{"table":"sources","columns":["reference_id","slug","source_type","source_quality","title","publisher","published_on","url","archive_url","official","language","supports","notes"],"row_count":176,"research_cutoff_on":"2026-08-21","generated_on":"2026-08-21","terms":"Free to reuse with attribution to the Internet Takedown Index. A research aggregation of public reporting, not a legal reference.","rows":[{"reference_id":"src_doj_sdny_silk_road_2013","slug":"united-states-attorney-s-office-southern-district-of-new-york-manhattan-u-s-atto","source_type":"prosecutor_release","source_quality":"P1","title":"Manhattan U.S. Attorney Announces Seizure Of Additional $28 Million Worth Of Bitcoins Belonging To Ross William Ulbricht, Alleged Owner And Operator Of Silk Road Website","publisher":"United States Attorney's Office, Southern District of New York","published_on":"2013-10-25","url":"https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-seizure-additional-28-million-worth-bitcoins-belonging","archive_url":null,"official":true,"language":"en","supports":"Silk Road seizure, Ulbricht arrest and charges, Bitcoin seizure","notes":["URL not re-verified character-for-character in this pass. Retrieve from justice.gov before import."]},{"reference_id":"src_court_ulbricht_judgment","slug":"united-states-district-court-for-the-southern-district-of-new-york-united-states","source_type":"judgment","source_quality":"P0","title":"United States v. Ross William Ulbricht, judgment and sentencing record","publisher":"United States District Court for the Southern District of New York","published_on":"2015-05-29","url":"https://law.justia.com/cases/federal/appellate-courts/ca2/15-1815/15-1815-2017-05-31.html","archive_url":null,"official":true,"language":"en","supports":"Conviction, sentence, and appellate history","notes":["Docket number not captured in this pass. MATERIAL GAP for a P0 citation.","Public appellate opinion identifies underlying criminal docket 14 Cr. 68 and affirms judgment; used as accessible case-status source because the district judgment PDF was not directly located."]},{"reference_id":"src_doj_sdny_silk_road_2_2014","slug":"united-states-attorney-s-office-southern-district-of-new-york-operator-of-silk-r","source_type":"prosecutor_release","source_quality":"P1","title":"Operator Of Silk Road 2.0 Website Charged In Manhattan Federal Court","publisher":"United States Attorney's Office, Southern District of New York","published_on":"2014-11-06","url":"https://www.justice.gov/usao-sdny/pr/operator-silk-road-20-website-charged-manhattan-federal-court","archive_url":null,"official":true,"language":"en","supports":"Silk Road 2.0 seizure, Benthall arrest and charges, seizure of additional dark markets","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_onymous_2014","slug":"europol-global-action-against-dark-markets-on-tor-network","source_type":"international_agency_release","source_quality":"P2","title":"Global action against dark markets on Tor network","publisher":"Europol","published_on":"2014-11-07","url":"https://www.europol.europa.eu/media-press/newsroom/news/global-action-against-dark-markets-tor-network","archive_url":null,"official":true,"language":"en","supports":"European component of Operation Onymous, arrest and server figures","notes":["URL not re-verified in this pass."]},{"reference_id":"src_news_onymous_2014","slug":"major-independent-news-organizations-contemporaneous-reporting-on-operation-onym","source_type":"news_report","source_quality":"S1","title":"Contemporaneous reporting on Operation Onymous","publisher":"Major independent news organizations","published_on":"2014-11-07","url":null,"archive_url":null,"official":false,"language":"en","supports":"Discrepancies in the reported number of seized hidden services","notes":["Placeholder for the specific article to be attached at verification. Do not import as-is.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_alphabay_2017","slug":"united-states-department-of-justice-alphabay-the-largest-online-dark-market-shut","source_type":"government_release","source_quality":"P1","title":"AlphaBay, the Largest Online 'Dark Market,' Shut Down","publisher":"United States Department of Justice","published_on":"2017-07-20","url":"https://www.justice.gov/usao-edca/pr/alphabay-largest-online-dark-market-shut-down","archive_url":null,"official":true,"language":"en","supports":"AlphaBay seizure, Cazes arrest and death, charges, scale figures","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_bayonet_2017","slug":"europol-massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-","source_type":"international_agency_release","source_quality":"P2","title":"Massive blow to criminal dark web activities after globally coordinated operation","publisher":"Europol","published_on":"2017-07-20","url":"https://www.europol.europa.eu/media-press/newsroom/news/massive-blow-to-criminal-dark-web-activities-after-globally-coordinated-operation","archive_url":null,"official":true,"language":"en","supports":"Joint AlphaBay and Hansa operation structure and coordination roles","notes":["URL not re-verified in this pass."]},{"reference_id":"src_politie_hansa_2017","slug":"politie-netherlands-dutch-national-police-statement-on-the-takeover-and-shutdown","source_type":"law_enforcement_release","source_quality":"P1","title":"Dutch National Police statement on the takeover and shutdown of Hansa Market","publisher":"Politie (Netherlands)","published_on":"2017-07-20","url":"https://www.om.nl/actueel/nieuws/2017/07/20/ondergrondse-hansa-market-overgenomen-en-neergehaald","archive_url":null,"official":true,"language":"nl","supports":"Covert takeover of Hansa, duration of covert operation, server seizures, administrator arrests","notes":["Original-language title not captured. Translation required. MATERIAL GAP.","Original Politie statement URL was not recoverable; replaced with equivalent official Netherlands Public Prosecution Service release."]},{"reference_id":"src_bitdefender_hansa_2017","slug":"bitdefender-bitdefender-account-of-technical-support-to-europol-ec3-on-hansa","source_type":"participating_company_report","source_quality":"T1","title":"Bitdefender account of technical support to Europol EC3 on Hansa","publisher":"Bitdefender","published_on":"2017-07-20","url":"https://www.bitdefender.com/en-gb/news/bitdefender-expertise-helps-international-law-enforcement-in-takedown-of-global-dark-markets-3347","archive_url":null,"official":false,"language":"en","supports":"Technical partner role in locating the Hansa infrastructure","notes":["URL not re-verified in this pass."]},{"reference_id":"src_bka_hydra_2022","slug":"bundeskriminalamt-bundeskriminalamt-statement-on-the-seizure-of-the-hydra-market","source_type":"law_enforcement_release","source_quality":"P1","title":"Bundeskriminalamt statement on the seizure of the Hydra Market server infrastructure","publisher":"Bundeskriminalamt","published_on":"2022-04-05","url":"https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2022/Presse2022/220405_PM_IllegalerDarknetMarktplatz.html","archive_url":null,"official":true,"language":"de","supports":"Server seizure in Germany, Bitcoin seizure, confirmation of no arrests","notes":["Original German title not captured. Translation required. MATERIAL GAP."]},{"reference_id":"src_doj_hydra_2022","slug":"united-states-department-of-justice-justice-department-investigation-leads-to-sh","source_type":"government_release","source_quality":"P1","title":"Justice Department Investigation Leads to Shutdown of Largest Online Darknet Marketplace","publisher":"United States Department of Justice","published_on":"2022-04-05","url":"https://www.justice.gov/usao-ndca/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace","archive_url":null,"official":true,"language":"en","supports":"US charges against Dmitry Pavlov, marketplace scale, parallel sanctions","notes":["URL not re-verified in this pass."]},{"reference_id":"src_elliptic_hydra_2022","slug":"elliptic-elliptic-analysis-of-the-hydra-market-bitcoin-seizure","source_type":"cybersecurity_report","source_quality":"T2","title":"Elliptic analysis of the Hydra Market Bitcoin seizure","publisher":"Elliptic","published_on":"2022-04-05","url":"https://www.elliptic.co/blog/5-billion-darknet-market-hydra-seized-by-german-authorities","archive_url":null,"official":false,"language":"en","supports":"Confirmation of 543.3 BTC seized across 88 transactions; successor market ecosystem","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_archetyp_2025","slug":"europol-europol-release-on-the-takedown-of-archetyp-market","source_type":"international_agency_release","source_quality":"P2","title":"Europol release on the takedown of Archetyp Market","publisher":"Europol","published_on":"2025-06-16","url":"https://www.europol.europa.eu/media-press/newsroom/news/europe-wide-takedown-hits-longest-standing-dark-web-drug-market","archive_url":null,"official":true,"language":"en","supports":"Operation dates, participating agencies and roles, arrests, asset seizure, marketplace scale","notes":["URL not re-verified in this pass. Europol is the coordinator rather than the executing authority; a BKA release is preferred as P1."]},{"reference_id":"src_bka_archetyp_2025","slug":"bundeskriminalamt-bundeskriminalamt-statement-on-operation-deep-sentinel","source_type":"law_enforcement_release","source_quality":"P1","title":"Bundeskriminalamt statement on Operation Deep Sentinel","publisher":"Bundeskriminalamt","published_on":"2025-06-16","url":null,"archive_url":null,"official":true,"language":"de","supports":"German lead role, arrests, seizure details","notes":["Original German title not captured. Translation required.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_raidforums_2022","slug":"united-states-department-of-justice-justice-department-announces-court-authorize","source_type":"government_release","source_quality":"P1","title":"Justice Department Announces Court-Authorized Seizure of RaidForums Website","publisher":"United States Department of Justice","published_on":"2022-04-12","url":"https://www.justice.gov/usao-edva/pr/us-leads-seizure-one-world-s-largest-hacker-forums-and-arrests-administrator","archive_url":null,"official":true,"language":"en","supports":"Domain seizures, indictment of Diogo Santos Coelho, forum scale","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_tourniquet_2022","slug":"europol-one-of-the-world-s-biggest-hacker-forums-taken-down","source_type":"international_agency_release","source_quality":"P2","title":"One of the world's biggest hacker forums taken down","publisher":"Europol","published_on":"2022-04-12","url":"https://www.europol.europa.eu/media-press/newsroom/news/one-of-world%E2%80%99s-biggest-hacker-forums-taken-down","archive_url":null,"official":true,"language":"en","supports":"Operation Tourniquet coordination, participating countries, UK arrest","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_genesis_2023","slug":"united-states-department-of-justice-genesis-market-a-major-initial-access-broker","source_type":"government_release","source_quality":"P1","title":"Genesis Market, a major initial access broker, seized in international operation","publisher":"United States Department of Justice","published_on":"2023-04-05","url":"https://www.justice.gov/archives/opa/pr/criminal-marketplace-disrupted-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"Domain seizures under an EDWI warrant, US server seizures","notes":["URL and exact release title not re-verified in this pass."]},{"reference_id":"src_europol_cookie_monster_2023","slug":"europol-takedown-of-genesis-market-the-largest-online-marketplace-for-stolen-cre","source_type":"international_agency_release","source_quality":"P2","title":"Takedown of Genesis Market, the largest online marketplace for stolen credentials","publisher":"Europol","published_on":"2023-04-05","url":"https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-notorious-hacker-marketplace-selling-your-identity-to-criminals","archive_url":null,"official":true,"language":"en","supports":"17-country coordination, 119 arrests, 208 property searches","notes":["URL not re-verified in this pass."]},{"reference_id":"src_nca_genesis_2023","slug":"national-crime-agency-nca-statement-on-operation-cookie-monster","source_type":"law_enforcement_release","source_quality":"P2","title":"NCA statement on Operation Cookie Monster","publisher":"National Crime Agency","published_on":"2023-04-05","url":"https://www.nationalcrimeagency.gov.uk/news/notorious-criminal-marketplace-selling-victim-identities-taken-down-in-international-operation","archive_url":null,"official":true,"language":"en","supports":"UK arrests and searches","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_fitzpatrick_2023","slug":"united-states-district-court-for-the-eastern-district-of-virginia-united-states-","source_type":"court_filing","source_quality":"P0","title":"United States v. Conor Brian Fitzpatrick, criminal complaint and affidavit","publisher":"United States District Court for the Eastern District of Virginia","published_on":"2023-03-16","url":"https://www.justice.gov/usao-edva/united-states-v-conor-brian-fitzpatrick","archive_url":null,"official":true,"language":"en","supports":"Arrest, charge, and identification of the BreachForums administrator","notes":["Docket number not captured. Arrest date conflicts across sources."]},{"reference_id":"src_news_breachforums_2023","slug":"established-specialist-cybersecurity-publication-specialist-reporting-on-the-bre","source_type":"news_report","source_quality":"S2","title":"Specialist reporting on the BreachForums shutdown and later sentencing","publisher":"Established specialist cybersecurity publication","published_on":"2023-03-29","url":"https://www.justice.gov/usao-edva/pr/justice-department-announces-arrest-founder-one-worlds-largest-hacker-forums-and","archive_url":null,"official":false,"language":"en","supports":"Forum shutdown decision, staff statements, sentencing and resentencing history","notes":["Placeholder. Attach the specific article at verification.","Replaced generic specialist-reporting stub with official DOJ arrest/disruption release."]