Europe’s policing organisation this week warned encryption, proxies, and AI are expanding cybercrime, underscoring the accelerating pace and sophistication of cyber threats, emphasising the need for enhanced law enforcement capabilities and international cooperation.

Europol’s warning came in the new edition of the Internet Organised Crime Threat Assessment (IOCTA) 2026.

Edvardas Šileris, head of the European Cybercrime Centre at Europol said: “The IOCTA 2026 provides an up-to-date roadmap for law enforcement agencies and stakeholders to understand and respond to the evolving threats posed by cybercrime. As criminals continue to exploit technological advancements, it is crucial that we enhance our capabilities and collaborate more effectively to protect our citizens and critical infrastructure.”

Europol said the IOCTA 2026 underscores the dynamic and interconnected nature of cybercrime, highlighting how criminals continue to exploit technological advancements to perpetrate a wide range of illicit activities.

The report revealed that the dark web remains a critical enabler for cybercriminals, with marketplaces and forums demonstrating remarkable resilience despite ongoing law enforcement efforts. The fragmentation and specialisation of these platforms pose significant challenges for investigators, as criminals rapidly adapt and migrate to new, often more secure, environments. End-to-end encrypted (E2EE) platforms and anonymised services now connect the realms of surface and dark web communication channels, increasingly blurring their distinction.

One of the report’s key findings was the increasing use of cryptocurrencies in facilitating cybercrime. Privacy coins and offshore exchange services have become integral to the laundering of ransomware payments, making it increasingly difficult for law enforcement agencies to trace illicit transactions. The report also notes the growing popularity of cryptocurrencies among minors and young adults, who may unknowingly engage in money laundering activities.

The report explored the advanced strategies used by cybercriminals to defraud citizens throughout the EU, notably the integration of automation and artificial intelligence (AI) to boost the efficiency and scope of their activities. Generative AI tools are increasingly employed to tailor social engineering tactics, accelerating and concealing online fraud schemes. Additionally, caller ID spoofing, a method that masks the caller’s identity, and so-called SIM farms, which can distribute thousands of SMS messages, calls, and social media posts, are significant facilitators of large-scale fraud.

In the realm of cyber-attacks, the report highlighted the persistent threat of ransomware, with a significant number of active ransomware brands observed throughout 2025. The report added the increasing interweaving of state-sponsored hybrid threats with criminal actors, who may serve as proxies for destabilisation purposes. The emergence of new hacking coalitions poses a significant threat to public institutions, big tech companies and people’s private data.

It is a hefty and far-reaching document but the message is clear the threat from cyber criminals, and increasingly state-backed actors is rising rapidly and the global business community needs to recognise and react to the risks they now face.

Jon Guy, Editor,

Emerging Risks