The seizure of two mobile phones in a small Swedish town exposed a resilient criminal architecture stretching across Europe, Asia and Australia. On 4 March, coordinated actions in Spain, Sweden and Thailand struck key nodes of this network, building on earlier operational activity in Australia.

Forensic analysis revealed not one organised crime group, but multiple interconnected networks involved in large-scale drug trafficking and money laundering. They were bound together by a web of companies and other structures.

Most of the key targets identified had previously been unknown to law enforcement. The true scale and structure of the criminal ecosystem only emerged once investigators unlocked the data inside the devices.

Led by Swedish authorities and known as Operation Candy, the investigation shows how locally rooted criminals can operate globally - and how digital evidence can bring an entire hidden system to light.

Local roots, global reach

The case began in November 2023, when Swedish authorities seized two mobile phones from a local drug trafficker in Sweden.

What initially appeared to be a local investigation quickly escalated. Forensic analysis of the devices revealed encrypted communications, international contacts and operational details pointing far beyond Sweden.

Experts at Europol supported Swedish investigators in analysing the data. What emerged was not a single organised crime group, but multiple criminal networks dealing in synthetic drugs and large-scale money laundering. They were all interconnected through shared facilitators and a sophisticated web of corporate entities used to obscure ownership, logistics and financial flows.

A web spanning continents

Data recovered from the devices exposed how the interconnected networks operated across multiple crime areas and jurisdictions.

• In a Swedish investigation that led to Thailand, members of the network were running a large-scale online drug distribution business supplying customers in the Nordic region.
• In Sweden, actors were managing domestic drug distribution while operating parallel money laundering structures to recycle criminal profits.
• In Germany, 1.2 tonnes of illicit drugs destined for the Australian market were intercepted, a shipment organised through the same criminal ecosystem.
• In Australia, the distributors awaiting that consignment were identified and arrested.
• In Spain, a high-value target was facilitating large scale narcotics trafficking.

Together, these activities revealed a decentralised but connected system, trafficking different drugs, moving profits across borders and using layered business structures to shield those directing operations.

Simultaneous action across continents

With the key roles identified, law enforcement prepared for the final phase of the investigation.

On 4 March, authorities carried out about 20 simultaneous house searches, striking key nodes of the network. These actions were coordinated from command posts from several locations in Europe, with investigators working side by side at a central command post here at Europol.

The operation resulted in:

• 13 arrests in Spain, Sweden and Thailand (4 in Spain, 6 in Sweden, 3 in Thailand).
• The targeting of multiple high-value criminal figures
• Significant seizures of criminal assets worth €4 million euro with tracing of more assets to come.

These actions build on earlier operational activity in Australia against two alleged members of a criminal syndicate, bringing the total number of arrests to 15

The Australian Victorian Joint Organised Crime Taskforce (JOCTF), comprising the Australian Federal Police (AFP), Victoria Police and Australian Border Force (ABF), started an investigation after receiving a referral from German Customs who detected and seized 1.2 tonnes of illicit drugs destined for Melbourne in February 2025 following a thorough and complex analysis. The illicit drugs were concealed in two shipping containers manifested to contain a product commonly used in the manufacture of roads.

German law enforcement removed the illicit substances before allowing the consignment to be shipped to Australia. When the containers arrived at the Port of Melbourne in April 2025 law enforcement inserted an inert substance into the consignment and then released it for delivery under police surveillance.

The consignment was delivered to a warehouse in Victoria’s central highlands before being delivered to a factory in the Melbourne suburb of Sunshine. Two men, aged 32, and 52, are currently before the courts in Australia - charged for their roles in the alleged importation attempt.

Criminal networks embedded in the legal economy

Rather than operating as isolated groups, the networks relied on a web of companies across multiple jurisdictions to conceal drug shipments, disguise ownership structures and launder profits.

Corporate entities were used to facilitate logistics, manage financial transactions and create layers of separation between leadership figures and operational activity.

This case reflects a broader shift in serious and organised crime: rather than rigid hierarchical groups, today’s most threatening actors operate as flexible, interconnected networks embedded within the legal economy.

According to Europol’s latest assessment of the EU’s most threatening criminal networks, 86% misuse legal business structures to facilitate operations, conceal illicit activity and launder profits. Sectors such as logistics, construction and real estate are particularly vulnerable. By infiltrating legitimate markets and using corporate structures as shields, these networks increase their resilience and reduce their visibility to law enforcement

A global problem requires a global response

This operation reflects the core mission of Europol: bringing together the right expertise from its network of over 3 500 law enforcement authorities to support Member States in tackling the most complex criminal threats. By connecting investigations that span borders, crime areas and continents, Europol helps turn local leads into coordinated international action against the highest levels of organised crime.

Europol provided comprehensive, long-term support that was crucial to the success of this operation. This included advanced analytical cooperation and operational coordination, specialist expertise in areas such as cryptocurrency analysis, the development of tailored intelligence products and reports, and dedicated funding to enable complex cross-border investigative actions. By combining these capabilities,

Europol ensured that local leads could be transformed into coordinated international operations against the highest levels of organised crime.

Starting in early 2025, Eurojust coordinated the international judicial cooperation essential for this investigation. Authorities from Sweden, Germany, Spain and Australia came together with Eurojust to set strategic plans and coordinate the judicial actions to be taken. Eurojust also ensured the execution of European Investigation Orders, European Arrest Warrants and Freezing Orders to several countries. During the action day, the Agency supported the judicial authorities in Sweden and Spain to solve and support urgent changes and follow up on the results of the execution of the various legal requests.