Europol IOCTA 2026 Warns AI and Anonymised Infrastructure Are Scaling Cybercrime
Report discovered via Awesome Annual Security Reports.
Summary
Europol’s IOCTA 2026 describes AI-enabled fraud, increasingly concealed criminal infrastructure and fragmented ransomware operations. It reports more than 120 active ransomware brands in 2025 and growing emphasis on data-leak extortion.
Key points
- Europol observed more than 120 active ransomware brands in 2025, with short-lived operations, rebranding and overlapping administrators, affiliates and infrastructure.
- Ransomware extortion increasingly centres on preventing publication of stolen data, supplemented by DDoS attacks, unsolicited calls and corporate email spam.
- The report identifies residential proxies, layered hosting arrangements and criminal-owned infrastructure as obstacles to tracing activity and obtaining evidence across jurisdictions.
- Generative AI is helping fraud networks personalise impersonation and social engineering at scale; the report anticipates further automation through agentic AI.
- Payment-terminal relay attacks increased across the EU in 2025, while cryptocurrency drainers matured into crime-as-a-service offerings that exploit deceptive wallet connections and transaction approvals.
- Operation Endgame actions in November disrupted more than 1,000 servers supporting Rhadamanthys, VenomRAT and the Elysium botnet; the main VenomRAT suspect was arrested in Greece.
- Europol calls for investment in law-enforcement AI capabilities, closer private-sector cooperation and changes to data retention and lawful access, while respecting fundamental rights and data protection.
Article Details
- Publisher
- Europol
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Law-enforcement assessment of cybercrime affecting the EU, covering criminal infrastructure, online fraud, cyber-attacks and online child sexual exploitation.
- Key Statistics
- Europol observed more than 120 active ransomware brands in 2025; the report describes attacks as steadily increasing.
- A SIM-farm service disrupted in October 2025 comprised at least 1,200 SIM-box devices and 40,000 SIM cards; suspects' services enabled the creation of more than 49 million online accounts, with the full scale still under investigation.
- The May 2025 Endgame action took down around 300 servers worldwide, neutralised 650 domains and resulted in international arrest warrants against 20 targets.
- NCMEC financial-extortion CyberTips reports increased from 13,842 in the first six months of 2024 to 23,593 in the same period of 2025, approximately 70%.
- Kidflix had more than 1.8 million registered users and about 80,000 uploaded videos during 2021–2025; the investigation identified approximately 1,400 suspects, led to 79 arrests and safeguarded 39 children.
- Recommendations
- Integrate AI capabilities into law enforcement while respecting fundamental rights and data protection.
- Improve cross-border cooperation and collaboration with online service providers to support lawful access to investigative data.
- Align providers' data retention policies in both retention duration and the types of data retained.
- Strengthen anti-spoofing measures and identity verification in telecommunications to counter criminal SIM-box infrastructure.
- Strengthen law-enforcement powers against financial services that do not comply with EU anti-money-laundering regulations.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cryptomixer[.]io | Seized domain of Cryptomixer, a mixing service suspected of facilitating cybercrime and money laundering, including obfuscation of ransomware proceeds. |
MITRE ATT&CK
T1056.001 · KeyloggingThe Smokeloader pay-per-install service enabled illicit activities including keylogging on victims' machines.T1090.002 · External ProxyCriminal infrastructure uses residential proxies to disguise malicious traffic behind home-user IP addresses.T1090.003 · Multi-hop ProxyCriminals route traffic through chained VPN servers and Tor nodes to obstruct source attribution.T1190 · Exploit Public-Facing ApplicationRansomware operators exploit unpatched vulnerabilities in public-facing applications to obtain initial access.T1486 · Data Encrypted for ImpactRansomware operations encrypt victims' data, including 8Base's documented double-extortion approach.T1496 · Resource HijackingSmokeloader enabled criminals to deploy cryptominers on victims' machines.T1566 · PhishingPhishing is described as a common initial-access vector for ransomware and a principal mechanism in online fraud.T1583.001 · DomainsCriminals register domains hosting imitations of legitimate websites to harvest credentials.T1657 · Financial TheftCryptocurrency drainers trick victims into approving transactions that immediately drain wallet funds.
People
Threat Actors
8baseGroup that developed a Phobos-based variant and used encryption and threatened data publication for double extortion.AkiraRansomware operation with ties to Conti; reportedly expanded targeting of virtualised infrastructure in 2025, likely leveraging SonicWall vulnerabilities.BlackBastaRussian-speaking ransomware group with roots in Conti; internal chats leaked in 2025 and its leak sites became inactive.Cl0pClosed ransomware group known for systematically exploiting zero-day vulnerabilities; resurfaced in February 2025.ContiDefunct group linked in the report to Qilin, Akira and BlackBasta; its leaked codebase is used in DragonForce payloads.DragonForceRansomware group offering customisable payloads and tailored extortion services; an alliance with LockBit and Qilin was announced in September 2025.FogSemi-closed ransomware group using shared infrastructure and maintaining a leak site and negotiation portal.LAPSUS$Extortion collective using spear-phishing, SIM swapping and insider recruitment; reportedly part of the alleged Scattered Hunters alliance.LockBitRansomware operation that attempted to rebound after its 2024 disruption and released LockBit 5.0 in September 2025.NoName057(16)Pro-Russian cybercrime network with a core based in Russia, targeting governments and corporations; resumed activity after disruption in July 2025.PhobosRaaS provider whose infrastructure supported 8Base; activity declined after coordinated law-enforcement actions.PlayRansomware group also known as PlayCrypt; continued double-extortion activity in 2025 and previously targeted critical infrastructure.PlayCryptExplicitly identified as another name for Play, a ransomware group using double extortion.QilinRaaS group offering integrated DDoS capabilities; its core appears based in Russia with ties to Conti.Scattered HuntersAlleged alliance, abbreviated SLSH, reported in August 2025 between Scattered Spider, ShinyHunters and LAPSUS$.Scattered SpiderCollective conducting social engineering, SIM swapping and extortion; responsible for the 2024 Transport for London attack and reportedly part of the alleged Scattered Hunters alliance.ShinyHuntersData-theft and extortion collective reportedly part of the alleged Scattered Hunters alliance; the report attributes theft of over a billion Salesforce customer records to its May 2025 social-engineering activity.The ComNetwork of online communities whose activities intertwine cyber-attacks, extortion, child sexual exploitation and real-world violence.
