The annual Internet Organized Crime Threat Assessment Report (IOCTA 2026) highlights that digital fraud, online child sexual exploitation, and cyberattacks pose a growing threat to society.
“Cybercriminals are rapidly exploiting advanced technologies, particularly artificial intelligence tools, to increase the speed, efficiency and scope of their illegal activities,” said Catherine De Bolle, Executive Director of Europol.
“These tools not only enable the automation of criminal processes, but also blur the line between legitimate and malicious uses of technology,” she added.
The report, titled "How Encryption, Proxies, and Artificial Intelligence Are Expanding Cybercrime," highlights the increasing pace and sophistication of cyber threats, highlighting the need for more advanced law enforcement capabilities and international cooperation.
Europol emphasizes that the investigation and prosecution of cybercrime poses a serious challenge for law enforcement agencies, due to the use of end-to-end encryption by criminal groups and complex technical and jurisdictional barriers, which create difficulties in identifying suspects and collecting evidence.
Cryptocurrencies remain the preferred payment method for cybercriminals, particularly in ransomware attacks. Europol notes that the increasing use of highly anonymous currencies and mixing services further complicates the ability of law enforcement agencies to track illicit financial flows.
Fraudulent schemes
The European law enforcement agency highlights that online fraud schemes pose a growing threat, through which organized crime groups target individuals or companies through investment schemes, compromising business emails and online payment systems. Europol emphasizes that fraudulent investment schemes through cryptocurrency, which have spread over the last decade through telephone call centers also in Albania, are particularly worrying.
According to Europol, these types of schemes are organized by transnational criminal organizations, using a series of logistical, technical and financial operations to commit fraud on a large scale. The report highlights that the techniques used by these criminal groups have become increasingly sophisticated, as a result of the use of artificial intelligence and the “crime as a service” model.
Ransomware attacks continue to be a serious threat. According to Europol, over 120 active “brands” were identified during 2025. The line between actors who carry out these attacks for financial gain and hybrid threats has become increasingly blurred. Hybrid threat actors are increasingly using criminal networks as intermediaries for destabilizing operations, including DDoS attacks, intrusions and ransomware attacks.
Also, extortion tactics aimed at exerting psychological pressure on victims are constantly on the rise, including data extortion, DDoS attacks, and threatening phone calls.
Decentralization of the “dark web”
The Europol report highlights that the viability of criminal digital markets on the so-called "dark web" plays an important role in enabling cybercrime.
The dark web is a hidden part of the internet that is not indexed by search engines and is only accessed through special programs like Tor, which guarantee the anonymity of users.
For decades, markets offering various criminal services or illegal goods have operated in this digital ecosystem. Archetyp Market, for example, operated as a dark web marketplace for the sale of drugs since 2020, registering more than 600,000 users and a transaction volume of over 250 million euros.
During 2025, these types of marketplaces have shown signs of shrinking, being replaced by more specialized sites. Also, the lifespan of these criminal platforms has shortened, as administrators have become more cautious about the risk of intervention by law enforcement agencies.
The focus of smaller marketplaces is the brokerage of various forms of online fraud and services such as “malware.” Since these marketplaces are made up of smaller communities, they have higher operational security, as administrators limit or control membership.
However, these platforms also face sustainability problems, often becoming a source of fraud against their own members, through sudden closures that remain common.
The report highlights an alarming increase in online child sexual exploitation, including sexual extortion and the trade in abusive material. A new challenge is the production of synthetic material through artificial intelligence, which complicates the identification of victims and investigations. Europol notes that fully encrypted applications have become the main communication channels for these networks, creating “dark zones” for investigators.
“The current epidemic of online fraud, the threat posed by ransomware that intersects with hybrid threats, and the monetization of child sexual abuse material underscore the urgent need for more proactive and collaborative efforts,” writes Catherine De Bolle.
“The accelerating pace of cybercrime poses increasingly sophisticated threats to society, with harmful consequences both online and offline,” she concluded./BIRN
