Organizations and roles
Last reviewed August 21, 2026
The public record puts 5 organizations on this action. Operational lead: Verden Public Prosecutor. The table lists the role the cited record assigns each one, in the record's own wording where it gives any.
Why this page names organizations only
Roles on this page describe the agencies that took part. Individuals named in the public record appear on the takedown entry itself, under People and accountability.
Organizations and roles
| Emblem | Organization | Role | What the record says |
|---|---|---|---|
| Staatsanwaltschaft Verden Germany , Germany | Operational lead | Directed the German-led investigation and obtained the judicial orders. | |
| European Union Agency for Law Enforcement Cooperation | Coordinator | Coordinated the 30-country operation. | |
| European Union Agency for Criminal Justice Cooperation | Judicial cooperation | Coordinated judicial cooperation across participating states. | |
| The Shadowserver Foundation Netherlands , Netherlands | Technical partner | Operated the sinkhole infrastructure used for victim notification. | |
| Federal Bureau of Investigation United States , United States | Supporting | Participated in the US component of the disruption. |
Accountability
Legal authority
German judicial orders (Verden Public Prosecutor's Office); coordinated domain actions with registries and registrars across many TLDs; Europol and Eurojust coordination
Oversight
The record assigns prosecuting or judicial roles to Eurojust.
Ongoing investigation
Group accounted for: Partial. Five arrests were officially reported but no core operator roster was published, and the service supported numerous independent criminal groups that were unaffected.
This page records organizational involvement as the cited sources state it. Where a role carries no description, the record gives none.
Last reviewed August 21, 2026