Europol Cracks Encrypted Platform ‘Ghost’ Used for Organized Crime

In a coordinated global effort, Europol, Eurojust, and law enforcement agencies from nine countries successfully dismantled an encrypted communication platform, Ghost, which was used by criminal networks to facilitate serious organized crime. The platform was involved in a range of illegal activities including drug trafficking, money laundering, and violent crimes. The operation marks a major victory in the ongoing fight against criminal networks using sophisticated encryption to evade law enforcement.

Launched in March 2022, the investigation into Ghost involved law enforcement from Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden, and the United States. These authorities worked under the judicial oversight of a Joint Investigation Team (JIT) set up between France and the U.S. in early 2024. During the operation, which spanned across multiple continents, 51 arrests were made, including 38 in Australia, where authorities also shut down a drug lab, seized drugs, weapons, and over €1 million in cash. Notably, one arrest was linked to the Italian mafia group Sacra Corona Unita. Further arrests are expected as the investigation continues.

Ghost attracted criminal networks due to its advanced security features. It operated using three encryption standards and allowed users to send self-destructing messages that erased all content on the recipient's phone using a special code. This capability provided anonymity and made it difficult for law enforcement to track or intercept communications. At its peak, Ghost facilitated thousands of encrypted messages daily, with a global network of resellers supporting its operations.

The platform's servers were discovered in France and Iceland, while its financial ties stretched to the U.S. and Australia, highlighting the platform's international reach. The coordinated raids and technical interventions involved cyber experts and intelligence agencies who mapped the platform’s global infrastructure, leading to its eventual shutdown.

Europol's taskforce (OTF) played a key role in identifying Ghost's suppliers, users, and resellers. This work, complemented by detailed cyber-investigations and cryptocurrency transaction analyses, enabled law enforcement to strike at the heart of the platform’s criminal usage.

As the landscape of encrypted communications continues to evolve, law enforcement agencies face a fragmented market where criminal actors shift between new, custom-built communication tools.

The takedown of Ghost reaffirms that even the most secure communication platforms can be compromised by well-coordinated law enforcement efforts, and serves as a warning to other criminal networks relying on encryption to shield their operations. The investigation continues, with more arrests anticipated as law enforcement agencies deepen their analysis of the platform's usage and connections.