CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Crimenetwork relaunch takedown

incident · incident:bka-crimenetwork-takedown-2026

BKA and ZIT dismantle the relaunched Crimenetwork darknet marketplace; the German operator was arrested in Mallorca on a European Arrest Warrant (2026-05-08).

Coverage
1
first 2026-05-12 → last 2026-10-21
Latest activity
2026-05-12
German police shut down the relaunched Crimenetwork marketplace; suspected operator arrested in Mallorca
Peak priority
routine
1 routine
Targets
legal-services
sectors: legal-services, public-sector · regions: dach, europe
Sources cited
2
2 hosts

Defender insights

What each entry about Crimenetwork relaunch takedown tells a defender to do, newest first.

Story timeline

  1. 2026-05-12BKA and ZIT shut down the relaunched Crimenetwork darknet marketplace; suspected German operator arrested in Mallorca on a European Arrest Warrant
    active-threatsGerman police shut down the relaunched Crimenetwork marketplace; suspected operator arrested in Mallorca
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceSearch Closed Sources: Purchase Technical Data

Reconnaissance TA0043

T1597.002Search Closed Sources: Purchase Technical Data×1

Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

Evidence: 2026-05-12/bka-and-zit-dismantle-relaunched-crimenetwork-darknet-market · ATT&CK page ↗

Entries about Crimenetwork relaunch takedown (1)

2026-05-12 · view entry permalink →

ROUTINEupdatedNATOA2

BKA and ZIT shut down the relaunched Crimenetwork darknet marketplace; suspected German operator arrested in Mallorca on a European Arrest Warrant

A special unit of the Spanish National Police arrested the suspected 35-year-old German operator of the relaunched Crimenetwork marketplace at his residence in Mallorca under a European Arrest Warrant, in an operation with Germany's Federal Criminal Police Office (BKA) and the Frankfurt am Main Public Prosecutor's Office's Central Office for Combating Internet Crime (ZIT); he is accused under Section 127 of the German Criminal Code of operating criminal trading platforms, and of narcotics trafficking (Help Net Security, 2026-05-11). Authorities say he built new infrastructure for Crimenetwork a few days after the previous version was shut down and its administrator arrested in December 2024; the BKA calls the marketplace one of the central marketplaces of the German-speaking underground economy for many years (Help Net Security, 2026-05-11). The relaunched platform offered stolen data, drugs, forged documents and other illegal services to more than 22,000 users and over 100 vendors, took payment in Bitcoin, Litecoin and Monero and earned an estimated more than €3.6 million in commissions and vendor fees; about €194,000 in assets were preliminarily seized (Help Net Security, 2026-05-11).

A special unit of the Spanish National Police arrested the suspected 35-year-old German operator at his residence in Mallorca under a European Arrest Warrant.

Authorities state the suspect allegedly created and operated a new technical infrastructure for Crimenetwork a few days after the previous version was shut down and its administrator was arrested in December 2024.

User and transaction data obtained during the operation are expected to support further investigations into the platform’s users and operators, who are believed to be mainly located in German-speaking countries.

Help Net Security 2026-05-11
Improvementrun 2026-10-21T1148Z-auditbodyclassificationconfidenceentitiesevent_dateevidenceheadlineprioritysourcessourcing_notesummarytitletechniques

The arrest in Mallorca was made by a special unit of the Spanish National Police in the operation with the BKA and ZIT, and the BKA describes Crimenetwork as one of the central marketplaces of the German-speaking underground economy, relaunched a few days after its December 2024 takedown (Help Net Security, 2026-05-11). The seized user and transaction data are expected to support further investigations into the platform's users and operators, believed to be mainly in German-speaking countries (Help Net Security, 2026-05-11).

incident12 May 05:00Zmulti-sourceOpen finding →

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • bka.de1 (50%)
  • helpnetsecurity.com1 (50%)