Criminal networks making millions from illegal access to premium sports broadcasts, film and television channels have been targeted in a major international operation coordinated by Bulgaria with Europol’s support. The seven-month operation resulted in 29 arrests, the dismantling of nine organised crime groups and the removal of over 27 000 illegal streaming URLs.
Operation KRATOS 2 brought together law enforcement authorities from across Europe and beyond to target criminal groups profiting from the unauthorised distribution of copyrighted content through sophisticated online platforms. The operation ran between September 2025 and April 2026, focusing on the criminal infrastructure enabling illegal IPTV services and unauthorised streaming platforms to operate across jurisdictions.
Organised crime adapts to the digital environment
What appears to consumers as cheap access to premium content is powered by complex criminal enterprises. The groups behind illegal streaming services increasingly rely on complex technical infrastructure, separating customer-facing websites from the servers hosting the illegal content and distributing these services across several countries to avoid detection.
In addition to generating significant criminal revenue, these services expose users to cybersecurity risks, including malware infections, spyware, data theft and other forms of online exploitation.
Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem supporting these services. This approach enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.
Results of the operation
The coordinated actions led to:
- 29 arrests
- 86 suspects identified
- 148 house searches
- 9 organised crime groups dismantled
- 59 cases referred to judicial authorities
- 72 ongoing criminal investigations
- 169 domains reported
- 27 332 URLs removed
- 722 961 infringing objects identified
The operation also benefited from extensive cooperation with private sector partners, whose intelligence contributed to the identification and disruption of criminal infrastructures linked to illegal streaming services.
Through this collaboration, authorities identified:
- 4 370 new domains linked to piracy activities
- 18 331 IP addresses associated with illegal services
- 397 384 URLs reported for suspension or removal
- 126 979 additional infringing objects
Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem supporting these services. This approach enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.
Europol’s support
Europol co-led the operational coordination alongside Bulgaria’s General Directorate Combating Organised Crime (GDBOP).
Throughout the operational phase, Europol facilitated intelligence exchange between participating countries, coordinated cross-border cooperation and provided operational and technical support to national authorities.
Information received from private sector partners was shared securely through Europol’s Secure Information Exchange Network Application (SIENA), enabling investigators to develop a comprehensive intelligence picture of the criminal ecosystem and coordinate action across multiple jurisdictions.
The Agency also supported the collection and analysis of operational results to identify emerging threats and support future investigations targeting digital piracy networks.
Participants
The operation involved authorities from Belgium, Bulgaria, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the United Kingdom and the United States.
Europol worked closely with strategic partners from the audiovisual and anti-piracy sectors, including AAPA, ACE/MPA, LALIGA, UEFA, Friend MTS, beIN Media Group and Irdeto.
