Home > Anti-Piracy >
A seven-month Europol operation, coordinated by Bulgaria with support form Europol, has dismantled nine criminal networks running pirate streaming services. The operation, dubbed KRATOS 2, resulted in 29 arrests and the removal of more than 27,000 URLs. While the press release includes many data points, the announcement does not mention the name of a single targeted platform that was taken offline.
The Internet is full of cheap IPTV services that offer access to premium sports, films, and television content for a fraction of what legal services charge.
This has turned into a multi-million dollar business for several similar networks, which are typically more professional and organized than the ‘hobby’ pirate projects that emerged two decades ago.
The professionality of these services is matched by the severeness of the law enforcement response. The modern-day piracy networks, which are not easily threatened by a cease and desist notice, are now often targeted in international law enforcement operations. This includes KRATOS 2.
The KRATOS 2 operation was coordinated by Bulgaria’s General Directorate for Combating Organised Crime (GDBOP), with operational support from Europol.
This wasn’t an isolated crackdown, but a months-long operation that ran from September 2025 to April 2026, Besides Bulgaria, it also involved Belgium, Croatia, France, Greece, Ireland, Italy, the Netherlands, Poland, Romania, Spain, the United Kingdom, and the United States.
The results, based on their sheer numbers, appear to be substantial. Press releases report that nine criminal organizations were dismantled, 29 people arrested, while another 86 suspects identified. In total, investigators carried out 148 house searches.
With 72 ongoing criminal investigations and 59 cases referred to judicial authorities, there may be further fallout in the future. However, while these numbers are significant, there is no concrete mention of any targets.
In the past, we have regularly reported on concrete actions, where domain names were seized, such as the Streameast and Fmovies crackdowns. However, the press release issued by Europol and others is more carefully worded.
There is no mention of domains that were seized or taken down. Instead, it mentions “169 reported domains”. Similarly, it mentioned that 27,332 URLs were removed, without disclosing where these URLs were removed from, and if these belonged to one or more domains.
The list of operational statistics adds that 722,961 infringing objects were identified since September last year. While that sounds impressive, we recently reported that Google removes nearly 10 million URLs from its index every day, following requests from the takedown outfit Link-Busters.
Private sector partners including ACE/MPA, LaLiga, UEFA, Friend MTS, beIN, and Irdeto, helped identify an additional 4,370 piracy-linked domains, 18,331 associated IP addresses, and 397,384 URLs that were flagged for suspension.
Again, these numbers are significant, but relatively modest compared to traditional DMCA removal campaigns.
Interestingly, the press release does not mention any names either. There are no platforms mentioned, no operator names identified, and no seized domain names cited. This stands in sharp contrast to the exact figured that are reported on the broader operation.
It is possible that the authorities don’t want to interfere with ongoing investigations, but some more context on the targets and what was actually achieved in terms of deterrence, would be helpful.
With the information at hand, it is essentially impossible for journalists to independently verify the operation’s impact. Whether the 27,332 “removed” URLs represent meaningful anti-piracy disruption, or whether these links were immediately replaced is unknown.
Many news outlets repeat the headline figures, without giving any context or asking any questions. While that may be what’s intended by the authorities, it’s not particularly helpful from a news providing perspective.
The KRATOS 2 operation follows the original operation, conducted during the summer of 2024. That action targeted a piracy network that catered to 22 million users. It resulted in 11 arrests, the seizure of 29 servers and 270 IPTV devices, and the takedown of 100 domains.
TorrentFreak covered that operation under its Italian name, Operation Takendown. No piracy platform name was disclosed in that case either but Bulgaria also had a leading role there.
Most Bulgarian coverage on KRATOS 2 cited the name figures and details that were covered by the Europol press release. However, they also add a specific note that went unmentioned by the official communication channels.
A few weeks ago, the United States Representative (USTR) removed Bulgaria from its Special 301 Piracy Watch List due to “significant enforcement actions” and “criminal prosecutions.” This included a torrent tracker crackdown, but the KRATOS operations likely played a key role as well.
According to Europol, KRATOS 2 as part of an ongoing enforcement campaign so it’s possible that a third phase will follow. Whether that will include names in addition to numbers, has yet to be seen.
Source: Torrent Freak