Europol and Eurojust Roles in Cybercrime Extraditions

A ransomware gang hits a hospital in France. Its servers sit in Germany. Its administrators work from Russia. Its victims pay in cryptocurrency that bounces through wallets on three continents. No single police force can chase all of that. That's why two agencies with unglamorous names now matter more than ever.

Cybercrime treats borders as a feature, not a bug. Servers, administrators, victims, and money flows routinely span a dozen or more jurisdictions. A national prosecutor can build the strongest case in the world against a suspect and still find the person physically out of reach. The evidence lives in one country, the suspect in another, and the wallets in several more.

Europol's IOCTA 2026, titled "How encryption, proxies, and AI are expanding cybercrime," spells out how much worse this has gotten. AI lowers the skill floor. Encryption hides the traffic. Cybercrime-as-a-service models let one developer sell infrastructure to hundreds of buyers who never meet. The same report identifies more than 120 active ransomware variants in 2025, each typically involving infrastructure spread across multiple jurisdictions.

The result is a mismatch that defines the whole problem. Crime globalized. Justice didn't. A country's police power stops at its own border, while the criminals behind a ransomware attack never had to cross one. That's the gap two European agencies are built to close, each in its own lane.

What Europol actually does in a cybercrime investigation

Europol is not a European FBI. It holds no arrest powers. When headlines say "Europol arrests cybercriminals," the operational reality is that national police executed those arrests using intelligence and coordination Europol provided. The headline is shorthand. The work is connective tissue.

The European Cybercrime Centre, or EC3, is the operational hub. In 2025 it supported hundreds of operations, produced thousands of operational reports, supported multiple Operational Task Forces, and coordinated dozens of Action Days leading to hundreds of arrests. All of that happened as a coordination and analysis function, not an enforcement one. Nobody at Europol kicks down a door.

That might sound like a limitation. It's actually what lets Europol work across 27 member states at once. A central European force with arrest powers would hit sovereignty conflicts the moment it tried to operate in France or Germany. A coordination hub doesn't. It moves information, not handcuffs.

In November 2025, Europol launched the Europol Threat Intelligence Platform (ETIP). The goal is a community for member-state and trusted-partner users to share and correlate law enforcement and open-source information about cyber threats. The launch workshop included discussions on integration with the Malware Information Sharing Platform, or MISP, the open-source threat-sharing standard many security teams already use.

The investigative pattern EC3 follows across major operations is consistent. Seize the platform. Preserve the database. Map the money. Identify administrators. Then target prolific users. Each step produces evidence that travels across borders better than any individual officer can.

Seized criminal infrastructure becomes an evidence trove. Private messages reveal roles and deals. Login metadata connects aliases to IP addresses. Payment records link handles to wallets. Reputation systems identify key actors. In one operation, law enforcement took coordinated action against 37 of LeakBase's most active users across multiple countries. The data did the work of identifying them. Europol did the work of getting that data into the right hands.

What Eurojust does once suspects are identified

Europol assembles the evidentiary picture. Eurojust coordinates what happens next in court systems. It facilitates European Arrest Warrants, European Investigation Orders, mutual legal assistance requests, and confiscation and freezing orders across member states with differing legal frameworks. If Europol finds the suspects, Eurojust figures out who gets to prosecute them.

The word "extradition" carries the drama, but it's a minority instrument in Eurojust's toolkit. Eurojust's 2025 support instruments show European Investigation Orders accounting for nearly half of open cases. Mutual legal assistance requests account for roughly a third. European Arrest Warrants and extradition proceedings make up a much smaller share. Most of the judicial work never involves physically moving a person across a border. It moves evidence, freezes assets, and coordinates prosecutions instead.

Eurojust also resolves conflicts of jurisdiction. When France, Germany, and the Netherlands all have a legitimate claim on the same suspect, someone has to decide which country prosecutes. Parallel prosecutions would fragment accountability and burn through evidence. Eurojust makes that call.

The agency hosts the European Judicial Cybercrime Network, established in 2016. The network builds shared expertise and best practice among judicial practitioners specifically on cybercrime. That deepens the bench of judges and prosecutors who can handle the cases Europol generates. The Cybercrime Judicial Monitor, with Issue 11 published June 2026, is Eurojust's primary public instrument for spreading case law and legislative developments to practitioners across member states.

