Pierluigi Paganini
June 04, 2026
An international law enforcement operation, codenamed Operation KRATOS and involving 13 countries (Belgium, Bulgaria, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the UK, and the US), spent seven months quietly dismantling the infrastructure behind illegal streaming operations. The operation coordinated by Bulgaria with Europol’s support, ran from September 2025 to April 2026 and ended with 29 arrests and nine organized crime groups dismantled. Belgium, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the UK, and the US all had skin in the game.
“Criminal networks making millions from illegal access to premium sports broadcasts, film and television channels have been targeted in a major international operation coordinated by Bulgaria with Europol’s support.” reads the press release published by EUROPOL. “The seven-month operation resulted in 29 arrests, the dismantling of nine organised crime groups and the removal of over 27 000 illegal streaming URLs.”
Private sector partners also participated in the operation. Investigators identified 18,331 IP addresses tied to illegal services and 4,370 new domains linked to piracy. They flagged nearly 400,000 URLs for suspension or removal and pulled down 27,332 illegal streaming links carrying unauthorized sports, film, and television content. On top of that, they identified over 722,000 infringing objects in total.
Arrests are only part of the picture. Authorities identified 86 additional suspects, ran 148 house searches, referred 59 cases to judicial authorities, and have 72 more criminal investigations still open.
What made this operation different from the usual whack-a-mole approach was where investigators aimed.
“Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem supporting these services.” continues the press release. “This approach enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.”
That distinction matters because these networks are built to survive takedowns of their front-facing sites.
“The groups behind illegal streaming services increasingly rely on complex technical infrastructure, separating customer-facing websites from the servers hosting the illegal content and distributing these services across several countries to avoid detection.” continues the announcement.
Spreading infrastructure across borders isn’t an accident, it’s the business model. What looks to the consumer like a cheap shortcut to a football match is, under the hood, a cross-border criminal operation.
Europol also flagged something that often gets buried in piracy discussions: the risk to users themselves.
“In addition to generating significant criminal revenue, these services expose users to cybersecurity risks, including malware infections, spyware, data theft and other forms of online exploitation.” concludes the press release.
Paying a few euros a month for illegal sports access and handing your payment details to an organized crime group turns out to be a suboptimal trade.
Intelligence from private sector partners moved through Europol’s SIENA secure network, letting investigators build a cross-border picture of criminal infrastructure before moving. The list of the partners imcludes LALIGA, UEFA, ACE/MPA, beIN Media Group, and Irdeto alongside anti-piracy specialists AAPA, Friend MTS, and Irdeto. When sports rights holders and law enforcement coordinate this tightly, the operational picture gets considerably sharper.
This is the second major KRATOS operation. The first, in summer 2024, shut down a network with over 22 million users worldwide and produced 11 arrests, 102 identified suspects, and 112 searches.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