},{"reference_id":"src_fbi_breachforums_seizure_2024","slug":"federal-bureau-of-investigation-fbi-seizure-notice-and-statement-regarding-breac","source_type":"law_enforcement_release","source_quality":"P1","title":"FBI seizure notice and statement regarding BreachForums","publisher":"Federal Bureau of Investigation","published_on":"2024-05-15","url":"https://techcrunch.com/2024/05/15/fbi-seizes-hacking-forum-breachforums-again/","archive_url":null,"official":true,"language":"en","supports":"Domain and Telegram channel seizure","notes":["The seizure banner itself is the principal artifact. URL not re-verified.","No operation-specific FBI/DOJ press release was located; original source stub described a seizure notice. URL is contemporaneous TechCrunch reporting quoting the FBI seizure page and recording agencies shown on the notice."]},{"reference_id":"src_news_breachforums_2024","slug":"established-specialist-cybersecurity-publication-specialist-reporting-on-the-202","source_type":"news_report","source_quality":"S2","title":"Specialist reporting on the 2024 BreachForums seizure and brief domain recovery","publisher":"Established specialist cybersecurity publication","published_on":"2024-05-16","url":"https://www.scworld.com/news/breachforums-seized-by-fbi-for-2nd-time","archive_url":null,"official":false,"language":"en","supports":"Temporary recovery of the domain by operators","notes":["Placeholder. Attach the specific article at verification."]},{"reference_id":"src_news_breachforums_2025","slug":"established-specialist-cybersecurity-publication-specialist-reporting-on-the-2-2","source_type":"news_report","source_quality":"S2","title":"Specialist reporting on the 2025 BreachForums portal seizure","publisher":"Established specialist cybersecurity publication","published_on":null,"url":"https://www.infosecurity-magazine.com/news/fbi-french-police-shutter/","archive_url":null,"official":false,"language":"en","supports":"2025 seizure of the BreachForums portal","notes":["MATERIAL GAP. No official primary source located in this pass."]},{"reference_id":"src_doj_gameover_zeus_2014","slug":"united-states-department-of-justice-u-s-leads-multi-national-action-against-game","source_type":"government_release","source_quality":"P1","title":"U.S. Leads Multi-National Action Against 'Gameover Zeus' Botnet and 'Cryptolocker' Ransomware, Charges Botnet Administrator","publisher":"United States Department of Justice","published_on":"2014-06-02","url":"https://www.justice.gov/usao-wdpa/pr/us-leads-multi-national-action-against-gameover-zeus-botnet-and-cryptolocker-ransomware","archive_url":null,"official":true,"language":"en","supports":"Disruption technique, Bogachev indictment, infection and loss estimates, partner roster","notes":["URL not re-verified in this pass."]},{"reference_id":"src_nca_tovar_2014","slug":"national-crime-agency-nca-statement-on-operation-tovar","source_type":"law_enforcement_release","source_quality":"P2","title":"NCA statement on Operation Tovar","publisher":"National Crime Agency","published_on":"2014-06-02","url":null,"archive_url":null,"official":true,"language":"en","supports":"UK role and victim notification window","notes":["URL not re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_secureworks_gameover_2014","slug":"secureworks-secureworks-analysis-of-the-gameover-zeus-peer-to-peer-network-and-i","source_type":"participating_company_report","source_quality":"T1","title":"Secureworks analysis of the Gameover Zeus peer-to-peer network and its disruption","publisher":"Secureworks","published_on":"2014-07-01","url":null,"archive_url":null,"official":false,"language":"en","supports":"Technical mechanics of the sinkhole and the subsequent variant resurgence","notes":["URL not re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_europol_avalanche_2016","slug":"europol-avalanche-network-dismantled-in-international-cyber-operation","source_type":"international_agency_release","source_quality":"P2","title":"'Avalanche' network dismantled in international cyber operation","publisher":"Europol","published_on":"2016-12-01","url":"https://www.europol.europa.eu/media-press/newsroom/news/%E2%80%98avalanche%E2%80%99-network-dismantled-in-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"Domain, server, arrest, and search figures; participating organizations and roles","notes":["URL not re-verified in this pass. A Verden prosecutor release is preferred as P1."]},{"reference_id":"src_doj_avalanche_2016","slug":"united-states-department-of-justice-us-department-of-justice-statement-on-the-av","source_type":"government_release","source_quality":"P2","title":"US Department of Justice statement on the Avalanche network takedown","publisher":"United States Department of Justice","published_on":"2016-12-01","url":"https://www.justice.gov/usao-wdpa/pr/avalanche-network-dismantled-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"US participation in the disruption","notes":["URL not re-verified in this pass."]},{"reference_id":"src_shadowserver_avalanche_2016","slug":"the-shadowserver-foundation-shadowserver-foundation-account-of-the-avalanche-sin","source_type":"participating_company_report","source_quality":"T1","title":"Shadowserver Foundation account of the Avalanche sinkhole operation","publisher":"The Shadowserver Foundation","published_on":"2016-12-01","url":"https://www.shadowserver.org/news/avalanche-year-two-this-time-with-andromeda/","archive_url":null,"official":false,"language":"en","supports":"Sinkhole operation and long-running victim notification","notes":["URL not re-verified in this pass.","Official participant retrospective, published one year after the action rather than on the input source date."]},{"reference_id":"src_europol_emotet_2021","slug":"europol-world-s-most-dangerous-malware-emotet-disrupted-through-global-action","source_type":"international_agency_release","source_quality":"P2","title":"World's most dangerous malware EMOTET disrupted through global action","publisher":"Europol","published_on":"2021-01-27","url":"https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action","archive_url":null,"official":true,"language":"en","supports":"Infrastructure takeover, participating authorities, Ukrainian arrests, infection scale","notes":["URL not re-verified in this pass."]},{"reference_id":"src_welivesecurity_emotet_2021","slug":"eset-welivesecurity-emotet-botnet-disrupted-following-global-law-enforcement-ope","source_type":"cybersecurity_report","source_quality":"T2","title":"Emotet botnet disrupted following global law enforcement operation","publisher":"ESET WeLiveSecurity","published_on":"2021-01-28","url":"https://www.welivesecurity.com/2021/01/28/emotet-botnet-disrupted-global-operation/","archive_url":null,"official":false,"language":"en","supports":"Technical description of the takeover and the planned uninstall module","notes":["URL verified as present in the research record."]},{"reference_id":"src_secalliance_emotet","slug":"secalliance-will-emotet-ever-bounce-back","source_type":"cybersecurity_report","source_quality":"T2","title":"Will Emotet ever bounce back?","publisher":"SecAlliance","published_on":null,"url":"https://www.secalliance.com/blog/will-emotet-ever-bounce-back","archive_url":null,"official":false,"language":"en","supports":"Emotet's November 2021 return and rebuild","notes":["URL verified as present in the research record. Publication date not captured."]},{"reference_id":"src_doj_qakbot_2023","slug":"united-states-department-of-justice-qakbot-malware-disrupted-in-international-cy","source_type":"government_release","source_quality":"P1","title":"Qakbot Malware Disrupted in International Cyber Takedown","publisher":"United States Department of Justice","published_on":"2023-08-29","url":"https://www.justice.gov/usao-cdca/pr/qakbot-malware-disrupted-international-cyber-takedown","archive_url":null,"official":true,"language":"en","supports":"Traffic redirection, uninstaller deployment, server and cryptocurrency seizures, absence of arrests","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_qakbot_2023","slug":"europol-europol-release-on-the-qakbot-infrastructure-takedown","source_type":"international_agency_release","source_quality":"P2","title":"Europol release on the Qakbot infrastructure takedown","publisher":"Europol","published_on":"2023-08-29","url":"https://www.europol.europa.eu/media-press/newsroom/news/qakbot-botnet-infrastructure-shattered-after-international-operation","archive_url":null,"official":true,"language":"en","supports":"European participation and coordination roles","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_qakbot_gallyamov_2025","slug":"united-states-department-of-justice-us-department-of-justice-announcement-chargi","source_type":"government_release","source_quality":"P1","title":"US Department of Justice announcement charging the alleged Qakbot leader and seizing cryptocurrency","publisher":"United States Department of Justice","published_on":"2025-05-22","url":"https://www.justice.gov/usao-cdca/pr/russian-national-and-leader-qakbot-malware-conspiracy-indicted-long-running-global","archive_url":null,"official":true,"language":"en","supports":"Gallyamov charge, continued operation after the 2023 takedown","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_911s5_2024","slug":"united-states-department-of-justice-911-s5-botnet-dismantled-and-its-administrat","source_type":"government_release","source_quality":"P1","title":"911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation","publisher":"United States Department of Justice","published_on":"2024-05-29","url":"https://www.justice.gov/archives/opa/pr/911-s5-botnet-dismantled-and-its-administrator-arrested-coordinated-international-operation","archive_url":null,"official":true,"language":"en","supports":"Arrest of YunHe Wang, domain and server seizures, 19 million compromised IP addresses including 613,841 in the United States","notes":["URL not re-verified in this pass."]},{"reference_id":"src_treasury_911s5_2024","slug":"united-states-department-of-the-treasury-treasury-sanctions-actors-behind-the-91","source_type":"government_release","source_quality":"P2","title":"Treasury Sanctions Actors Behind the 911 S5 Botnet","publisher":"United States Department of the Treasury","published_on":"2024-05-28","url":"https://home.treasury.gov/news/press-releases/jy2375","archive_url":null,"official":true,"language":"en","supports":"Sanctions designations of Wang, associates, and three Thai entities","notes":["Sanctions are recorded as a parallel action, not as criminal charges."]},{"reference_id":"src_europol_endgame_2024","slug":"europol-largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem","source_type":"international_agency_release","source_quality":"P2","title":"Largest ever operation against botnets hits dropper malware ecosystem","publisher":"Europol","published_on":"2024-05-30","url":"https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem","archive_url":null,"official":true,"language":"en","supports":"Wave 1 infrastructure figures, initiating countries, arrests","notes":["URL not re-verified in this pass."]},{"reference_id":"src_bka_endgame_2024","slug":"bundeskriminalamt-bundeskriminalamt-statement-and-wanted-list-published-for-oper","source_type":"law_enforcement_release","source_quality":"P1","title":"Bundeskriminalamt statement and wanted list published for Operation Endgame","publisher":"Bundeskriminalamt","published_on":"2024-05-30","url":"https://www.bka.de/DE/DasBKA/OrganisationAufbau/Fachabteilungen/Cybercrime/Endgame/Endgame.html","archive_url":null,"official":true,"language":"de","supports":"Named suspects remaining at large, German lead role","notes":["Original German title not captured. Translation required."]},{"reference_id":"src_europol_endgame_2025","slug":"europol-europol-release-on-operation-endgame-s-2025-action-against-initial-acces","source_type":"international_agency_release","source_quality":"P2","title":"Europol release on Operation Endgame's 2025 action against initial access malware","publisher":"Europol","published_on":"2025-05-23","url":"https://www.europol.europa.eu/media-press/newsroom/news/operation-endgame-strikes-again-ransomware-kill-chain-broken-its-source","archive_url":null,"official":true,"language":"en","supports":"Wave 2 infrastructure figures, charges, cryptocurrency seizures","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_danabot_2025","slug":"united-states-district-court-for-the-central-district-of-california-united-state","source_type":"indictment","source_quality":"P0","title":"United States v. Aleksandr Stepanov et al., DanaBot indictment","publisher":"United States District Court for the Central District of California","published_on":"2025-05-22","url":"https://www.justice.gov/usao-cdca/pr/16-defendants-federally-charged-connection-danabot-malware-scheme-infected-computers","archive_url":null,"official":true,"language":"en","supports":"16-defendant DanaBot charges announced with the Endgame wave","notes":["Defendant names not individually captured in this pass. Documented named-person gap."]},{"reference_id":"src_europol_endgame_2025_nov","slug":"europol-europol-release-on-the-november-2025-operation-endgame-action-against-rh","source_type":"international_agency_release","source_quality":"P2","title":"Europol release on the November 2025 Operation Endgame action against Rhadamanthys, VenomRAT and Elysium","publisher":"Europol","published_on":"2025-11-14","url":"https://www.europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down","archive_url":null,"official":true,"language":"en","supports":"Wave 3 infrastructure figures and the Greek arrest","notes":["URL not re-verified in this pass. No supporting national release located."]