Europol has published the 2026 edition of the Internet Organised Crime Threat Assessment (IOCTA), one of the key reports on the evolution of cybercrime in Europe. The document, titled «How encryption, proxies, and AI are expanding cybercrime», analyses how emerging technologies—especially artificial intelligence, end-to-end encryption, and cryptocurrencies—are transforming the landscape of digital threats.

The report highlights that cybercrime is becoming increasingly sophisticated, decentralised, and professionalised. According to Europol, criminal groups swiftly exploit any technological advancement to enhance their operations, hinder investigations, and expand the scope of their attacks. This situation compels law enforcement agencies and public and private organisations to strengthen their technical capabilities and international cooperation.
One of the highlights of the IOCTA 2026 is the role of the dark web as an essential infrastructure of cybercrime. Despite police operations in recent years, illegal markets and criminal forums continue to show a great capacity for recovery. When a platform is dismantled, more fragmented, specialised, and secure alternatives quickly emerge. Moreover, the combination of anonymised services and platforms with end-to-end encryption is blurring the line between the surface web and the dark web, further complicating investigative tasks.
Cryptocurrencies remain a key element in the digital criminal ecosystem. The report particularly highlights the growing use of so-called «privacy coins» and offshore exchange services to launder money derived from ransomware and other illicit activities. These tools greatly hinder the traceability of transactions and pose a significant challenge for the authorities. Europol also warns about the increase in the indirect involvement of minors and young adults in money laundering activities related to cryptocurrencies, often without being fully aware of the legal implications.
Artificial intelligence emerges as one of the main accelerators of online fraud. Cybercriminals use generative AI tools to create more convincing messages, personalise social engineering techniques, and automate large-scale fraudulent campaigns. These technologies allow for the production of e-mails, SMS messages, or fake content with a very high level of realism. This is supplemented by techniques such as caller ID spoofing, which allows for the falsification of the identity of phone calls, and SIM farms, capable of sending thousands of messages and simultaneous communications.
Regarding cyberattacks, ransomware remains one of the main threats. The IOCTA 2026 highlights that, during 2025, numerous variants and active groups were detected, many of which have evolved into double extortion models: they not only encrypt the victims’ information but also threaten to publish the stolen data if the ransom is not paid. This strategy increases the pressure on businesses and public institutions and makes data protection a critical security factor.
The report also warns about the growing connection between criminal actors and state-sponsored hybrid threats. Some cybercrime groups act as intermediaries or proxies in political destabilisation or espionage operations. This convergence between organised crime and geopolitical interests represents a new risk scenario for critical infrastructure, public administrations, and large technology companies.
Another of the most concerning points is the increase in onlinechild sexual exploitation. Europol reports an increase in cases of sexual extortion, as well as the commercialisation of child sexual abuse material for economic purposes. There is also concern about the growth of synthetic content generated with artificial intelligence, which creates new technical and legal challenges for identifying victims and pursuing those responsible. Encrypted messaging platforms have become a common space for this type of criminal activity.
In this context, the report particularly mentions The Com, a network of online criminal communities linked to extremely violent activities. According to Europol, these environments combine online child sexual exploitation, extortion, cyberattacks, and other forms of serious violence, creating highly dangerous and difficult-to-infiltrate criminal ecosystems.
Finally, the IOCTA 2026 emphasises the need for a coordinated response among governments, law enforcement, technology companies, and international organisations. Europol insists that the fight against cybercrime will require greater technical capabilities, regulation adapted to new digital challenges, and much closer global cooperation. The report thus consolidates itself as an essential strategic guide for understanding how digital threats are evolving and how to prepare for an increasingly complex and hostile environment.
_____
Aquest apunt en català / Esta entrada en español / Post en français








