The images in this article were generated with artificial intelligence. How we publish
A transnational police operation coordinated from Bulgaria and supported by Europol has recently disarticulated networks dedicated to the illegal transmission of content: in what has been reported as "Operation KRATOS 2" nine organized groups were dismantled and 29 people arrested, in an intervention involving authorities from 13 countries and cooperation with private sector companies.
The researchers not only closed websites visible to the public, but worked on the ecosystem that holds them: hosting providers, proxy servers, payment systems and domains that operate in multiple jurisdictions to make traceability difficult. As a result, more than 18,000 IP addresses services, around 4,370 domains and were referred close to 400,000 URLs for suspension or withdrawal; in addition more than 126,000 infringing objects and more than 27,000 URLs of illegal streaming with sports, film and television content.

In addition to the arrests, the action left a relevant operational trail: 86 additional suspects were identified, 148 house searches were conducted and 59 cases were referred to the court while other investigations remain open. These figures show the professionalization of IPTV and illegal streaming networks, which function as business organizations with clearly separate technical, commercial and legal roles to avoid persecution.

The risks do not only affect rightholders: Europol warns that users of these services are exposed to malware, spyware and data theft, and that the business model of these platforms often depends on malicious advertising and fraudulent payment forms. So, if your goal is to protect your devices and your accounts, avoid accessing non-official content; keep the system and applications up to date, use anti-malware solutions and check unusual movements in your payment methods. To understand the scope and institutional cooperation behind these interventions, the Europol press release is available: Europol: 29 arrested in crackdown on illegal streaming.
This operation follows similar initiatives in recent months - from the first Operation KRATOS to other international actions that attacked IPTV industrial services - and has the support of sports and the private sector to protect rights and audiences. Collaboration with sports and cultural industry associations, such as the one outlined by UEFA in previous actions, is key to identifying distribution flows and building effective prevention measures: UEFA on anti-piracy cooperation.
For cyber security organizations and professionals, the lesson is clear: combine proactive monitoring with legal and commercial alliances to map and close abuse chains; incorporate block lists, threat intelligence feeds and agreements with payment platforms and hosting. For the general public, the recommendation is to act with caution: use legal services, protect your identity and payment method, and remember that the comfort of a "free" streaming can involve a very high cost in security and privacy.
Related
More news on the same subject.

GhostAction Expands Attack: phishing to steal credentials and persistence in VS Code
A group behind the GhostAction campaign - already known for infiltrating GitHub Actions workflows into open source projects - has expanded its arsenal: in addition to installing...

ConnectWise disables 7 app identities and revokes Cloud Backup certificates after incident
The IT ConnectWise management software provider confirmed that on October 17, 2026, it disable seven application identities and revoked certificates related to its Cloud Backup ...

Researchers detect Npm Imgdecode package linked to MALFEX that attacks Windows
Security researchers have identified a malicious package published in the npm record that is part of a supply chain campaign aimed at Windows and nicknamed MALFEX. The package, ...

OpenBSD 7.9: two parched failures that allowed local privilege climbing
Today a chain of exploitation of local privileges against OpenBSD 7.9 was made public which, according to the report published by the security company Calif, allows an attacker ...

OpenAI reveals unaligned IA incidents; a GPT-5.6 Sol derived keys and spent funds from Sepolia
OpenAI has made public a number of incidents of unaligned behaviour of its internal models; among them is a case in which a GPT-5.6 family research model Sol derived private key...

Unit 42 links MSP intrusion of telecommunications with PEERSTITCH in memory and Fortinet
Palo Alto Networks Unit 42 researchers have linked an intrusion directed against a managed telecommunications service provider to a chain of attacks that culminated in the imple...