},{"reference_id":"src_microsoft_lumma_2025","slug":"microsoft-on-the-issues-disrupting-lumma-stealer-microsoft-leads-global-action-a","source_type":"participating_company_report","source_quality":"T1","title":"Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool","publisher":"Microsoft On the Issues","published_on":"2025-05-21","url":"https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/","archive_url":null,"official":false,"language":"en","supports":"Court order, approximately 2,300 domains seized, more than 394,000 infected computers identified between 2025-03-16 and 2025-05-16, partner roles","notes":["URL verified as present in the research record.","Microsoft is a directly participating party, so this is graded T1, but a DOJ release remains the preferred P1 primary source."]},{"reference_id":"src_doj_lumma_2025","slug":"united-states-department-of-justice-us-department-of-justice-statement-on-the-se","source_type":"government_release","source_quality":"P1","title":"US Department of Justice statement on the seizure of Lumma Stealer command infrastructure","publisher":"United States Department of Justice","published_on":"2025-05-21","url":"https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation","archive_url":null,"official":true,"language":"en","supports":"Seizure of the central command structure and the marketplaces selling the malware","notes":["URL not re-verified in this pass. Should be promoted to primary once verified."]},{"reference_id":"src_europol_lumma_2025","slug":"europol-europol-statement-on-the-lumma-stealer-disruption","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the Lumma Stealer disruption","publisher":"Europol","published_on":"2025-05-21","url":"https://www.europol.europa.eu/media-press/newsroom/news/europol-and-microsoft-disrupt-world%E2%80%99s-largest-infostealer-lumma","archive_url":null,"official":true,"language":"en","supports":"Suspension of Europe-based infrastructure","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_netwalker_2021","slug":"united-states-department-of-justice-department-of-justice-launches-global-action","source_type":"government_release","source_quality":"P1","title":"Department of Justice Launches Global Action Against NetWalker Ransomware","publisher":"United States Department of Justice","published_on":"2021-01-27","url":"https://www.justice.gov/archives/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware","archive_url":null,"official":true,"language":"en","supports":"Seizure of dark-web resources with Bulgarian assistance, charges against Vachon-Desjardins, cryptocurrency seizure","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_netwalker_2021","slug":"europol-europol-statement-on-the-netwalker-action","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the NetWalker action","publisher":"Europol","published_on":"2021-01-27","url":null,"archive_url":null,"official":true,"language":"en","supports":"Bulgarian role and international coordination","notes":["URL not re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_hive_2023","slug":"united-states-department-of-justice-u-s-department-of-justice-disrupts-hive-rans","source_type":"government_release","source_quality":"P1","title":"U.S. Department of Justice Disrupts Hive Ransomware Variant","publisher":"United States Department of Justice","published_on":"2023-01-26","url":"https://www.justice.gov/archives/opa/pr/us-department-justice-disrupts-hive-ransomware-variant","archive_url":null,"official":true,"language":"en","supports":"Covert network access from July 2022, more than 300 decryption keys to victims under attack and more than 1,000 to previous victims, approximately 130 million USD in ransom demands averted, German and Dutch server seizures","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_hive_2023","slug":"europol-europol-statement-on-the-hive-ransomware-takedown","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the Hive ransomware takedown","publisher":"Europol","published_on":"2023-01-26","url":"https://www.europol.europa.eu/media-press/newsroom/news/cybercriminals-stung-hive-infrastructure-shut-down","archive_url":null,"official":true,"language":"en","supports":"International coordination and German and Dutch participation","notes":["URL not re-verified in this pass."]},{"reference_id":"src_nca_cronos_2024","slug":"national-crime-agency-international-investigation-disrupts-the-world-s-most-harm","source_type":"law_enforcement_release","source_quality":"P1","title":"International investigation disrupts the world's most harmful cyber crime group","publisher":"National Crime Agency","published_on":"2024-02-20","url":"https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group","archive_url":null,"official":true,"language":"en","supports":"34 servers seized, decryption keys, wallet freezes, account closures, leak-site takeover, task force roster","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_cronos_2024","slug":"europol-law-enforcement-disrupt-world-s-biggest-ransomware-operation","source_type":"international_agency_release","source_quality":"P2","title":"Law enforcement disrupt world's biggest ransomware operation","publisher":"Europol","published_on":"2024-02-20","url":"https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation","archive_url":null,"official":true,"language":"en","supports":"Participating countries and coordination roles, Poland and Ukraine arrests","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_lockbit_2024","slug":"united-states-department-of-justice-us-department-of-justice-announcements-on-lo","source_type":"government_release","source_quality":"P1","title":"US Department of Justice announcements on LockBit charges and defendants","publisher":"United States Department of Justice","published_on":"2024-02-20","url":"https://www.justice.gov/usao-nj/pr/us-and-uk-disrupt-lockbit-ransomware-variant","archive_url":null,"official":true,"language":"en","supports":"Charges against Sungatov, Kondratyev, Vasiliev, Astamirov, Panev, and Matveev; arrest and extradition history","notes":["This is an aggregated placeholder covering several distinct DOJ releases. Split into per-release sources at verification."]},{"reference_id":"src_doj_khoroshev_2024","slug":"united-states-district-court-for-the-district-of-new-jersey-united-states-v-dmit","source_type":"indictment","source_quality":"P0","title":"United States v. Dmitry Yuryevich Khoroshev, Criminal No. 24-299","publisher":"United States District Court for the District of New Jersey","published_on":"2024-05-07","url":"https://www.justice.gov/usao-nj/lockbit","archive_url":null,"official":true,"language":"en","supports":"26-count indictment identifying LockBitSupp as Khoroshev; coordinated sanctions and reward","notes":["Case number captured. Document URL not re-verified in this pass."]},{"reference_id":"src_europol_encrochat_2020","slug":"europol-dismantling-of-an-encrypted-network-sends-shockwaves-through-organised-c","source_type":"international_agency_release","source_quality":"P2","title":"Dismantling of an encrypted network sends shockwaves through organised crime groups across Europe","publisher":"Europol","published_on":"2020-07-02","url":"https://www.europol.europa.eu/media-press/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe","archive_url":null,"official":true,"language":"en","supports":"Joint investigation team structure, technical implant on France-hosted servers, user and message scale","notes":["URL not re-verified in this pass. A French judicial source would be preferred as P1."]},{"reference_id":"src_nca_venetic_2020","slug":"national-crime-agency-nca-statement-on-operation-venetic","source_type":"law_enforcement_release","source_quality":"P2","title":"NCA statement on Operation Venetic","publisher":"National Crime Agency","published_on":"2020-07-02","url":"https://www.nationalcrimeagency.gov.uk/news/operation-venetic","archive_url":null,"official":true,"language":"en","supports":"UK arrest and seizure figures","notes":["Initial arrest figure of 746 was later revised upward. Both are preserved."]},{"reference_id":"src_europol_skyecc_2021","slug":"europol-new-major-interventions-to-block-encrypted-communications-of-criminal-ne","source_type":"international_agency_release","source_quality":"P2","title":"New major interventions to block encrypted communications of criminal networks","publisher":"Europol","published_on":"2021-03-10","url":"https://www.europol.europa.eu/media-press/newsroom/news/new-major-interventions-to-block-encrypted-communications-of-criminal-networks","archive_url":null,"official":true,"language":"en","supports":"Sky ECC monitoring, user and message scale, Belgian action day","notes":["URL not re-verified in this pass."]},{"reference_id":"src_belgium_skyecc_2021","slug":"federal-public-prosecutor-s-office-of-belgium-belgian-federal-prosecutor-s-offic","source_type":"prosecutor_release","source_quality":"P1","title":"Belgian Federal Prosecutor's Office statement on the Sky ECC action day","publisher":"Federal Public Prosecutor's Office of Belgium","published_on":"2021-03-09","url":null,"archive_url":null,"official":true,"language":"nl","supports":"Belgian searches, arrests, and judicial authorization","notes":["Original-language title not captured. Translation required.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_anom_2021","slug":"united-states-attorney-s-office-southern-district-of-california-fbi-s-encrypted-","source_type":"government_release","source_quality":"P1","title":"FBI's Encrypted Phone Platform Infiltrated Hundreds of Criminal Syndicates; Result is Massive Worldwide Takedown","publisher":"United States Attorney's Office, Southern District of California","published_on":"2021-06-08","url":"https://www.justice.gov/usao-sdca/pr/fbi-s-encrypted-phone-platform-infiltrated-hundreds-criminal-syndicates-result-massive","archive_url":null,"official":true,"language":"en","supports":"Covert operation of ANOM, 17-defendant indictment, message and device scale","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_trojan_shield_2021","slug":"europol-800-criminals-arrested-in-biggest-ever-law-enforcement-operation-against","source_type":"international_agency_release","source_quality":"P2","title":"800 criminals arrested in biggest ever law enforcement operation against encrypted communication","publisher":"Europol","published_on":"2021-06-08","url":"https://www.europol.europa.eu/media-press/newsroom/news/800-criminals-arrested-in-biggest-ever-law-enforcement-operation-against-encrypted-communication","archive_url":null,"official":true,"language":"en","supports":"Global arrest aggregate and European coordination roles","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_anom_sentencing_2024","slug":"united-states-attorney-s-office-southern-district-of-california-distributor-of-a","source_type":"prosecutor_release","source_quality":"P1","title":"Distributor of Anom Hardened Encrypted Devices Sentenced to 63 Months in Prison for Racketeering","publisher":"United States Attorney's Office, Southern District of California","published_on":"2024-01-01","url":"https://www.justice.gov/usao-sdca/pr/distributor-anom-hardened-encrypted-devices-sentenced-63-months-prison-racketeering","archive_url":null,"official":true,"language":"en","supports":"Sentencing of an ANOM distributor to 63 months","notes":["URL verified as present in the research record. Exact publication date within 2024 not captured."]},{"reference_id":"src_doj_welcome_to_video_2019","slug":"united-states-department-of-justice-south-korean-national-and-hundreds-of-others","source_type":"government_release","source_quality":"P1","title":"South Korean National and Hundreds of Others Charged Worldwide in the Takedown of the Largest Darknet Child Pornography Website, Which was Funded by Bitcoin","publisher":"United States Department of Justice","published_on":"2019-10-16","url":"https://www.justice.gov/usao-dc/pr/south-korean-national-and-hundreds-others-charged-worldwide-takedown-largest-darknet","archive_url":null,"official":true,"language":"en","supports":"Server seizure in South Korea, Son's arrest and US indictment, 337 arrests, 23 children rescued, site scale","notes":["URL not re-verified in this pass."]},{"reference_id":"src_nca_welcome_to_video_2019","slug":"national-crime-agency-nca-statement-on-the-welcome-to-video-investigation","source_type":"law_enforcement_release","source_quality":"P2","title":"NCA statement on the Welcome to Video investigation","publisher":"National Crime Agency","published_on":"2019-10-16","url":null,"archive_url":null,"official":true,"language":"en","supports":"UK participation and arrests","notes":["URL not re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_chainalysis_wtv_2019","slug":"chainalysis-chainalysis-account-of-blockchain-analysis-in-the-welcome-to-video-i","source_type":"participating_company_report","source_quality":"T1","title":"Chainalysis account of blockchain analysis in the Welcome to Video investigation","publisher":"Chainalysis","published_on":"2019-10-16","url":"https://www.chainalysis.com/blog/chainalysis-doj-welcome-to-video-shutdown/","archive_url":null,"official":false,"language":"en","supports":"Bitcoin tracing methodology used to identify users","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_webstresser_2018","slug":"europol-world-s-biggest-marketplace-selling-internet-paralysing-ddos-attacks-tak","source_type":"international_agency_release","source_quality":"P2","title":"World's biggest marketplace selling internet paralysing DDoS attacks taken down","publisher":"Europol","published_on":"2018-04-25","url":"https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-biggest-marketplace-selling-internet-paralysing-ddos-attacks-taken-down","archive_url":null,"official":true,"language":"en","supports":"Infrastructure seizure locations, administrator arrests, service scale","notes":["URL not re-verified in this pass."]