Démantèlements du dark web : chronologie des actions des forces de l'ordre

BlackSuit (Royal) servers and domains taken down

According to the U.S. Department of Justice, U.S. agencies and international partners took down four servers and nine domains of the BlackSuit (Royal) ransomware group on July 24, 2025. A warrant for the seizure of virtual currency valued at about $1.09 million was also unsealed.

Source: U.S. Department of Justice

Suspected XSS forum administrator arrested in Kyiv

According to Europol, an investigation led by French police and the Paris prosecutor, with Ukrainian authorities and Europol, led to the arrest of the suspected administrator of the XSS forum in Kyiv on 22 July 2025.

Source: Europol

Archetyp Market dismantled in six-country operation

According to Europol, authorities from six countries, supported by Europol and Eurojust, dismantled Archetyp Market in coordinated actions between 11 and 13 June 2025. The platform's infrastructure in the Netherlands was taken offline and its suspected administrator was arrested in Spain. Dated here to the day of the official announcement.

Source: Europol

Four suspected 8Base leaders arrested, servers taken down

According to Europol, a coordinated international action in the week before the announcement led to the arrest of four individuals suspected of leading the 8Base ransomware group, and 27 servers linked to the network were taken down. Dated here to the day of the official announcement.

Source: Europol

Cracked marketplace infrastructure taken down

According to the U.S. Department of Justice, it took part in a multinational operation, announced alongside the Europol-supported Operation Talent, to disrupt and take down the infrastructure of the Cracked and Nulled cybercrime marketplaces. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

Nulled forum taken down in Operation Talent

According to Europol, a German-led operation involving law enforcement from eight countries took down the Cracked and Nulled forums between 28 and 30 January 2025. Two suspects were arrested, 17 servers were seized and 12 domains of the two platforms were seized. Dated here to the day of the official announcement.

Source: Europol

LockBit infrastructure seized in UK-led operation

According to the U.S. Department of Justice, the UK National Crime Agency, working with the Justice Department, the FBI and international partners, disrupted LockBit by seizing public-facing websites and taking control of servers used by its administrators. A U.S. indictment charging two Russian nationals was also announced. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

DOJ announces disruption of ALPHV/Blackcat ransomware

According to the U.S. Department of Justice, a disruption campaign was carried out against the ALPHV/Blackcat ransomware group, and the FBI developed a decryption tool offered to more than 500 affected victims. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

Ragnar Locker infrastructure seized, key suspect arrested

According to Europol, an action carried out between 16 and 20 October 2023 by authorities from eleven countries led to the arrest of the group's key target in Paris on 16 October. The ransomware's infrastructure was seized in the Netherlands, Germany and Sweden and its data leak site was taken down.

Source: Europol

BreachForums founder arrested and forum disrupted

According to the U.S. Department of Justice, the alleged founder of BreachForums was arrested on March 15, 2023, and the FBI and the Department of Health and Human Services Office of Inspector General conducted a disruption operation that took the forum offline.

Source: U.S. Department of Justice

Suspected DoppelPaymer core members targeted

According to Europol, on 28 February 2023 German regional police and the Ukrainian National Police, supported by Europol, Dutch police and the FBI, targeted suspected core members of the group behind the DoppelPaymer ransomware.

Source: Europol

Hive ransomware servers and websites seized

According to the U.S. Department of Justice, the FBI had penetrated Hive's networks since July 2022 and provided decryption keys to victims. In coordination with German and Dutch authorities, it then seized control of the servers and websites Hive used to communicate with its members. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

Alleged operator of The Real Deal arraigned

According to the U.S. Attorney's Office for the Northern District of Georgia, the alleged operator of The Real Deal market was arraigned on access device fraud and money laundering conspiracy charges. The release says a federal grand jury returned the indictment on April 13, 2021. Dated here to the day of the official announcement.

Source: U.S. Attorney's Office, Northern District of Georgia (U.S. Department of Justice)

Hydra Market servers seized in Germany

According to the U.S. Department of Justice, the German Federal Criminal Police, in coordination with U.S. law enforcement, seized Hydra Market's servers and cryptocurrency wallets holding about $25 million in bitcoin on the morning of the announcement. A Russian resident was indicted on conspiracy charges related to operating the market.

Source: U.S. Department of Justice

REvil suspects charged; $6.1 million seized

According to the U.S. Department of Justice, an indictment was unsealed charging a Ukrainian national with Sodinokibi/REvil ransomware attacks, and $6.1 million traceable to alleged ransom payments received by a charged Russian national was seized. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

Ukrainian police expose group using Clop ransomware

According to the Cyberpolice Department of the National Police of Ukraine, six suspects accused of carrying out Clop ransomware attacks on South Korean and U.S. organisations were exposed in an international operation coordinated through Interpol with law enforcement from South Korea and the United States. Dated here to the day of the official announcement.

Source: Cyberpolice Department, National Police of Ukraine

DOJ seizes ransom paid to DarkSide

According to the U.S. Department of Justice, it seized 63.7 bitcoins, then valued at about $2.3 million, alleged to be proceeds of a ransom payment to the DarkSide group, under a seizure warrant authorized the same day.

Source: U.S. Department of Justice

Coordinated action against NetWalker ransomware announced

According to the U.S. Department of Justice, a coordinated international action against NetWalker included charges against a Canadian national, the seizure of about $454,530 in cryptocurrency from ransom payments, and the disabling of a dark web resource used to communicate with victims. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

AlphaBay marketplace seized in international operation

According to the U.S. Department of Justice, a U.S.-led international operation seized the infrastructure of AlphaBay, with cooperation from authorities in Thailand, the Netherlands, Lithuania, Canada, the United Kingdom and France, and Europol. The release states the alleged creator and administrator was arrested in Thailand on July 5. Dated here to the day of the official announcement.

Source: U.S. Department of Justice

Hansa Market taken down by Dutch police

According to Europol, operations led by the FBI, the DEA and the Dutch National Police, with Europol's support, resulted on 20 July 2017 in the takedown of the AlphaBay and Hansa dark web markets.

Source: Europol

Silk Road website seized and alleged operator arrested

According to the U.S. Attorney's Office for the Southern District of New York, the alleged owner and operator of Silk Road was arrested in San Francisco on October 1, 2013, and federal agents seized the Silk Road website under a civil forfeiture action filed on September 30, 2013. The release, dated October 25, 2013, also announces the seizure of further bitcoins, bringing the total to about 173,991.

Source: U.S. Attorney's Office, Southern District of New York (U.S. Department of Justice)