12 Cybercriminals Arrested Following Takedown of Ghost Communication Platform

Irish and Spanish law enforcement authorities have successfully apprehended 12 members of a high-risk criminal network in a coordinated operation spanning both countries. 

The arrests, announced on March 26, 2025, included six suspects in Ireland and six in Spain, all allegedly involved in large-scale drug trafficking operations. 

The criminals were identified through digital evidence obtained during last year’s international takedown of the Ghost encrypted communication platform, which served as a crucial tool for organized crime groups worldwide.

Sophisticated Communication Network Exposed

The criminal network relied on Ghost’s advanced encryption protocols to coordinate drug shipments between Spain and Ireland. 

Europol, which provided operational support since November 2023, reported that investigators were able to trace several Ghost user handles back to members of the criminal organization following the platform’s dismantling in September 2024. 

Despite the criminals’ attempts to evade detection by fragmenting their communications across multiple platforms, law enforcement officials successfully linked their activities to specific Ghost accounts.

“The sophistication of their communications was in stark contrast to the simplicity of their modus operandi,” stated Europol in their official release.

Stop attacks before they start, powered by a 97% precise neural Network to Detect Cyber Attacks

“It consisted of smuggling cocaine and marijuana across the continent in vehicles equipped with custom-made secret compartments and cloned number plates.”

Ghost represented one of the most secure encrypted platforms available to criminal organizations.

Developed around 2015, the service provided users with modified smartphones featuring three distinct layers of encryption and specialized security protocols. For approximately $2,350, users received a custom device with a six-month subscription to Ghost’s encrypted network along with technical support.

The platform’s sophisticated security features included a message self-destruction system that could erase communications from both sender and recipient devices when triggered by a specific code sequence. 

This functionality made evidence collection particularly challenging for law enforcement agencies until they successfully infiltrated the network.

International Takedown Operation

The Ghost platform was dismantled in September 2024 as part of a major international operation coordinated by Europol and involving law enforcement agencies from Australia, Canada, France, Iceland, Ireland, Italy, the Netherlands, Sweden, and the United States. 

The operation led to the arrest of Ghost’s alleged administrator, 32-year-old Jay Je Yoon Jung and 51 other individuals across multiple countries.

“Today, we have demonstrated that no matter how secure criminal networks believe themselves to be, they cannot evade our collective efforts,” Europol’s Executive Director Catherine De Bolle stated during the initial takedown announcement.

Europol deployed two experts with mobile offices to Spain and Ireland to provide immediate support in analyzing and securing evidence. 

This case highlights how digital evidence from dismantled criminal communication platforms continues to yield results months after initial operations. 

Law enforcement officials expect additional arrests as investigations into Ghost users continue across multiple jurisdictions.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free