurrency**, held user funds in escrow until “jobs” were completed, and was structured to make financial flows difficult to trace; searches in Bucharest and Ramnicu Valcea reportedly resulted in the seizure of electronic storage devices, approximately **$650,000 in cryptocurrency**, and significant cash holdings. Potential charges cited include forming an organized criminal group, incitement to murder, attempted murder, and **money laundering**. Separately, police in Zeeland, the Netherlands arrested four suspects following a tip linking them to the theft of **169 NFTs** valued at roughly **€1.4 million**; the operation included seizure of data carriers, money, vehicles, and a residence, though the suspects were later released after interrogation as the investigation continued. The case highlights how blockchain-based assets (including NFTs) remain attractive targets for theft and fraud, with common access vectors including **phishing, social engineering, malware, and seed phrase theft**, and underscores the evidentiary role of seized digital media in crypto-asset investigations.
Jun 29, 2026
Multiple law-enforcement actions were reported across Europe and the U.S. targeting **cyber-enabled criminal activity**, including online intimidation, financial malware operations, and crypto/NFT theft. In Hungary, police working with Romanian authorities detained four young suspects accused of **swatting** and **doxing** tied to disputes initiated via *Discord*, including false bomb and violence threats that triggered significant emergency response deployments. Separately, U.S. authorities convicted two Venezuelan nationals for a multi-state **ATM jackpotting** operation in which they physically accessed older ATMs, connected a laptop, and deployed **malware** to force cash dispensing, resulting in hundreds of thousands of dollars in losses and restitution orders. In Romania, two suspects were investigated at the request of UK authorities over an alleged **hitman-for-hire** marketplace designed to conceal identities and payments via **cryptocurrency escrow**, with police seizing storage devices, crypto valued around **$650,000**, and significant cash. In the Netherlands, Zeeland police arrested four suspects linked to the theft of **169 NFTs** valued at roughly **€1.4 million**, seizing data carriers, cash, vehicles, and a house during raids as the investigation continued.
Jun 29, 2026