The demand is growing. Eurojust's Joint Investigation Team support increased 11% from 2024 to 2025. Cybercrime cases don't respect national court calendars. Someone has to make the calendars talk to each other.

Joint Investigation Teams as the mechanism that connects the two agencies

Joint Investigation Teams are where the two agencies stop working in sequence and start working in the same room. Investigators from multiple countries work under a shared legal framework, with Europol providing analytical support inside the team and Eurojust providing judicial coordination around it. The output is one investigation with many passports.

In 2025, Eurojust supported 412 Joint Investigation Teams, more than in any prior year. That number reflects the increasing complexity of cross-border cybercrime cases. A single operation might need a warrant in one country, a wiretap in a second, and an asset freeze in a third. A JIT lets everyone plan those moves together instead of mailing requests back and forth.

The Sky ECC case shows how the structure works in practice. Belgium, France, and the Netherlands formed a JIT to investigate serious organized crime linked to the Sky ECC encrypted communications platform. Europol provided analytical support to process and organize intercepted decrypted data. The data was massive. The phones were everywhere. No single country could have handled it alone.

A General Court ruling in the case, BW v Europol and Eurojust, from 25 February 2026, settled an important legal question. The Court established that Europol and Eurojust's conduct, meaning participation in meetings, analytical activities, and information exchange, constituted preparatory measures without binding legal effects. In plain terms, the agencies can't be directly challenged for doing intelligence work. That gives them significant latitude to act as intelligence intermediaries inside a JIT.

The ruling matters for how aggressively the agencies can operate in future investigations. If every coordination meeting opened them to lawsuits, they'd be paralyzed. Instead, the law treats their role as preparation, not decision. National authorities remain the ones who pull the triggers. Europol and Eurojust hand them the loaded evidence.

How Operation Endgame demonstrates the sequential model across a multi-year, multi-phase operation

Operation Endgame is the clearest available demonstration of the full Europol-to-Eurojust pipeline. International cooperation was coordinated from the outset through both agencies, targeting infostealer, RAT, and botnet infrastructure responsible for infecting hundreds of thousands of computers worldwide. This wasn't a single raid. It's been a rolling campaign.

The May 2025 phase set the pattern. Authorities took down approximately 300 servers worldwide, neutralized hundreds of domains, and issued international arrest warrants against a number of targets. Each takedown dealt a direct blow to the ransomware kill chain. Servers don't just host crime. They're load-bearing infrastructure for the whole business model.

The November 2025 phase widened the net. Law enforcement and judicial agencies from Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the United Kingdom, and the United States arrested the main VenomRAT suspect in Greece. They also seized or disrupted a large number of servers and internet domains. Eleven countries, one suspect, one coordinated arrest. That's the model working as designed.

The June 18, 2026, phase went after SocGholish malware tied to a threat actor known for malware distribution. Dutch, U.S., Canadian, and German authorities backed by Europol and Eurojust remediated thousands of websites infected with SocGholish and took down scores of servers and domains. Victims didn't just watch the takedown. Their websites got cleaned.

But the Russia ceiling reappears. The DanaBot charges involved 16 people linked to a Russia-based organization. Warrants were issued. The absence of a U.S.–Russia extradition treaty prevents physical surrender. Evidentiary success and legal attribution do not guarantee enforcement. The pipeline can carry everything except a suspect out of a country that won't cooperate.

The structural obstacles that cause extraditions to stall even when investigations succeed

Even when Europol builds a complete evidentiary picture and Eurojust obtains the right judicial instruments, extradition can fail at three structural points. Political borders come first: no treaty with Russia, Belarus, or other states harboring major cybercrime actors means no surrender, no matter how strong the case. Encryption and data retention gaps come second. Conflicting national legal frameworks come third, delaying or blocking surrender even among cooperating states.

IOCTA 2026 names the encryption challenge explicitly. Widespread end-to-end encrypted platforms combined with restrictive data retention policies create investigative blind spots. By the time authorities request access to digital evidence, it's often no longer available. The data simply expired before anyone asked for it.