},{"reference_id":"src_nca_webstresser_2018","slug":"national-crime-agency-nca-statement-on-the-webstresser-takedown","source_type":"law_enforcement_release","source_quality":"P2","title":"NCA statement on the Webstresser takedown","publisher":"National Crime Agency","published_on":"2018-04-25","url":null,"archive_url":null,"official":true,"language":"en","supports":"UK role and follow-on action against users","notes":["URL not re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_poweroff_2022","slug":"united-states-department-of-justice-federal-prosecutors-in-los-angeles-and-alask","source_type":"government_release","source_quality":"P1","title":"Federal Prosecutors in Los Angeles and Alaska Charge 6 Defendants with Operating Websites that Offer Computer Attack Services","publisher":"United States Department of Justice","published_on":"2022-12-14","url":"https://www.justice.gov/usao-ak/pr/federal-prosecutors-alaska-and-los-angeles-charge-6-defendants-operating-websites-offered","archive_url":null,"official":true,"language":"en","supports":"48 domain seizures and six defendants charged","notes":["URL not re-verified in this pass. Defendant names not captured as person records."]},{"reference_id":"src_europol_poweroff_2022","slug":"europol-europol-statement-on-the-december-2022-operation-poweroff-wave","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the December 2022 Operation PowerOFF wave","publisher":"Europol","published_on":"2022-12-14","url":"https://www.europol.europa.eu/media-press/newsroom/news/global-crackdown-against-ddos-services-shuts-down-most-popular-platforms","archive_url":null,"official":true,"language":"en","supports":"International coordination","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_poweroff_2024","slug":"europol-europol-statement-on-the-december-2024-operation-poweroff-wave","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the December 2024 Operation PowerOFF wave","publisher":"Europol","published_on":"2024-12-11","url":"https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-shuts-down-27-ddos-booters-ahead-of-annual-christmas-attacks","archive_url":null,"official":true,"language":"en","supports":"27 platforms taken down, three arrests","notes":["URL not re-verified in this pass."]},{"reference_id":"src_europol_poweroff_2026","slug":"europol-europol-statement-on-the-april-2026-operation-poweroff-wave","source_type":"international_agency_release","source_quality":"P2","title":"Europol statement on the April 2026 Operation PowerOFF wave","publisher":"Europol","published_on":"2026-04-17","url":"https://www.europol.europa.eu/media-press/newsroom/news/europol-supported-global-operation-targets-over-75-000-users-engaged-in-ddos-attacks","archive_url":null,"official":true,"language":"en","supports":"53 domains seized, four arrests, 21 participating countries","notes":["MATERIAL GAP. Most recent record in the corpus and least verified. Confirm before import."]},{"reference_id":"src_doj_snake_2023","slug":"united-states-department-of-justice-justice-department-announces-court-authori-2","source_type":"government_release","source_quality":"P1","title":"Justice Department Announces Court-Authorized Disruption of Snake Malware Network Controlled by Russia's Federal Security Service","publisher":"United States Department of Justice","published_on":"2023-05-09","url":"https://www.justice.gov/usao-edny/pr/justice-department-announces-court-authorized-disruption-snake-malware-network","archive_url":null,"official":true,"language":"en","supports":"PERSEUS tool, Rule 41 warrant in EDNY, self-overwrite mechanism, FSB Center 16 attribution","notes":["URL not re-verified in this pass."]},{"reference_id":"src_cisa_snake_2023","slug":"cybersecurity-and-infrastructure-security-agency-hunting-russian-intelligence-sn","source_type":"government_release","source_quality":"P2","title":"Hunting Russian Intelligence 'Snake' Malware, joint cybersecurity advisory","publisher":"Cybersecurity and Infrastructure Security Agency","published_on":"2023-05-09","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a","archive_url":null,"official":true,"language":"en","supports":"Technical description of Snake and its network","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_kv_botnet_2024","slug":"united-states-department-of-justice-u-s-government-disrupts-botnet-people-s-repu","source_type":"government_release","source_quality":"P1","title":"U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure","publisher":"United States Department of Justice","published_on":"2024-01-31","url":"https://www.justice.gov/archives/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical","archive_url":null,"official":true,"language":"en","supports":"Court-authorized malware deletion from routers, Rule 41 warrants in WDPA, reinfection caveat","notes":["URL not re-verified in this pass."]},{"reference_id":"src_cisa_volt_typhoon_2024","slug":"cybersecurity-and-infrastructure-security-agency-cisa-guidance-on-volt-typhoon-a","source_type":"government_release","source_quality":"P2","title":"CISA guidance on Volt Typhoon activity against critical infrastructure","publisher":"Cybersecurity and Infrastructure Security Agency","published_on":"2024-02-07","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a","archive_url":null,"official":true,"language":"en","supports":"Threat context for the KV Botnet disruption","notes":["URL not re-verified in this pass."]},{"reference_id":"src_doj_raptor_train_2024","slug":"united-states-department-of-justice-court-authorized-operation-disrupts-worldwid","source_type":"government_release","source_quality":"P1","title":"Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers","publisher":"United States Department of Justice","published_on":"2024-09-18","url":"https://www.justice.gov/usao-wdpa/pr/court-authorized-operation-disrupts-worldwide-botnet-used-peoples-republic-china-state","archive_url":null,"official":true,"language":"en","supports":"Seizure of botnet control, attribution to Integrity Technology Group, French assistance","notes":["URL not re-verified in this pass."]},{"reference_id":"src_lumen_raptor_train_2024","slug":"lumen-technologies-black-lotus-labs-black-lotus-labs-research-on-the-raptor-trai","source_type":"participating_company_report","source_quality":"T1","title":"Black Lotus Labs research on the Raptor Train botnet","publisher":"Lumen Technologies Black Lotus Labs","published_on":"2024-09-18","url":"https://www.lumen.com/blog/en-us/derailing-raptor-train","archive_url":null,"official":false,"language":"en","supports":"More than 200,000 compromised devices, botnet architecture","notes":["URL not re-verified in this pass."]},{"reference_id":"src_bleepingcomputer_fitzpatrick_resentence_2025","slug":"bleepingcomputer-breachforums-hacking-forum-admin-resentenced-to-three-years-in-","source_type":"news_report","source_quality":"S1","title":"BreachForums hacking forum admin resentenced to three years in prison","publisher":"BleepingComputer","published_on":"2025-09-16","url":"https://www.justice.gov/opa/pr/founder-one-worlds-largest-hacker-forums-resentenced-three-years-prison","archive_url":null,"official":false,"language":"en","supports":"Fourth Circuit vacatur of the original sentence and Fitzpatrick's 2025-09-16 resentencing to 36 months custody plus 20 years supervised release.","notes":["URL not re-verified character-for-character in this pass. Retrieve from bleepingcomputer.com before import.","Replaced secondary source stub with official DOJ resentencing release."]},{"reference_id":"src_doj_coreflood_2011","slug":"us-doj-coreflood-botnet-disruption-case-history","source_type":"government_release","source_quality":"S2","title":"Coreflood botnet disruption case history","publisher":"US DOJ","published_on":"2011-04-13","url":"https://www.justice.gov/archives/opa/pr/department-justice-takes-action-disable-international-botnet","archive_url":null,"official":true,"language":"en","supports":"Establishes the civil/criminal seizure of Coreflood command infrastructure and use of a TRO/injunction to disable the botnet.","notes":["Not independently re-verified; pulled from aggregation-pass reporting. Retrieve and cite the underlying D. Conn. docket before publication."]},{"reference_id":"src_fbi_dnschanger_2011","slug":"fbi-usao-sdny-operation-ghost-click-dnschanger-case-announcement","source_type":"law_enforcement_release","source_quality":"S2","title":"Operation Ghost Click / DNSChanger case announcement","publisher":"FBI / USAO SDNY","published_on":"2011-11-08","url":"https://archives.fbi.gov/archives/newyork/press-releases/2011/manhattan-u.s.-attorney-charges-seven-individuals-for-engineering-sophisticated-internet-fraud-scheme-that-infected-millions-of-computers-worldwide-and-manipulated-internet-advertising-business","archive_url":null,"official":true,"language":"en","supports":"Establishes the DNSChanger seizure, substitute-DNS remediation, and the six-defendant indictment.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_megaupload_2012","slug":"us-doj-usao-edva-megaupload-indictment-and-seizure-announcement","source_type":"prosecutor_release","source_quality":"S2","title":"Megaupload indictment and seizure announcement","publisher":"US DOJ / USAO EDVA","published_on":"2012-01-19","url":"https://www.justice.gov/archives/opa/pr/justice-department-charges-leaders-megaupload-widespread-online-copyright-infringement","archive_url":null,"official":true,"language":"en","supports":"Establishes the 18-domain seizure, the seven-defendant indictment, and coordinated New Zealand arrests.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_fbi_citadel_2013","slug":"fbi-cyber-division-citadel-botnet-disruption-announcement","source_type":"law_enforcement_release","source_quality":"S2","title":"Citadel botnet disruption announcement","publisher":"FBI Cyber Division","published_on":"2013-06-05","url":"https://www.fbi.gov/news/speeches-and-testimony/taking-down-botnets","archive_url":null,"official":true,"language":"en","supports":"Establishes FBI coordination with Microsoft's civil action against Citadel infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_zeroaccess_2013","slug":"europol-zeroaccess-botnet-disruption-announcement","source_type":"international_agency_release","source_quality":"P2","title":"ZeroAccess botnet disruption announcement","publisher":"Europol","published_on":"2013-12-05","url":null,"archive_url":null,"official":true,"language":"en","supports":"Establishes the Europol/FBI/Microsoft coalition action against ZeroAccess.","notes":["Not independently re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_europol_ramnit_2015","slug":"europol-ramnit-botnet-disruption-announcement","source_type":"international_agency_release","source_quality":"P2","title":"Ramnit botnet disruption announcement","publisher":"Europol","published_on":"2015-02-24","url":"https://www.europol.europa.eu/media-press/newsroom/news/botnet-taken-down-through-international-law-enforcement-cooperation","archive_url":null,"official":true,"language":"en","supports":"Establishes the Europol-coordinated Ramnit infrastructure disruption and the 3.2 million infection estimate.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_simda_2015","slug":"interpol-simda-botnet-disruption-announcement","source_type":"international_agency_release","source_quality":"P2","title":"Simda botnet disruption announcement","publisher":"INTERPOL","published_on":"2015-04-01","url":"https://www.interpol.int/en/News-and-Events/News/2015/INTERPOL-coordinates-global-operation-to-take-down-Simda-botnet","archive_url":null,"official":true,"language":"en","supports":"Establishes the INTERPOL-coordinated Simda C2 disruption.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_beebone_2015","slug":"europol-operation-source-beebone-botnet-disruption","source_type":"international_agency_release","source_quality":"P2","title":"Operation Source: Beebone botnet disruption","publisher":"Europol","published_on":"2015-04-08","url":"https://www.europol.europa.eu/media-press/newsroom/news/international-police-operation-targets-polymorphic-beebone-botnet","archive_url":null,"official":true,"language":"en","supports":"Establishes the Dutch-led, Europol-supported Beebone domain seizure and sinkholing operation.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_fbi_playpen_2015","slug":"fbi-us-doj-operation-pacifier-playpen-case-history","source_type":"law_enforcement_release","source_quality":"S2","title":"Operation Pacifier / Playpen case history","publisher":"FBI / US DOJ","published_on":"2015-03-04","url":"https://www.justice.gov/archives/opa/pr/florida-man-sentenced-prison-engaging-child-exploitation-enterprise","archive_url":null,"official":true,"language":"en","supports":"Establishes the Playpen server seizure, the FBI's covert operation of the site under an NIT warrant, and the resulting prosecutions.","notes":["Not independently re-verified in this pass.","Replacement official outcome source for generic source stub; also documents creator/lead administrator and sentence."]},{"reference_id":"src_europol_babylon_2015","slug":"europol-operation-babylon-italian-led-tor-hidden-service-takedown","source_type":"international_agency_release","source_quality":"P2","title":"Operation Babylon: Italian-led Tor hidden-service takedown","publisher":"Europol","published_on":"2015-06-01","url":"https://www.europol.europa.eu/media-press/newsroom/news/darknet-hidden-service-for-child-sexual-abuse-material-shut-down","archive_url":null,"official":true,"language":"en","supports":"Establishes the Italian-led shutdown of the Tor hidden service and the roughly 14,000-wallet seizure.","notes":["Not independently re-verified in this pass. Exact date estimated."]