Europol Shuts Down ‘Ghost’ Encrypted Messaging Platform Used for Crime

• A global coalition took down a new criminal communication platform called ‘Ghost.’
• The highly secure messaging service was used by cybercriminals for various illegal activities.
• The operation resulted in more than 50 arrests, and weapons, drugs, and cash were seized.

The encrypted communication platform Ghost, promoted as a highly secure messaging solution, was exploited by criminal networks to facilitate a wide range of illicit activities, including drug trafficking and money laundering. Europol, in partnership with Eurojust and multiple international law enforcement agencies, successfully dismantled it.

The global takedown was a collaborative effort involving nine countries, including Australia, Canada, France, Ireland, Italy, the Netherlands, Sweden, and the United States.

With servers located in France and Iceland, and financial assets discovered in the U.S., the operation was complex and required precise coordination. Over 50 arrests were made, with significant seizures of weapons, drugs, and over EUR 1 million in cash.

Ghost's appeal to criminal enterprises stemmed from its advanced encryption capabilities that allowed users to communicate without revealing personal information, offering three encryption standards.

The solution provided the option to send a message followed by a specific code, which would result in the self-destruction of all messages on the victim’s phone.

The platform's self-destructing messages feature made it attractive for clandestine operations across borders. Despite its sophistication, the joint task force penetrated its infrastructure, identifying key suppliers and users.

Several thousand people worldwide used the tool, which has its own infrastructure and applications and a network of resellers based in several countries. On a global scale, around 1,000 messages were exchanged each day via Ghost.

The landscape remains dynamic as criminal actors shift to less established or custom-built platforms to maintain their anonymity, and this fragmentation complicates efforts to monitor and intercept illicit communications.

Authorities that took part in the investigation are the Federal Bureau of Investigation (FBI), and the Australian Federal Police, as well as law enforcement from Canada, France, Iceland, Ireland, Italy, The Netherlands, and Sweden.