Global Sting Operation Unmasks Criminals: 232 Arrested Using Encrypted Chat Bust

Global Sting Operation Unmasks Criminals: 232 Arrested Using Encrypted Chat Bust

At a glance

• Arrests: 232 suspects were arrested in coordinated raids in Türkiye and several European countries on April 15, 2025.
• Encrypted Chat Platforms: Operation BULUT was built on intelligence from the long-defunct Sky ECC and Anom platforms.
• Global Collaboration: Police in Belgium, France, Germany, the Netherlands, Spain and Türkiye worked with Europol; Australia’s federal police supplied Anom data.
• Key Outcomes: Four drug networks dismantled, over EUR 300 million in assets seized and at least 21 tonnes of drugs linked to the groups.
• What it shows: Old encrypted-chat data is still producing cases years after the platforms were shut down.

Old chat data, new arrests

Criminals once trusted encrypted phones to keep their deals private. Years after those services were shut down, their messages are still putting people in handcuffs. In Operation Bulut (“cloud” in Turkish), police used decrypted data from Sky ECC and Anom to take apart four major drug trafficking networks operating across Europe and Türkiye.

How Operation Bulut came together

Europol coordinated the operation. French authorities shared decrypted Sky ECC data with Türkiye, and the Australian Federal Police provided Anom intelligence. Turkish National Police officers then worked at Europol’s headquarters alongside European investigators, and on April 15, 2025, raids led to the arrest of 232 suspects, including high-value targets in the networks’ leadership.

The first arrests came in Türkiye, aimed at the top of the trafficking hierarchy. When investigators found strong links to crime inside the EU, a second phase brought in police from Belgium, France, Germany, the Netherlands and Spain.

Why the chat data still works

Neither platform was “cracked” during this operation. Sky ECC was penetrated by European police in 2021, and Anom was a phone network secretly run by the FBI and its partners until it was revealed that same year. The messages collected then are still being analyzed.

Europol cross-checked suspects against passenger records and other datasets, which allowed quiet surveillance of key targets before the raids.

From intelligence to seizures

According to Europol, more than EUR 300 million in assets were seized across Türkiye and Europe, including 681 properties and 127 vehicles. The groups were linked to the seizure of at least 21 tonnes of drugs, including 3.3 million MDMA tablets.

The case shows what old intelligence can still do. Messages written years ago led investigators to properties, vehicles and people.

Who took part

Several agencies carried out the investigation.

They included France’s JUNALCO prosecutors and national police, the Dutch National Police, Belgium’s Federal Judicial Police, Germany’s Bundeskriminalamt, Spain’s National Police and Guardia Civil, and Türkiye’s National Police, with Europol running a real-time coordination platform during the raids.

What it means for police and for privacy

The arrest of 232 suspects shows that encrypted platforms are not a safe haven once police get inside them, even years later.

Criminal groups have since moved to other apps, and police will have to adapt again. The case also renews debate about privacy and the bulk collection of encrypted messages.

Encrypted apps are now part of everyday personal and business communication. Balancing privacy rights against police access to them will keep getting harder.

What comes next

Operation Bulut shows how far international police cooperation can stretch the value of a single intelligence haul.

“Years after their takedown, encrypted platforms like SKY ECC and ANOM are still helping law enforcement turn intelligence into action,” said Jean-Philippe Lecouffe, Europol’s Executive Deputy Director Operations. Criminal groups have moved to new tools, and police will have to keep up.

The open question is what happens when the Sky ECC and Anom data runs dry. Police will need new sources, and criminals will be looking for apps that stay closed.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.