},{"reference_id":"src_doj_darkode_2015","slug":"us-doj-usao-wdpa-darkode-forum-takedown-announcement","source_type":"prosecutor_release","source_quality":"S2","title":"Darkode forum takedown announcement","publisher":"US DOJ / USAO WDPA","published_on":"2015-07-15","url":"https://www.justice.gov/usao-wdpa/pr/major-computer-hacking-forum-dismantled","archive_url":null,"official":true,"language":"en","supports":"Establishes the international Darkode forum seizure and coordinated arrests.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_wsm_2019","slug":"us-doj-wall-street-market-and-silkkitie-takedown-announcement","source_type":"prosecutor_release","source_quality":"P1","title":"Wall Street Market and Silkkitie takedown announcement","publisher":"US DOJ","published_on":"2019-05-03","url":"https://www.justice.gov/usao-cdca/pr/3-germans-who-allegedly-operated-dark-web-marketplace-over-1-million-users-face-us","archive_url":null,"official":true,"language":"en","supports":"Establishes the coordinated German/Finnish darknet-market shutdowns and the US moderator charge.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_wsm_2019","slug":"europol-wall-street-market-takedown-coordination","source_type":"international_agency_release","source_quality":"P2","title":"Wall Street Market takedown coordination","publisher":"Europol","published_on":"2019-05-03","url":"https://www.europol.europa.eu/media-press/newsroom/news/double-blow-to-dark-web-marketplaces","archive_url":null,"official":true,"language":"en","supports":"Corroborates the coordinated international nature of the action.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_deepdotweb_2019","slug":"us-doj-usao-wdpa-deepdotweb-administrators-charged-domain-seized","source_type":"prosecutor_release","source_quality":"P1","title":"DeepDotWeb administrators charged; domain seized","publisher":"US DOJ / USAO WDPA","published_on":"2019-05-07","url":"https://www.justice.gov/usao-wdpa/pr/administrators-deepdotweb-indicted-money-laundering-conspiracy-relating-kickbacks-sales","archive_url":null,"official":true,"language":"en","supports":"Establishes the domain seizure and the arrest of two alleged administrators.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_darkmarket_2021","slug":"europol-darkmarket-world-s-largest-illegal-dark-web-marketplace-taken-down","source_type":"international_agency_release","source_quality":"P2","title":"DarkMarket: world's largest illegal dark web marketplace taken down","publisher":"Europol","published_on":"2021-01-12","url":"https://www.europol.europa.eu/media-press/newsroom/news/darkmarket-worlds-largest-illegal-dark-web-marketplace-taken-down","archive_url":null,"official":true,"language":"en","supports":"Establishes the DarkMarket server seizure, operator arrest, and user/seller scale.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_monopoly_2021","slug":"europol-monopoly-market-infrastructure-seizure","source_type":"international_agency_release","source_quality":"P2","title":"Monopoly Market infrastructure seizure","publisher":"Europol","published_on":"2023-05-02","url":"https://www.europol.europa.eu/media-press/newsroom/news/288-dark-web-vendors-arrested-in-major-marketplace-seizure","archive_url":null,"official":true,"language":"en","supports":"Establishes the covert 2021 German seizure of Monopoly Market infrastructure later disclosed alongside Operation SpecTor.","notes":["Not independently re-verified in this pass. Disclosure date used where operational date not separately public.","Europol 2023 release retrospectively documents the December 2021 server seizure."]},{"reference_id":"src_europol_spector_2023","slug":"europol-operation-spector-288-dark-web-vendors-arrested-worldwide","source_type":"international_agency_release","source_quality":"P2","title":"Operation SpecTor: 288 dark web vendors arrested worldwide","publisher":"Europol","published_on":"2023-05-02","url":"https://www.europol.europa.eu/media-press/newsroom/news/288-dark-web-vendors-arrested-in-major-marketplace-seizure","archive_url":null,"official":true,"language":"en","supports":"Establishes the 288-arrest figure, seized cash/virtual currency, drugs, and firearms.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_weleakinfo_2020","slug":"us-doj-weleakinfo-domain-seizure-announcement","source_type":"prosecutor_release","source_quality":"S2","title":"WeLeakInfo domain seizure announcement","publisher":"US DOJ","published_on":"2020-01-15","url":"https://www.justice.gov/usao-dc/pr/weleakinfocom-domain-name-seized","archive_url":null,"official":true,"language":"en","supports":"Establishes the multinational WeLeakInfo domain seizure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_vpnfilter_2018","slug":"us-doj-usao-wdpa-vpnfilter-botnet-c2-domain-seizure","source_type":"prosecutor_release","source_quality":"P1","title":"VPNFilter botnet C2 domain seizure","publisher":"US DOJ / USAO WDPA","published_on":"2018-05-23","url":"https://www.justice.gov/archives/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected","archive_url":null,"official":true,"language":"en","supports":"Establishes the court-authorized domain seizure and redirection used to disrupt VPNFilter.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_cyclops_blink_2022","slug":"us-doj-court-authorized-disruption-of-cyclops-blink","source_type":"prosecutor_release","source_quality":"P1","title":"Court-authorized disruption of Cyclops Blink","publisher":"US DOJ","published_on":"2022-04-06","url":"https://www.justice.gov/archives/opa/pr/justice-department-announces-court-authorized-disruption-botnet-controlled-russian-federation","archive_url":null,"official":true,"language":"en","supports":"Establishes the court-authorized removal of GRU-linked malware from compromised C2 devices.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_rsocks_2022","slug":"us-doj-usao-sdca-rsocks-residential-proxy-botnet-dismantled","source_type":"prosecutor_release","source_quality":"P1","title":"RSOCKS residential proxy botnet dismantled","publisher":"US DOJ / USAO SDCA","published_on":"2022-06-16","url":"https://www.justice.gov/usao-sdca/pr/russian-botnet-disrupted-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"Establishes the FBI's undercover mapping and disruption of RSOCKS proxy infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_flubot_2022","slug":"europol-flubot-europe-s-most-spread-mobile-malware-disrupted-through-internation","source_type":"international_agency_release","source_quality":"P2","title":"FluBot: Europe's most spread mobile malware disrupted through international police cooperation","publisher":"Europol","published_on":"2022-06-01","url":"https://www.europol.europa.eu/media-press/newsroom/news/takedown-of-sms-based-flubot-spyware-infecting-android-phones","archive_url":null,"official":true,"language":"en","supports":"Establishes the 11-country Dutch-led disruption of FluBot infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_ipstorm_2023","slug":"us-doj-ccips-ipstorm-botnet-developer-pleads-guilty-botnet-dismantled","source_type":"prosecutor_release","source_quality":"P1","title":"IPStorm botnet developer pleads guilty; botnet dismantled","publisher":"US DOJ CCIPS","published_on":"2023-11-01","url":"https://www.justice.gov/usao-pr/pr/russian-and-moldovan-national-pleads-guilty-operating-illegal-botnet-proxy-service","archive_url":null,"official":true,"language":"en","supports":"Establishes the IPStorm dismantlement and Makinin's guilty plea.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_chipmixer_2023","slug":"us-doj-fbi-chipmixer-cryptocurrency-mixer-dismantled","source_type":"prosecutor_release","source_quality":"P1","title":"ChipMixer cryptocurrency mixer dismantled","publisher":"US DOJ / FBI","published_on":"2023-03-15","url":"https://www.justice.gov/usao-edpa/pr/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed","archive_url":null,"official":true,"language":"en","supports":"Establishes the US-German seizure of ChipMixer infrastructure and the charge against its alleged operator.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_ragnar_locker_2023","slug":"europol-ragnar-locker-ransomware-infrastructure-disrupted","source_type":"international_agency_release","source_quality":"P2","title":"Ragnar Locker ransomware infrastructure disrupted","publisher":"Europol","published_on":"2023-10-20","url":"https://www.europol.europa.eu/media-press/newsroom/news/ragnar-locker-ransomware-gang-taken-down-international-police-swoop","archive_url":null,"official":true,"language":"en","supports":"Establishes the French-led operation and the multi-country infrastructure seizures.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_alphv_2023","slug":"us-doj-justice-department-disrupts-alphv-blackcat-ransomware","source_type":"prosecutor_release","source_quality":"P1","title":"Justice Department disrupts ALPHV/BlackCat ransomware","publisher":"US DOJ","published_on":"2023-12-19","url":"https://www.justice.gov/usao-sdfl/pr/justice-department-disrupts-prolific-alphvblackcat-ransomware-variant","archive_url":null,"official":true,"language":"en","supports":"Establishes the FBI's disruption of ALPHV/BlackCat infrastructure and the decryption-key offer.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_bka_nemesis_2024","slug":"bundeskriminalamt-nemesis-market-darknet-marketplace-shut-down","source_type":"law_enforcement_release","source_quality":"P1","title":"Nemesis Market darknet marketplace shut down","publisher":"Bundeskriminalamt","published_on":"2024-03-21","url":"https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2024/Presse2024/240321_PM_Nemesis_Market.html","archive_url":null,"official":true,"language":"de","supports":"Establishes the BKA seizure of Nemesis Market infrastructure.","notes":["Not independently re-verified in this pass. Original German title not captured."]},{"reference_id":"src_politie_magnus_2024","slug":"dutch-national-police-operation-magnus-com-operation-magnus-redline-and-meta-inf","source_type":"law_enforcement_release","source_quality":"P1","title":"Operation Magnus: RedLine and META infostealers dismantled","publisher":"Dutch National Police / operation-magnus.com","published_on":"2024-10-28","url":"https://www.politie.nl/headless-api/nieuws/2024/oktober/29/internationale-opsporingsdiensten-ontmantelen-infostealers.html","archive_url":null,"official":true,"language":"en","supports":"Establishes the Dutch-led takedown of RedLine and META Stealer infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_safe_inet_2020","slug":"europol-popular-vpn-used-by-ransomware-gangs-taken-down","source_type":"international_agency_release","source_quality":"P2","title":"Popular VPN used by ransomware gangs taken down","publisher":"Europol","published_on":"2020-12-22","url":"https://www.europol.europa.eu/media-press/newsroom/news/cybercriminals%E2%80%99-favourite-vpn-taken-down-in-global-action","archive_url":null,"official":true,"language":"en","supports":"Establishes the multinational takedown of Safe-Inet/Insorg VPN infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_doublevpn_2021","slug":"europol-vpn-service-seized-in-coordinated-international-law-enforcement-action","source_type":"international_agency_release","source_quality":"P2","title":"VPN service seized in coordinated international law enforcement action","publisher":"Europol","published_on":"2021-06-30","url":"https://www.europol.europa.eu/media-press/newsroom/news/coordinated-action-cuts-access-to-vpn-service-used-ransomware-groups","archive_url":null,"official":true,"language":"en","supports":"Establishes the Dutch-led seizure of DoubleVPN infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_vpnlab_2022","slug":"europol-vpnlab-net-shut-down-after-europol-coordinated-action","source_type":"international_agency_release","source_quality":"P2","title":"VPNLab.net shut down after Europol coordinated action","publisher":"Europol","published_on":"2022-01-18","url":"https://www.europol.europa.eu/media-press/newsroom/news/unhappy-new-year-for-cybercriminals-vpnlabnet-goes-offline","archive_url":null,"official":true,"language":"en","supports":"Establishes the coordinated seizure of VPNLab.net infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_lolekhosted_2023","slug":"us-doj-usao-mdfl-justice-department-seizes-lolekhosted-net-domain","source_type":"prosecutor_release","source_quality":"P1","title":"Justice Department seizes LolekHosted.net domain","publisher":"US DOJ / USAO MDFL","published_on":"2023-08-08","url":"https://www.justice.gov/archives/opa/pr/administrator-bulletproof-webhosting-domain-charged-connection-facilitation-netwalker","archive_url":null,"official":true,"language":"en","supports":"Establishes the LolekHosted.net domain seizure and its connection to NetWalker ransomware attacks.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_matrix_2024","slug":"europol-matrix-encrypted-communications-platform-taken-down","source_type":"international_agency_release","source_quality":"P2","title":"Matrix encrypted communications platform taken down","publisher":"Europol","published_on":"2024-12-03","url":"https://www.europol.europa.eu/media-press/newsroom/news/international-operation-takes-down-another-encrypted-messaging-service-used-criminals","archive_url":null,"official":true,"language":"en","supports":"Establishes the French-Dutch takedown of Matrix infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_ispoof_2022","slug":"europol-ispoof-fraud-enabling-platform-taken-down-and-142-arrested-worldwide","source_type":"international_agency_release","source_quality":"P2","title":"iSpoof: fraud-enabling platform taken down and 142 arrested worldwide","publisher":"Europol","published_on":"2022-11-24","url":"https://www.europol.europa.eu/media-press/newsroom/news/action-against-criminal-website-offered-%E2%80%98spoofing%E2%80%99-services-to-fraudsters-142-arrests","archive_url":null,"official":true,"language":"en","supports":"Establishes the Metropolitan Police-led takedown and the 142-arrest figure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_labhost_2024","slug":"europol-labhost-one-of-the-biggest-phishing-services-worldwide-taken-down","source_type":"international_agency_release","source_quality":"P2","title":"LabHost, one of the biggest phishing services worldwide, taken down","publisher":"Europol","published_on":"2024-04-18","url":"https://www.europol.europa.eu/media-press/newsroom/news/labhost-phishing-platform-used-to-steal-personal-information-dismantled","archive_url":null,"official":true,"language":"en","supports":"Establishes the 19-country operation against LabHost.