Group

Group-IB, a leading creator of predictive cybersecurity technologies to investigate, prevent, and fight digital crime, contributed intelligence support to Operation CyberProtect III (19–22 May 2026), a joint law enforcement operation co-organized by INTERPOL and the Organization for Security and Co-operation in Europe (OSCE) targeting the growing exploitation of subscription-based content platforms to facilitate human trafficking and sexual exploitation.

Bringing together 14 law enforcement officers from Germany, Netherlands, Romania, Spain, Sweden, Ukraine, and the United Kingdom, the operation’s hackathon format — a focused collaborative event using digital tools to address a specific policing challenge — generated 34 suspicious cases, 18 suspect profiles, and 27 potential victims. To support the operation, Group-IB deployed its Threat Intelligence Graph — an interactive visualization tool within its Unified Risk Platform that maps complex, disparate data into a clear investigative storyline, connecting threat actors, network infrastructure, and indicators of compromise in real time — alongside analyst expertise to conduct database checks and discovery intelligence analysis. This work surfaced relevant accounts and activity linked to potential exploitation networks, with the team identifying additional potential threat actor infrastructure.

Organized crime networks are increasingly weaponizing content subscription services — platforms commonly associated with sexually explicit material — to recruit and sexually exploit women, minors, and vulnerable adults. Victims are lured with promises of income before being coerced into exploitative content production. A modus operandi highlighted in an INTERPOL Purple Notice published in February 2026 describes criminal groups masquerading as legitimate modelling agencies: once a victim is engaged, the group seizes control of their account, retains the majority of earnings, and applies escalating psychological pressure and coercion to compel increasingly explicit content production.

Operation CyberProtect III exposed a range of emerging tactics and trends driving online sexual exploitation. Key findings included:

“Criminal networks that weaponize digital platforms to traffic and coerce vulnerable people are among the most damaging actors in today’s threat landscape. Group-IB’s contribution to Operation CyberProtect III reflects our adversary-centric approach — mapping the infrastructure, recruitment channels, and financial flows these networks depend on to deliver intelligence that investigators can act on immediately. Our collaboration with INTERPOL is central to how Group-IB operates: we believe that predictive, intelligence-driven cooperation between the private sector and law enforcement is the most effective way to dismantle the criminal ecosystems behind these crimes, and to protect the people they target.”

Operation CyberProtect III was co-organized by INTERPOL and OSCE, and supported by Cybercrime Atlas, Diaconiía, the Dutch National Rapporteur on Trafficking in Human Beings and Sexual Violence against Children, Europol, Group-IB, META, S2W, STOP THE TRAFFIK, and TikTok. Participating countries included Germany, Netherlands, Romania, Spain, Sweden, Ukraine, and the United Kingdom.