Malware
8Base**PHOBOS AND 8BASE DISRUPTION[^24]**AkiraAkira, also with ties to Conti, is operating since March 2023 and has maintained significant activity in 2025.Angel Drainerthe acquisition of a large crypto wallet draining service, Inferno Drainer, by a rival draining-as-a-service provider, Angel Drainer, in October 2024)[^12].BumbleBeemalware services, dismantled Bumblebee,DanabotLactrodectus, Qakbot, Hijackloader, DanaBot,DragonForceDragonForce, a largely Russian-speaking group active since 2023, stood out in 2025 with a novel business model, capabilities and competitive approach[^XII].ElysiumRhadamantys, VenomRAT and the ElysiumFogFog, a ransomware first detected in early 2024, has a modular design, allowing attackers to control the targets and scope of the encryption, content of the ransom note and other aspects of the attack.HijackLoaderLactrodectus, Qakbot, Hijackloader, DanaBot,Inferno Drainerthe acquisition of a large crypto wallet draining service, Inferno Drainer, by a rival draining-as-a-service provider, Angel Drainer, in October 2024)[^12].LactrodectusLactrodectus, Qakbot, Hijackloader, DanaBot,LockBitFollowing its takedown in 2024[^20], LockBit has made several attempts to rebound in 2025, although with limited success.Phobos**PHOBOS AND 8BASE DISRUPTION[^24]**QakbotLactrodectus, Qakbot, Hijackloader, DanaBot,QilinQilin emerged as a dominant ransomware family in 2025.RhadamantysRhadamantys, VenomRAT and the ElysiumSmokeLoaderSmokeloader botnet35, which was run as a pay-TrickBotTrickbot and Warmcookie malware strains36.VenomRATRhadamantys, VenomRAT and the ElysiumWarmCookieTrickbot and Warmcookie malware strains36.
Vendors
FortinetThe group seems to be working on automating attack-based vulnerabilities in Fortinet Secure Socket Layer (SSL) VPN devices[^IX], thus enabling affiliates to launch attacks on desired targets.SonicWallIn 2025, Akira also expanded their capabilities to target virtualised infrastructure, likely by leveraging SonicWall[^XI] vulnerabilities for initial access[^19].
Products
LinuxLockBit 5.0 was released in September, including variants capable of targeting Windows, Linux and VMware.Microsoft WindowsLockBit 5.0 was released in September, including variants capable of targeting Windows, Linux and VMware.SalesforceSalesforce customer records by trickingVMwareLockBit 5.0 was released in September, including variants capable of targeting Windows, Linux and VMware.
Countries
DenmarkThe countries involved were Belgium, Canada, Czechia, Denmark, Estonia, Finland, France, Germany,GermanyCoordinated actions took place across Germany, the Netherlands, Romania, Spain, and Sweden, targeting the platform’s administrator, moderators, key vendors, and technical infrastructure.GreeceCroatia, Cyprus, Greece, Hungary, Italy, a limited amount of CSAM freely available on theNetherlandsCoordinated actions took place across Germany, the Netherlands, Romania, Spain, and Sweden, targeting the platform’s administrator, moderators, key vendors, and technical infrastructure.Philippinesabout 80 000 uploaded videos. There were The Philippines continues to be a hotspot for LDCA,RussiaThe core group appears to be based in Russia, with ties to the defunct Conti group.SwitzerlandIn November 2025, Europol supported an action week conducted by LE in Switzerland and Germany in Zurich, Switzerland.UkraineItaly, Latvia, Lithuania, Netherlands, Poland, Romania, Spain, Sweden, Switzerland, Ukraine, and theUnited KingdomIn 2023, Scattered Spider members claimed to have acted as an initial access broker (IAB) against UK and US corporations via the ALPHV/BlackCat ransomware affiliate group.United StatesIn 2023, Scattered Spider members claimed to have acted as an initial access broker (IAB) against UK and US corporations via the ALPHV/BlackCat ransomware affiliate group.
Industries
Financial ServicesParallel to this increased reliance on mobile identity and financial services, some criminal networks involved in OFS have moved away from commercial bulletproof hosting and are increasingly deploying their ownHealthcareengineering, insider threat recruitment, data theft and extortion campaigns against major corporations, healthcare and transport providers.RetailThe group was also responsible for the cyber-attack against Transport for London in 2024, as well as for extorting many UK retail and US healthcare providers[^31].Telecommunications**CAAS NETWORK PROVIDING SIM BOXES FOR TELECOMMUNICATIONS-ENABLED CYBERCRIMES**Transportthreat recruitment, data theft and extortion campaigns against major corporations, healthcare and transport providers.