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_heartsender_2025","slug":"us-doj-justice-department-seizes-domains-behind-heartsender-phishing-kit-operati","source_type":"prosecutor_release","source_quality":"P1","title":"Justice Department seizes domains behind HeartSender phishing-kit operation","publisher":"US DOJ","published_on":"2025-01-30","url":"https://www.justice.gov/opa/pr/justice-department-announces-seizure-cybercrime-websites-selling-hacking-tools-transnational","archive_url":null,"official":true,"language":"en","supports":"Establishes the 39-domain seizure targeting HeartSender.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_cracked_nulled_2025","slug":"us-doj-cracked-and-nulled-cybercrime-marketplaces-seized","source_type":"prosecutor_release","source_quality":"P1","title":"Cracked and Nulled cybercrime marketplaces seized","publisher":"US DOJ","published_on":"2025-01-30","url":"https://www.justice.gov/opa/pr/cracked-and-nulled-marketplaces-disrupted-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"Establishes the multinational seizure of the Cracked and Nulled forums.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_phobos_2025","slug":"europol-law-enforcement-disrupts-phobos-ransomware-and-8base-group","source_type":"international_agency_release","source_quality":"P2","title":"Law enforcement disrupts Phobos ransomware and 8Base group","publisher":"Europol","published_on":"2025-02-10","url":"https://www.europol.europa.eu/media-press/newsroom/news/key-figures-behind-phobos-and-8base-ransomware-arrested-international-cybercrime-crackdown","archive_url":null,"official":true,"language":"en","supports":"Establishes the disruption of more than 100 servers connected to Phobos/8Base.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_usss_garantex_2025","slug":"us-secret-service-doj-garantex-cryptocurrency-exchange-domains-seized","source_type":"law_enforcement_release","source_quality":"P1","title":"Garantex cryptocurrency exchange domains seized","publisher":"US Secret Service / DOJ","published_on":"2025-03-07","url":"https://www.justice.gov/usao-edva/pr/garantex-cryptocurrency-exchange-disrupted-international-operation","archive_url":null,"official":true,"language":"en","supports":"Establishes the US domain seizure and parallel German/Finnish actions against Garantex.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_bka_boystown_2021","slug":"bundeskriminalamt-frankfurt-prosecutors-boystown-darknet-csam-platform-dismantle","source_type":"law_enforcement_release","source_quality":"P1","title":"Boystown darknet CSAM platform dismantled","publisher":"Bundeskriminalamt / Frankfurt prosecutors","published_on":"2021-05-03","url":"https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2021/Presse2021/210503_pmboystown.html","archive_url":null,"official":true,"language":"de","supports":"Establishes the German-led seizure of Boystown and the four arrests.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_boystown_2021","slug":"europol-one-of-the-world-s-largest-dark-web-child-sexual-abuse-platforms-taken-d","source_type":"international_agency_release","source_quality":"P2","title":"One of the world's largest dark web child sexual abuse platforms taken down","publisher":"Europol","published_on":"2021-05-03","url":"https://www.europol.europa.eu/media-press/newsroom/news/4-arrested-in-takedown-of-dark-web-child-abuse-platform-some-half-million-users","archive_url":null,"official":true,"language":"en","supports":"Corroborates the German-led operation and reports the approximately 400,000-user figure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_kidflix_2025","slug":"europol-kidflix-one-of-the-largest-child-sexual-exploitation-platforms-taken-dow","source_type":"international_agency_release","source_quality":"P2","title":"Kidflix: one of the largest child sexual exploitation platforms taken down","publisher":"Europol","published_on":"2025-04-02","url":"https://www.europol.europa.eu/media-press/newsroom/news/global-crackdown-kidflix-major-child-sexual-exploitation-platform-almost-two-million-users","archive_url":null,"official":true,"language":"en","supports":"Establishes the German-led seizure of Kidflix and the nearly two-million-user figure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_hsi_cfake_2026","slug":"us-hsi-doj-hsi-seizes-domains-behind-non-consensual-sexual-deepfake-services","source_type":"law_enforcement_release","source_quality":"P1","title":"HSI seizes domains behind non-consensual sexual deepfake services","publisher":"US HSI / DOJ","published_on":"2026-06-12","url":"https://www.justice.gov/opa/pr/united-states-seizes-domain-names-publishing-nude-digital-forgeries-famous-women","archive_url":null,"official":true,"language":"en","supports":"Establishes the HSI-led seizure of CFAKE.com and SOCFAKE.com.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_ice_in_our_sites_2010","slug":"us-ice-hsi-national-ipr-center-operation-in-our-sites-launched-against-piracy-we","source_type":"law_enforcement_release","source_quality":"S2","title":"Operation In Our Sites launched against piracy websites","publisher":"US ICE HSI / National IPR Center","published_on":"2010-06-30","url":"https://www.justice.gov/archive/usao/co/news/2010/November10/11_29_10.html","archive_url":null,"official":true,"language":"en","supports":"Establishes the initial nine-domain seizure and the program's growth to 761 domains by 2012.","notes":["Not independently re-verified in this pass.","Equivalent official DOJ archive source verifying the initial nine-domain phase; the originally described ICE release was not recovered."]},{"reference_id":"src_doj_kat_2016","slug":"us-doj-artem-vaulin-administrator-of-kickass-torrents-website-arrested-in-poland","source_type":"prosecutor_release","source_quality":"P1","title":"Artem Vaulin, administrator of Kickass Torrents website, arrested in Poland","publisher":"US DOJ","published_on":"2016-07-20","url":"https://www.justice.gov/archives/opa/pr/us-authorities-charge-owner-most-visited-illegal-file-sharing-website-copyright-infringement","archive_url":null,"official":true,"language":"en","supports":"Establishes the Kickass Torrents domain seizure and Vaulin's arrest in Poland.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_iptv_2024","slug":"europol-illegal-iptv-distribution-network-dismantled-across-europe","source_type":"international_agency_release","source_quality":"P2","title":"Illegal IPTV distribution network dismantled across Europe","publisher":"Europol","published_on":"2024-11-27","url":"https://www.europol.europa.eu/media-press/newsroom/news/european-law-enforcement-stops-illegal-iptv-service-providers","archive_url":null,"official":true,"language":"en","supports":"Establishes the 102 identified suspects, 11 arrests, and 112+ searches.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_offsides_2026","slug":"us-doj-ice-hsi-operation-offsides-doj-seizes-domains-streaming-world-cup-matches","source_type":"prosecutor_release","source_quality":"P1","title":"Operation Offsides: DOJ seizes domains streaming World Cup matches without authorization","publisher":"US DOJ / ICE HSI","published_on":"2026-07-20","url":"https://www.justice.gov/opa/pr/united-states-seizes-more-1000-internet-domains-used-illegally-stream-world-cup-2026-matches","archive_url":null,"official":true,"language":"en","supports":"Establishes the seizure of more than 1,000 unauthorized World Cup streaming domains.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_amaq_2018","slug":"europol-islamic-state-amaq-propaganda-infrastructure-disrupted","source_type":"international_agency_release","source_quality":"P2","title":"Islamic State Amaq propaganda infrastructure disrupted","publisher":"Europol","published_on":"2018-04-27","url":"https://www.europol.europa.eu/media-press/newsroom/news/islamic-state-propaganda-machine-hit-law-enforcement-in-coordinated-takedown-action","archive_url":null,"official":true,"language":"en","supports":"Establishes the Belgian/EU coalition action against Amaq propaganda infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_is_web_2019","slug":"europol-coordinated-action-against-islamic-state-online-propaganda-infrastructur","source_type":"international_agency_release","source_quality":"P2","title":"Coordinated action against Islamic State online propaganda infrastructure","publisher":"Europol","published_on":"2019-11-25","url":"https://www.europol.europa.eu/media-press/newsroom/news/eu-law-enforcement-and-judicial-authorities-join-forces-to-disrupt-terrorist-propaganda-online","archive_url":null,"official":true,"language":"en","supports":"Establishes the renewed 2019 EU-coordinated action against Islamic State web infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_synergia_ii_2024","slug":"interpol-interpol-operation-synergia-ii-targets-cybercrime-infrastructure-across","source_type":"international_agency_release","source_quality":"P2","title":"INTERPOL operation Synergia II targets cybercrime infrastructure across 95 countries","publisher":"INTERPOL","published_on":"2024-11-05","url":"https://www.interpol.int/en/News-and-Events/News/2024/INTERPOL-cyber-operation-takes-down-22-000-malicious-IP-addresses","archive_url":null,"official":true,"language":"en","supports":"Establishes the more-than-90-country scope and 22,000+ malicious infrastructures disrupted.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_synergia_iii_2026","slug":"interpol-interpol-synergia-iii-72-countries-target-45-000-malicious-ips","source_type":"international_agency_release","source_quality":"P2","title":"INTERPOL Synergia III: 72 countries target 45,000 malicious IPs","publisher":"INTERPOL","published_on":"2026-03-13","url":"https://www.interpol.int/en/News-and-Events/News/2026/45-000-malicious-IP-addresses-taken-down-in-international-cyber-operation","archive_url":null,"official":true,"language":"en","supports":"Establishes the campaign's duration, 72-country participation, and 45,000 malicious IP target.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_secure_2025","slug":"interpol-operation-secure-interpol-coordinated-action-takes-down-20-000-maliciou","source_type":"international_agency_release","source_quality":"P2","title":"Operation Secure: INTERPOL-coordinated action takes down 20,000+ malicious IPs and domains","publisher":"INTERPOL","published_on":"2025-06-11","url":"https://www.interpol.int/News-and-Events/News/2025/20-000-malicious-IPs-and-domains-taken-down-in-INTERPOL-infostealer-crackdown","archive_url":null,"official":true,"language":"en","supports":"Establishes the 26-country scope, 20,000+ IP/domain figure, 41 servers seized, and 32 arrests.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_serengeti2_2025","slug":"interpol-afripol-operation-serengeti-2-0-disrupts-over-11-000-malicious-cyber-in","source_type":"international_agency_release","source_quality":"P2","title":"Operation Serengeti 2.0 disrupts over 11,000 malicious cyber infrastructures in Africa","publisher":"INTERPOL / AFRIPOL","published_on":"2025-08-22","url":"https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions","archive_url":null,"official":true,"language":"en","supports":"Establishes the 18-country-plus-UK scope and 11,000+ malicious infrastructures figure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_interpol_redcard2_2026","slug":"interpol-operation-red-card-2-0-targets-cross-border-online-fraud","source_type":"international_agency_release","source_quality":"P2","title":"Operation Red Card 2.0 targets cross-border online fraud","publisher":"INTERPOL","published_on":"2026-02-18","url":"https://www.interpol.int/News-and-Events/News/2026/Major-operation-in-Africa-targeting-online-scams-nets-651-arrests-recovers-USD-4.3-million","archive_url":null,"official":true,"language":"en","supports":"Establishes the INTERPOL-coordinated Red Card 2.0 action against fraud infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_europol_bestmixer_2019","slug":"europol-bestmixer-io-taken-down-in-first-action-of-its-kind-against-crypto-mixin","source_type":"international_agency_release","source_quality":"P2","title":"BestMixer.io taken down in first action of its kind against crypto mixing service","publisher":"Europol","published_on":"2019-05-22","url":"https://www.europol.europa.eu/media-press/newsroom/news/multi-million-euro-cryptocurrency-laundering-service-bestmixerio-taken-down","archive_url":null,"official":true,"language":"en","supports":"Establishes the Dutch FIOD-led seizure of BestMixer, described as the first such action.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_sinbad_2023","slug":"us-doj-dutch-and-finnish-authorities-sinbad-cryptocurrency-mixer-infrastructure-","source_type":"prosecutor_release","source_quality":"P1","title":"Sinbad cryptocurrency mixer infrastructure seized","publisher":"US DOJ / Dutch and Finnish authorities","published_on":"2023-11-27","url":"https://www.justice.gov/archives/opa/pr/operators-cryptocurrency-mixers-charged-money-laundering","archive_url":null,"official":true,"language":"en","supports":"Establishes the trilateral seizure of Sinbad mixer infrastructure.