Criminal networks making millions from illegal access to premium sports broadcasts, film and television channels have been targeted in a major international operation coordinated by Bulgaria with Europol’s support. The seven-month operation resulted in 29 arrests, the dismantling of nine organised crime groups and the removal of over 27 000 illegal streaming URLs.

Operation KRATOS 2 brought together law enforcement authorities from across Europe and beyond to target criminal groups profiting from the unauthorised distribution of copyrighted content through sophisticated online platforms. The operation ran between September 2025 and April 2026, focusing on the criminal infrastructure enabling illegal IPTV services and unauthorised streaming platforms to operate across jurisdictions.

Organised crime adapts to the digital environment

What appears to consumers as cheap access to premium content is powered by complex criminal enterprises. The groups behind illegal streaming services increasingly rely on complex technical infrastructure, separating customer-facing websites from the servers hosting the illegal content and distributing these services across several countries to avoid detection.

In addition to generating significant criminal revenue, these services expose users to cybersecurity risks, including malware infections, spyware, data theft and other forms of online exploitation.

Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem supporting these services. This approach enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.

Results of the operation

The coordinated actions led to:

• 29 arrests
• 86 suspects identified
• 148 house searches
• 9 organised crime groups dismantled
• 59 cases referred to judicial authorities
• 72 ongoing criminal investigations
• 169 domains reported
• 27 332 URLs removed
• 722 961 infringing objects identified

The operation also benefited from extensive cooperation with private sector partners, whose intelligence contributed to the identification and disruption of criminal infrastructures linked to illegal streaming services.

Through this collaboration, authorities identified:

• 4 370 new domains linked to piracy activities
• 18 331 IP addresses associated with illegal services
• 397 384 URLs reported for suspension or removal
• 126 979 additional infringing objects

Rather than focusing solely on taking down websites, investigators targeted the wider criminal ecosystem supporting these services. This approach enabled authorities to gather intelligence on the organised crime groups operating behind the platforms and identify key suspects involved in their management and technical operation.