The 2024 Common Challenges in Cybercrime report, a Europol–Eurojust joint publication, identifies seven persistent structural gaps. Data volume. Data loss. Access to data. Anonymisation services. Obstacles to international cooperation. Rapid response, prevention, and awareness. Challenges for public-private partnerships. None have been fully resolved by subsequent legislative tools.

New laws help at the margins. The EU e-Evidence Package and the Digital Services Act are cited in the same report as partial responses. But their effectiveness depends on uptake across member states and cooperation from non-EU jurisdictions. A law passes in one jurisdiction. A server sits in another. The gap remains.

The practical implication for CISOs and security teams is blunt. Law enforcement action disrupts criminal ecosystems but cannot substitute for organizational defense. The political and jurisdictional ceiling means some threat actors operate with effective impunity regardless of attribution quality. You can name them. You can charge them. You still can't bring them in. That's not a failure of the investigation. It's a limit of the map.

What successful cases show about the conditions that make extradition and enforcement possible

When suspects are located in jurisdictions that cooperate, whether EU member states, treaty partners, or states with extradition relationships, the Europol-to-Eurojust pipeline reliably converts intelligence into enforcement. The difference between a success story and a stalled case is usually geography. The AudiA6 takedown in June 2026 shows the system at full strength. Europol-coordinated international investigators dismantled a cryptocurrency laundering service suspected of laundering more than EUR 336 million between 2022 and 2025. Two suspected administrators were arrested in Georgia. Multiple domains shut down, servers seized, and cryptocurrency frozen or seized. Georgia cooperated. The suspects were within reach. The operation delivered.

Operation Talent, from January 2025, disrupted Cracked and Nulled, two major cybercrime marketplaces with millions of users each and combined revenue in the millions of dollars. The takedown also seized related hosting infrastructure and payment processors. The message: targeting the criminal business layer, not just malware, is now standard practice. You can shut down the forums where criminals buy and sell, not just the tools they use.

One October 2026 ransomware group takedown, coordinated by Eurojust and Europol across nine countries, shut down a group responsible for a large number of attacks worldwide. A 16-year-old identified as the main operator was among those arrested. Age and apparent obscurity don't provide operational protection when the evidentiary and judicial pipeline is fully engaged. The kid thought a gamertag was a mask. It wasn't.

The conditions that correlate with enforcement success are consistent across cases. Suspects in cooperating jurisdictions. Financial infrastructure traceable on-chain. Seized platform databases that yield alias-to-identity linkages. JIT structures that pre-coordinate legal authority across countries before action days. When those conditions line up, the arrests happen. When they don't, the warrants pile up.

Where private-sector intelligence fits into the enforcement pipeline

Private-sector threat intelligence has become a material input to Europol investigations, not an optional supplement. The reason is scale. The cybercrime-as-a-service ecosystem moves faster and wider than law enforcement can monitor independently. Vendors see the infrastructure first because victims call them before they call the police.

In June 2025, Microsoft announced a partnership with Europol embedding corporate representatives at the European Cybercrime Centre to support joint operations. That formalized a public-private intelligence interface that had previously operated ad hoc. A Microsoft researcher now sits where the case files come in. Their telemetry has a direct line to investigators.

The formalization matters, but so do the gaps. A joint Eurojust and Europol report explicitly identifies public-private partnerships as one of five structural challenge areas. No standardized rules of engagement exist. Cooperation quality varies by operation and relationship. One vendor might share everything in real time. Another might sit on the same data for legal review. The pipeline is only as good as the relationship feeding it.

For security vendors, the implication is direct. Threat intelligence shared with law enforcement, whether malware samples, infrastructure mapping, wallet addresses, or seller handles, may become evidence in prosecutions. The sharing relationship isn't just reputational. A sample you upload today might be a court exhibit next year.

IOCTA 2026 documents the blurring of hybrid state actors and criminal networks. Hybrid threat actors now use cybercriminal infrastructure as proxies. That means vendor intelligence on nation-state-adjacent campaigns may feed directly into the enforcement and extradition cases the agencies are building. The line between state-sponsored and profit-driven is getting harder to draw. The agencies don't care which side a suspect is on. They care whether the evidence holds up in court.