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_huione_2026","slug":"us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back","source_type":"prosecutor_release","source_quality":"P1","title":"DOJ seizes cloud infrastructure behind Huione Group money-laundering backend","publisher":"US DOJ","published_on":"2026-06-23","url":"https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services","archive_url":null,"official":true,"language":"en","supports":"Establishes the seizure of a Huione Group-linked cloud-computing backend account.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_socksescort_2026","slug":"us-doj-socksescort-residential-proxy-network-disrupted","source_type":"prosecutor_release","source_quality":"P1","title":"SocksEscort residential proxy network disrupted","publisher":"US DOJ","published_on":"2026-03-01","url":"https://www.justice.gov/usao-edca/pr/authorities-dismantle-global-malicious-proxy-service-deployed-malware-and-defrauded","archive_url":null,"official":true,"language":"en","supports":"Establishes the seizure of dozens of SocksEscort domains.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_leakbase_2026","slug":"us-doj-fbi-leakbase-stolen-data-marketplace-seized","source_type":"prosecutor_release","source_quality":"P1","title":"LeakBase stolen-data marketplace seized","publisher":"US DOJ / FBI","published_on":"2026-03-04","url":"https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums","archive_url":null,"official":true,"language":"en","supports":"Establishes the LeakBase seizure and evidentiary preservation of user data.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_aisuru_2026","slug":"usao-alaska-us-doj-coordinated-disruption-of-aisuru-kimwolf-jackskid-and-mossad-","source_type":"prosecutor_release","source_quality":"S2","title":"Coordinated disruption of Aisuru, KimWolf, JackSkid, and Mossad IoT DDoS botnets","publisher":"USAO Alaska / US DOJ","published_on":"2026-03-19","url":"https://www.justice.gov/usao-ak/pr/authorities-disrupt-worlds-largest-iot-ddos-botnets-responsible-record-breaking-attacks","archive_url":null,"official":true,"language":"en","supports":"Establishes the multi-country disruption of the four related IoT DDoS botnet families.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_poweroff_apr2026_8domain","slug":"usao-alaska-poweroff-eight-ddos-for-hire-domains-seized","source_type":"prosecutor_release","source_quality":"S2","title":"PowerOFF: eight DDoS-for-hire domains seized","publisher":"USAO Alaska","published_on":"2026-04-16","url":"https://www.justice.gov/usao-ak/pr/us-authorities-conduct-cyber-operations-part-global-crackdown-ddos-hire-services","archive_url":null,"official":true,"language":"en","supports":"Establishes an eight-domain PowerOFF seizure attributed to USAO Alaska in April 2026.","notes":["Not independently re-verified in this pass. Possible overlap/duplication with td_2026_poweroff_apr flagged for reconciliation."]},{"reference_id":"src_doj_backpage_2018","slug":"us-doj-fbi-justice-department-leads-seizure-of-backpage-com-indicts-founders","source_type":"prosecutor_release","source_quality":"P1","title":"Justice Department leads seizure of Backpage.com, indicts founders","publisher":"US DOJ / FBI","published_on":"2018-04-06","url":"https://www.justice.gov/usao-az/pr/justice-department-leads-effort-seize-backpagecom-internet-s-leading-forum-prostitution","archive_url":null,"official":true,"language":"en","supports":"Establishes the Backpage.com seizure and the indictment of its founders and executives.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_3ve_2018","slug":"us-doj-fbi-nine-charged-in-36-million-digital-advertising-fraud-scheme-3ve-methb","source_type":"prosecutor_release","source_quality":"P1","title":"Nine charged in $36 million digital advertising fraud scheme (3ve/Methbot)","publisher":"US DOJ / FBI","published_on":"2018-11-27","url":"https://www.justice.gov/usao-edny/pr/two-international-cybercriminal-rings-dismantled-and-eight-defendants-indicted-causing","archive_url":null,"official":true,"language":"en","supports":"Establishes the 3ve ad-fraud botnet disruption and associated indictment.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_gru_router_2026","slug":"us-doj-doj-disrupts-gru-unit-26165-dns-hijacking-router-network","source_type":"prosecutor_release","source_quality":"P1","title":"DOJ disrupts GRU Unit 26165 DNS-hijacking router network","publisher":"US DOJ","published_on":"2026-04-01","url":"https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled","archive_url":null,"official":true,"language":"en","supports":"Establishes the court-authorized neutralization of the US-based portion of the GRU router network.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_lumma_rebound_2025","slug":"aggregated-security-reporting-lumma-stealer-operators-register-replacement-domai","source_type":"news_report","source_quality":"S1","title":"Lumma Stealer operators register replacement domains within a day of seizure","publisher":"Aggregated security reporting","published_on":"2025-05-22","url":null,"archive_url":null,"official":false,"language":"en","supports":"Establishes that Lumma operators stood up three replacement domains within roughly a day of the initial May 2025 seizure, which DOJ/Microsoft subsequently also seized.","notes":["Not independently re-verified in this pass.","No exact URL for this original source stub was recovered in the audit. The linked replacement source(s) support the material claim; no URL was invented."]},{"reference_id":"src_doj_anom_defendants_2021","slug":"usao-southern-district-of-california-17-defendants-named-in-anom-superseding-ind","source_type":"prosecutor_release","source_quality":"P1","title":"17 defendants named in ANOM superseding indictment","publisher":"USAO Southern District of California","published_on":"2021-06-08","url":"https://www.justice.gov/usao-sdca/pr/fbi-s-encrypted-phone-platform-infiltrated-hundreds-criminal-syndicates-result-massive","archive_url":null,"official":true,"language":"en","supports":"Establishes the 17-defendant ANOM distributor roster including Ayik, Catanzariti, Hosseini, Ayub, Ngakuru, Nikitovic, Kumar, Zakhimi, and Dmitrienko.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_danabot_defendants_2025","slug":"usao-central-district-of-california-16-defendants-federally-charged-in-connectio","source_type":"prosecutor_release","source_quality":"P1","title":"16 defendants federally charged in connection with DanaBot malware scheme","publisher":"USAO Central District of California","published_on":"2025-05-22","url":"https://www.justice.gov/usao-cdca/pr/16-defendants-federally-charged-connection-danabot-malware-scheme-infected-computers","archive_url":null,"official":true,"language":"en","supports":"Names lead defendants Aleksandr Stepanov ('JimmBee') and Artem Kalinkin ('Onix') among 16 charged in the DanaBot scheme (part of Operation Endgame wave 2).","notes":["Not independently re-verified in this pass.","Full 16-name roster is only partially public; remaining 14 largely pseudonymous/sealed per the compass-artifact verification pass."]},{"reference_id":"src_doj_cityxguide_2020","slug":"usao-northern-district-of-texas-fbi-cityxguide-seized-owner-wilhan-martono-charg","source_type":"prosecutor_release","source_quality":"S2","title":"CityXGuide seized; owner Wilhan Martono charged","publisher":"USAO Northern District of Texas / FBI","published_on":"2020-06-01","url":"https://www.justice.gov/usao-ndtx/pr/us-attorney-s-office-shuts-down-website-promoting-prostitution-and-sex-trafficking","archive_url":null,"official":true,"language":"en","supports":"Establishes the CityXGuide seizure and the 28-count indictment against owner Wilhan Martono.","notes":["Not independently re-verified in this pass.","A fully source-paired contemporaneous primary release was not recovered in the underlying research pass; treat this record as lower confidence pending direct retrieval of the USAO N.D. Tex. release."]},{"reference_id":"src_doj_btc_e_2017","slug":"us-doj-fbi-irs-ci-btc-e-cryptocurrency-exchange-dismantled-operator-alexander-vi","source_type":"prosecutor_release","source_quality":"S2","title":"BTC-e cryptocurrency exchange dismantled; operator Alexander Vinnik arrested","publisher":"US DOJ / FBI / IRS-CI","published_on":"2017-07-26","url":"https://www.justice.gov/usao-ndca/pr/russian-national-and-bitcoin-exchange-charged-21-count-indictment-operating-alleged","archive_url":null,"official":true,"language":"en","supports":"Establishes the BTC-e disruption and Vinnik's arrest in Greece.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_bitzlato_2023","slug":"us-doj-usao-edny-fbi-bitzlato-dismantled-founder-anatoly-legkodymov-charged","source_type":"prosecutor_release","source_quality":"P1","title":"Bitzlato dismantled; founder Anatoly Legkodymov charged","publisher":"US DOJ / USAO EDNY / FBI","published_on":"2023-01-18","url":"https://www.justice.gov/usao-edny/pr/founder-and-majority-owner-bitzlato-cryptocurrency-exchange-charged-unlicensed-money","archive_url":null,"official":true,"language":"en","supports":"Establishes the French-led dismantlement of Bitzlato infrastructure and the charge/arrest of founder Anatoly Legkodymov.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_z_library_2022","slug":"us-doj-usao-edny-fbi-z-library-domains-seized-two-russian-nationals-charged","source_type":"prosecutor_release","source_quality":"P1","title":"Z-Library domains seized; two Russian nationals charged","publisher":"US DOJ / USAO EDNY / FBI","published_on":"2022-11-16","url":"https://www.justice.gov/usao-edny/pr/two-russian-nationals-charged-running-massive-e-book-piracy-website","archive_url":null,"official":true,"language":"en","supports":"Establishes the approximately 249-domain seizure and the charges against Napolsky and Ermakova.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_kingdom_market_2023","slug":"us-doj-fbi-hsi-kingdom-market-darknet-marketplace-dismantled-administrator-alan-","source_type":"prosecutor_release","source_quality":"S2","title":"Kingdom Market darknet marketplace dismantled; administrator Alan Bill arrested","publisher":"US DOJ / FBI / HSI","published_on":"2023-12-01","url":"https://www.justice.gov/usao-edmo/pr/slovakian-man-accused-running-darknet-market-selling-drugs-and-personal-information","archive_url":null,"official":true,"language":"en","supports":"Establishes the Kingdom Market shutdown and the arrest of alleged administrator Alan Bill in Newark, New Jersey.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_dridex_2015","slug":"us-doj-fbi-uk-nca-dridex-botnet-disrupted-administrator-andrey-ghinkul-charged","source_type":"prosecutor_release","source_quality":"S2","title":"Dridex botnet disrupted; administrator Andrey Ghinkul charged","publisher":"US DOJ / FBI / UK NCA","published_on":"2015-10-13","url":"https://www.justice.gov/archives/opa/pr/bugat-botnet-administrator-arrested-and-malware-disabled","archive_url":null,"official":true,"language":"en","supports":"Establishes the Dridex disruption and the charge/arrest of Andrey Ghinkul in Cyprus.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_samourai_2024","slug":"us-doj-usao-sdny-irs-ci-fbi-samourai-wallet-founders-arrested-infrastructure-sei","source_type":"prosecutor_release","source_quality":"P1","title":"Samourai Wallet founders arrested; infrastructure seized","publisher":"US DOJ / USAO SDNY / IRS-CI / FBI","published_on":"2024-04-24","url":"https://www.justice.gov/usao-sdny/pr/founders-and-ceo-cryptocurrency-mixing-service-arrested-and-charged-money-laundering","archive_url":null,"official":true,"language":"en","supports":"Establishes the arrest of Samourai Wallet's founders and the seizure of web servers (Iceland) and domain/app infrastructure (US).","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_radar_dispossessor_2024","slug":"us-doj-fbi-cleveland-radar-dispossessor-ransomware-infrastructure-disabled","source_type":"prosecutor_release","source_quality":"S2","title":"Radar/Dispossessor ransomware infrastructure disabled","publisher":"US DOJ / FBI Cleveland","published_on":"2024-08-12","url":"https://www.justice.gov/usao-ndoh/pr/websites-seized-multi-national-ransomware-takedown","archive_url":null,"official":true,"language":"en","supports":"Establishes the disabling of Radar/Dispossessor infrastructure across the US, UK, and Germany, and the 'Brain' alias for the alleged operator.","notes":["Not independently re-verified in this pass."]