The images in this article were generated with artificial intelligence. How we publish
A transnational police operation coordinated from Bulgaria and supported by Europol has recently disarticulated networks dedicated to the illegal transmission of content: in what has been reported as "Operation KRATOS 2" nine organized groups were dismantled and 29 people arrested, in an intervention involving authorities from 13 countries and cooperation with private sector companies.
The researchers not only closed websites visible to the public, but worked on the ecosystem that holds them: hosting providers, proxy servers, payment systems and domains that operate in multiple jurisdictions to make traceability difficult. As a result, more than 18,000 IP addresses services, around 4,370 domains and were referred close to 400,000 URLs for suspension or withdrawal; in addition more than 126,000 infringing objects and more than 27,000 URLs of illegal streaming with sports, film and television content.

In addition to the arrests, the action left a relevant operational trail: 86 additional suspects were identified, 148 house searches were conducted and 59 cases were referred to the court while other investigations remain open. These figures show the professionalization of IPTV and illegal streaming networks, which function as business organizations with clearly separate technical, commercial and legal roles to avoid persecution.

The risks do not only affect rightholders: Europol warns that users of these services are exposed to malware, spyware and data theft, and that the business model of these platforms often depends on malicious advertising and fraudulent payment forms. So, if your goal is to protect your devices and your accounts, avoid accessing non-official content; keep the system and applications up to date, use anti-malware solutions and check unusual movements in your payment methods. To understand the scope and institutional cooperation behind these interventions, the Europol press release is available: Europol: 29 arrested in crackdown on illegal streaming.
This operation follows similar initiatives in recent months - from the first Operation KRATOS to other international actions that attacked IPTV industrial services - and has the support of sports and the private sector to protect rights and audiences. Collaboration with sports and cultural industry associations, such as the one outlined by UEFA in previous actions, is key to identifying distribution flows and building effective prevention measures: UEFA on anti-piracy cooperation.
For cyber security organizations and professionals, the lesson is clear: combine proactive monitoring with legal and commercial alliances to map and close abuse chains; incorporate block lists, threat intelligence feeds and agreements with payment platforms and hosting. For the general public, the recommendation is to act with caution: use legal services, protect your identity and payment method, and remember that the comfort of a "free" streaming can involve a very high cost in security and privacy.
Related
More news on the same subject.

GitLab critical alert: emergency patch fixes CVE-2026-19478 allowing to modify or eliminate public projects without credentials
GitLab published an emergency patch on August 17, 2026 to correct critical vulnerability in its self-hosted software (Community and Enterprise Edition) which, under certain cond...

When the MCP server keeps your credentials: the silent attack vector of the IA in production
The incorporation of IA agents into business processes has opened a practical way for production systems and data to be accessible from models: it is called Model Context Protoc...

Critical alert: CVE-2026-58231 in SAP Commerce Cloud could allow remote code execution; patch and urgent mitigation
A critical vulnerability that affects SAP Commerce Cloud, registered as CVE-2026-58231 and with maximum score 10.0 on the CVSS scale, it is being exploited attempts shortly afte...

The massive purchase of expired domains drives fraud, malware and streaming pirate: the business behind the dropcatch
An intelligence report on DNS published by Infoblox and disseminated by specialized media confirms that criminals are buying large-scale expired domains - the so-called dropcatc...

HoneyMyte updates CoolClient with a signed kernel driver to hide processes and protect the C2 channel
Kaspersky has published an analysis that attributes to the actor known as HoneyMyte (also Mustang Panda) an updated version of the CoolClient backdoor that incorporates a signed...

GeoServer on zero-day vulnerability alert in jsonArrayContains with real risk of remote execution
The GeoServer open source project has a zero-day vulnerability that is being actively explored by attackers, according to researchers' public alerts and the watchTowr intelligen...

AmnesiaStealer MacOS malware that steals credentials and controls real-time browser sessions
Security researchers have documented a new malware family aimed at macOS - called AmnesiaStealer - that combines a dropper in shell, an infostealer written in Rust and a remote ...