[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTOmMiZDIzOLI5-92QLBRXV8Ed4N-q7NoXnwSbi8H5z4":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b1b70181-e443-4f69-a89e-841890bee281","354 dark web vendors and buyers arrested in Operation TorNado","354-dark-web-vendors-and-buyers-arrested-in-operation-tornado-6ec35e","Europol and police in 14 countries arrested 354 dark web vendors and buyers in Operation TorNado, which ran from May 2025 to October 2026. Investigators went after people who had traded on five marketplaces that were already offline: Archetyp, Bohemia, Nemesis, Kingdom and Tor2Door. Seized money (Source: Europol) The people who used those markets were still exposed after the sites went dark. Police also went after vendors and buyers on forums, single-vendor shops and encrypted … More → The post 354 dark web vendors and buyers arrested in Operation TorNado appeared first on Help Net Security.","Europol and law enforcement agencies from 14 countries arrested 354 individuals involved in dark web marketplaces during Operation TorNado, which ran from May 2025 to October 2026. The operation targeted vendors and buyers on five previously shut-down marketplaces (Archetyp, Bohemia, Nemesis, Kingdom, Tor2Door), as well as on forums, single-vendor shops, and encrypted messaging services. The United States led the arrests with 132, followed by the UK with 59, Hungary with 45, and Germany with 41. Significant seizures of drugs, firearms, cash, and cryptocurrency were made in both the US and Europe.","354 dark web vendors and buyers arrested in 14 countries during Operation TorNado.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Feuropol-dark-web-arrests-cybercrime\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F13120323\u002Foperation-tornado.webp","2026-11-13T11:06:29+00:00","2026-11-13T12:00:33.043634+00:00",7,[17,20,23,26,28,30],{"name":18,"type":19},"Operation TorNado","campaign",{"name":21,"type":22},"Europol","vendor",{"name":24,"type":25},"Archetyp","product",{"name":27,"type":25},"Bohemia",{"name":29,"type":25},"Nemesis",{"name":31,"type":25},"Kingdom","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},[],[21,24,27],{"controls":43,"vendors":44},[],[],{"slug":46,"title":47,"body":48,"framework_refs":49,"framework_notes":54},"operation-tornado-354-dark-web-criminals-arrested-through-persistent-law-enforcement-intelligence-ga","Operation TorNado: 354 Dark Web Criminals Arrested Through Persistent Law Enforcement Intelligence Gathering","Operation TorNado demonstrates that even after dark web marketplaces are shut down, law enforcement can continue to identify and arrest participants by leveraging digital evidence, cryptocurrency tracing, and cross-border intelligence sharing. The operation spanned over a year and targeted not just active platforms but also users of previously dismantled ones, showing that anonymity on the dark web is not guaranteed. For organizations, this case reinforces that illicit activity leaves persistent digital footprints — including transaction records, metadata, and communications — that can be reconstructed long after the fact. It also highlights the growing effectiveness of international law enforcement cooperation in combating cybercrime and the importance of monitoring for insider threats or employees who may be engaging in dark web activity.",[50,51,52,53],"NIST CSF 2.0 DE.CM: Continuous Monitoring","CIS Control 17: Incident Response Management (v8)","NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":55,"NIST CSF 2.0 DE.CM: Continuous Monitoring":56,"CIS Control 17: Incident Response Management (v8)":57,"NIST SP 800-53 SI-5: Security Alerts, Advisories, and Directives":58},"NIS2 requires robust incident handling procedures, including cooperation with authorities, which mirrors the cross-border law enforcement coordination that made Operation TorNado successful.","Continuous monitoring of external threat environments, including dark web sources, would help organizations detect if their data or credentials are being traded on illicit marketplaces before damage escalates.","A mature incident response capability — including coordination with law enforcement — is what enabled the multi-year, multi-country investigation to successfully attribute and arrest hundreds of dark web participants.","Subscribing to and acting on threat intelligence about active dark web marketplaces would have enabled earlier detection of organizational data or credentials being traded illicitly."]