},{"reference_id":"src_doj_monopoly_operator_2023","slug":"united-states-attorney-s-office-district-of-columbia-citizen-of-croatia-and-serb","source_type":"prosecutor_release","source_quality":"P1","title":"Citizen of Croatia and Serbia Charged with Running Monopoly Drug Market on the Darknet","publisher":"United States Attorney's Office, District of Columbia","published_on":"2023-06-27","url":"https://www.justice.gov/usao-dc/pr/citizen-croatia-and-serbia-charged-running-monopoly-drug-market-darknet","archive_url":null,"official":true,"language":"en","supports":"Milomir Desnica arrest, extradition, charges, and Monopoly Market operator role","notes":[]},{"reference_id":"src_doj_monopoly_sentence_2024","slug":"united-states-attorney-s-office-district-of-columbia-serbian-citizen-sentenced-t","source_type":"prosecutor_release","source_quality":"P1","title":"Serbian Citizen Sentenced to 14 Years in Prison for Operating Monopoly Narcotics Marketplace on Dark Web","publisher":"United States Attorney's Office, District of Columbia","published_on":"2024-02-15","url":"https://www.justice.gov/usao-dc/pr/serbian-citizen-sentenced-14-years-prison-operating-monopoly-narcotics-marketplace-dark","archive_url":null,"official":true,"language":"en","supports":"Milomir Desnica guilty plea and 168-month sentence","notes":[]},{"reference_id":"src_europol_socksescort_2026","slug":"www-europol-europa-eu-src_europol_socksescort_2026","source_type":"web_source","source_quality":"S2","title":"src_europol_socksescort_2026","publisher":"www.europol.europa.eu","published_on":null,"url":"https://www.europol.europa.eu/media-press/newsroom/news/europol-and-international-partners-disrupt-socksescort-proxy-service","archive_url":null,"official":false,"language":"en","supports":"Recovered source URL from verification pass","notes":[]},{"reference_id":"src_microsoft_zeroaccess_2013","slug":"microsoft-microsoft-the-fbi-europol-and-industry-partners-disrupt-the-notorious-","source_type":"official_private_partner_release","source_quality":"P2","title":"Microsoft, the FBI, Europol and industry partners disrupt the notorious ZeroAccess botnet","publisher":"Microsoft","published_on":"2013-12-05","url":"https://news.microsoft.com/source/2013/12/05/microsoft-the-fbi-europol-and-industry-partners-disrupt-the-notorious-zeroaccess-botnet/","archive_url":null,"official":true,"language":"en","supports":"ZeroAccess legal/technical disruption, agencies, 18 IP addresses, 49 domains and W.D. Tex. civil order","notes":[]},{"reference_id":"src_doj_anom_all_guilty_2025","slug":"united-states-attorney-s-office-southern-district-of-california-all-extradited-d","source_type":"prosecutor_release","source_quality":"P1","title":"All Extradited Distributors of ANOM Hardened Encrypted Devices Plead Guilty to Racketeering Conspiracy","publisher":"United States Attorney's Office, Southern District of California","published_on":"2025-02-07","url":"https://www.justice.gov/usao-sdca/pr/all-extradited-distributors-anom-hardened-encrypted-devices-plead-guilty-racketeering","archive_url":null,"official":true,"language":"en","supports":"ANOM case status, eight extradited guilty pleas, eight arrested abroad awaiting extradition, one fugitive, approximately 1,200 arrests","notes":[]},{"reference_id":"src_doj_samourai_pleas_2025","slug":"united-states-attorney-s-office-southern-district-of-new-york-founders-of-samour","source_type":"prosecutor_release","source_quality":"P1","title":"Founders of Samourai Wallet Cryptocurrency Mixing Service Plead Guilty","publisher":"United States Attorney's Office, Southern District of New York","published_on":"2025-08-06","url":"https://www.justice.gov/usao-sdny/pr/founders-samourai-wallet-cryptocurrency-mixing-service-plead-guilty","archive_url":null,"official":true,"language":"en","supports":"July 30, 2025 guilty pleas, Hill extradition, agencies and forfeiture agreement","notes":[]},{"reference_id":"src_doj_samourai_sentencing_2025","slug":"united-states-attorney-s-office-southern-district-of-new-york-founders-of-samo-2","source_type":"prosecutor_release","source_quality":"P1","title":"Founders of Samourai Wallet Cryptocurrency Mixing Service Sentenced to Five and Four Years in Prison","publisher":"United States Attorney's Office, Southern District of New York","published_on":"2025-11-19","url":"https://www.justice.gov/usao-sdny/pr/founders-samourai-wallet-cryptocurrency-mixing-service-sentenced-five-and-four-years","archive_url":null,"official":true,"language":"en","supports":"Rodriguez and Hill sentences, forfeiture, supervision and agency roles","notes":[]},{"reference_id":"src_doj_backpage_convictions_2023","slug":"united-states-department-of-justice-office-of-public-affairs-backpage-principals","source_type":"prosecutor_release","source_quality":"P1","title":"Backpage Principals Convicted of $500M Prostitution Promotion Scheme","publisher":"United States Department of Justice, Office of Public Affairs","published_on":"2023-11-17","url":"https://www.justice.gov/archives/opa/pr/backpage-principals-convicted-500m-prostitution-promotion-scheme","archive_url":null,"official":true,"language":"en","supports":"Trial convictions of Lacey, Spear and Brunst","notes":[]},{"reference_id":"src_doj_backpage_sentencing_2024","slug":"united-states-department-of-justice-office-of-public-affairs-three-owners-of-not","source_type":"prosecutor_release","source_quality":"P1","title":"Three Owners of Notorious Prostitution Website Backpage Sentenced","publisher":"United States Department of Justice, Office of Public Affairs","published_on":"2024-08-28","url":"https://www.justice.gov/archives/opa/pr/three-owners-notorious-prostitution-website-backpagecom-sentenced","archive_url":null,"official":true,"language":"en","supports":"Sentences for Lacey, Spear and Brunst; Ferrer and Hyer pleas; Larkin death; agencies","notes":[]},{"reference_id":"src_doj_backpage_case_page","slug":"united-states-attorney-s-office-district-of-arizona-united-states-v-backpage-cas","source_type":"court_case_page","source_quality":"P1","title":"United States v. Backpage case information and docket updates","publisher":"United States Attorney's Office, District of Arizona","published_on":null,"url":"https://www.justice.gov/usao-az/us-v-michael-lacey","archive_url":null,"official":true,"language":"en","supports":"Docket numbers, judgments, appeals, forfeiture cases and later sentencing entries","notes":[]},{"reference_id":"src_doj_cityxguide_sentence_2022","slug":"united-states-attorney-s-office-northern-district-of-texas-cityxguide-owner-sent","source_type":"prosecutor_release","source_quality":"P1","title":"CityXGuide Owner Sentenced to 8+ Years in Prison for Reckless Disregard of Sex Trafficking, Racketeering Conspiracy","publisher":"United States Attorney's Office, Northern District of Texas","published_on":"2022-11-14","url":"https://www.justice.gov/usao-ndtx/pr/cityxguide-owner-sentenced-8-years-prison-reckless-disregard-sex-trafficking","archive_url":null,"official":true,"language":"en","supports":"Wilhan Martono plea, 97-month sentence, arrest date conflict and agencies","notes":[]},{"reference_id":"src_doj_kingdom_plea_2026","slug":"united-states-attorney-s-office-eastern-district-of-missouri-slovakian-man-admit","source_type":"prosecutor_release","source_quality":"P1","title":"Slovakian Man Admits Aiding Darknet Market that Sold Drugs and Stolen Personal Information","publisher":"United States Attorney's Office, Eastern District of Missouri","published_on":"2026-01-27","url":"https://www.justice.gov/usao-edmo/pr/slovakian-man-admits-aiding-darknet-market-sold-drugs-and-stolen-personal-information","archive_url":null,"official":true,"language":"en","supports":"Alan Bill plea, offense, arrest and agency roster","notes":[]},{"reference_id":"src_doj_kingdom_sentence_2026","slug":"united-states-attorney-s-office-eastern-district-of-missouri-slovakian-administr","source_type":"prosecutor_release","source_quality":"P1","title":"Slovakian Administrator of Darknet Market that Sold Drugs and Stolen Personal Information Sentenced to 200 Months in Prison","publisher":"United States Attorney's Office, Eastern District of Missouri","published_on":"2026-05-08","url":"https://www.justice.gov/usao-edmo/pr/slovakian-administrator-darknet-market-sold-drugs-and-stolen-personal-information","archive_url":null,"official":true,"language":"en","supports":"Alan Bill 200-month sentence and forfeiture","notes":[]},{"reference_id":"src_doj_dridex_plea_2017","slug":"united-states-attorney-s-office-western-district-of-pennsylvania-moldovan-pleads","source_type":"prosecutor_release","source_quality":"P1","title":"Moldovan Pleads Guilty to Distributing Bugat Malware","publisher":"United States Attorney's Office, Western District of Pennsylvania","published_on":"2017-02-08","url":"https://www.justice.gov/usao-wdpa/pr/moldovan-pleads-guilty-distributing-bugat-malware","archive_url":null,"official":true,"language":"en","supports":"Andrey Ghinkul guilty plea","notes":[]},{"reference_id":"src_doj_dridex_sentence_2018","slug":"united-states-attorney-s-office-western-district-of-pennsylvania-moldovan-senten","source_type":"prosecutor_release","source_quality":"P1","title":"Moldovan Sentenced for Distributing Multifunction Malware Package","publisher":"United States Attorney's Office, Western District of Pennsylvania","published_on":"2018-12-06","url":"https://www.justice.gov/usao-wdpa/pr/moldovan-sentenced-distributing-multifunction-malware-package","archive_url":null,"official":true,"language":"en","supports":"Andrey Ghinkul extradition and time-served sentence","notes":[]},{"reference_id":"src_doj_btc_e_plea_2024","slug":"united-states-department-of-justice-office-of-public-affairs-btc-e-operator-plea","source_type":"prosecutor_release","source_quality":"P1","title":"BTC-e Operator Pleads Guilty to Money Laundering Conspiracy","publisher":"United States Department of Justice, Office of Public Affairs","published_on":"2024-05-03","url":"https://www.justice.gov/archives/opa/pr/btc-e-operator-pleads-guilty-money-laundering-conspiracy","archive_url":null,"official":true,"language":"en","supports":"Alexander Vinnik guilty plea and BTC-e case status","notes":[]},{"reference_id":"src_reuters_vinnik_swap_2025","slug":"reuters-russian-alexander-vinnik-back-in-moscow-after-prisoner-swap-ria-news-age","source_type":"news_report","source_quality":"S1","title":"Russian Alexander Vinnik back in Moscow after prisoner swap, RIA news agency says","publisher":"Reuters","published_on":"2025-02-13","url":"https://www.reuters.com/world/plane-carrying-alexander-vinnik-released-by-us-prisoner-swap-arrives-moscow-2025-02-13/","archive_url":null,"official":false,"language":"en","supports":"Vinnik release from U.S. custody and return to Russia in prisoner exchange","notes":[]},{"reference_id":"src_doj_lockbit_pleas_2024","slug":"united-states-attorney-s-office-district-of-new-jersey-two-foreign-nationals-ple","source_type":"prosecutor_release","source_quality":"P1","title":"Two Foreign Nationals Plead Guilty to Participation in LockBit Ransomware Group","publisher":"United States Attorney's Office, District of New Jersey","published_on":"2024-07-18","url":"https://www.justice.gov/usao-nj/pr/two-foreign-nationals-plead-guilty-participation-lockbit-ransomware-group","archive_url":null,"official":true,"language":"en","supports":"Guilty pleas and custody status of Astamirov and Vasiliev","notes":[]},{"reference_id":"src_doj_lockbit_panev_extradition_2025","slug":"united-states-attorney-s-office-district-of-new-jersey-dual-russian-and-israeli-","source_type":"prosecutor_release","source_quality":"P1","title":"Dual Russian and Israeli National Extradited to the United States for His Role in the LockBit Ransomware Conspiracy","publisher":"United States Attorney's Office, District of New Jersey","published_on":"2025-03-13","url":"https://www.justice.gov/usao-nj/pr/dual-russian-and-israeli-national-extradited-united-states-his-role-lockbit-ransomware","archive_url":null,"official":true,"language":"en","supports":"Panev arrest, extradition and detention; current statuses of charged LockBit defendants","notes":[]},{"reference_id":"src_doj_bitzlato_plea_2023","slug":"united-states-attorney-s-office-eastern-district-of-new-york-founder-and-majorit","source_type":"prosecutor_release","source_quality":"P1","title":"Founder and Majority Owner of Cryptocurrency Exchange Pleads Guilty to Unlicensed Money Transmitting","publisher":"United States Attorney's Office, Eastern District of New York","published_on":"2023-12-06","url":"https://www.justice.gov/usao-edny/pr/founder-and-majority-owner-cryptocurrency-exchange-pleads-guilty-unlicensed-money","archive_url":null,"official":true,"language":"en","supports":"Legkodymov guilty plea, forfeiture and docket 23-CR-496 (ENV)","notes":[]},{"reference_id":"src_doj_kimwolf_butler_2026","slug":"united-states-attorney-s-office-district-of-alaska-canadian-man-arrested-by-inte","source_type":"prosecutor_release","source_quality":"P1","title":"Canadian Man Arrested by International Authorities, Charged with Administrating KimWolf DDoS Botnet","publisher":"United States Attorney's Office, District of Alaska","published_on":"2026-05-21","url":"https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos","archive_url":null,"official":true,"language":"en","supports":"Jacob Butler charge, Canadian arrest and extradition warrant; related KimWolf infrastructure disruption","notes":[]},{"reference_id":"src_nz_court_dotcom_high_2025","slug":"high-court-of-new-zealand-dotcom-v-minister-of-justice-2025-nzhc-2634","source_type":"court_decision","source_quality":"P1","title":"Dotcom v Minister of Justice [2025] NZHC 2634","publisher":"High Court of New Zealand","published_on":"2025-09-19","url":"https://www.courtsofnz.govt.nz/assets/cases/2025/2025-NZHC-2634.pdf","archive_url":null,"official":true,"language":"en","supports":"Kim Dotcom judicial review/extradition decision and High Court proceeding CIV-2024-485-583","notes":[]},{"reference_id":"src_nz_court_dotcom_appeal_2026","slug":"court-of-appeal-of-new-zealand-dotcom-v-minister-of-justice-2026-nzca-284","source_type":"court_decision","source_quality":"P1","title":"Dotcom v Minister of Justice [2026] NZCA 284","publisher":"Court of Appeal of New Zealand","published_on":"2026-07-01","url":"https://www.courtsofnz.govt.nz/assets/cases/2026/2026-NZCA-284.pdf","archive_url":null,"official":true,"language":"en","supports":"Court of Appeal dismissal of Kim Dotcom extradition appeal; one Supreme Court route remained","notes":[]},{"reference_id":"src_infosecurity_matveev_russia_charge_2024","slug":"infosecurity-magazine-russia-arrests-prominent-ransomware-operator","source_type":"news_report","source_quality":"S2","title":"Russia Arrests Prominent Ransomware Operator","publisher":"Infosecurity Magazine","published_on":"2024-12-02","url":"https://www.infosecurity-magazine.com/news/russia-arrests-ransomware-wazawaka/","archive_url":null,"official":false,"language":"en","supports":"Secondary reporting that links the unnamed Kaliningrad domestic malware prosecution to Mikhail Matveev; the identity linkage relies on Russian media sourcing and is not an official named Russian release","notes":[]}]}