International law enforcement shuts down cybercriminal communications platform Ghost

Digital mobile communications: Thousands of criminals used the same “social network”, Ghost, to conduct illegal activities worldwide. The platform offered multiple encryption options, but despite these security measures, Europol and other agencies successfully broke through and arrested the administrator.

A broad coalition of law enforcement agencies has taken down Ghost, a platform that offered sophisticated, encrypted communications for criminals. Run by a single administrator, a 32-year-old man arrested in Australia, the platform allowed users to exchange messages and even murder requests from around the world.

Europol worked with agencies from nine different countries to remove Ghost. The platform supported three different encryption standards and users could reportedly delete all previously exchanged messages by sending a single, specific code.

Australian Federal Police Assistant Commissioner David McLean said Ghost was widely used by notorious criminal organisations including Italian mafia syndicates, outlaw motorcycle gangs, Middle Eastern groups and Korean gangs. These groups relied on the app to coordinate drug trafficking, order killings and more.

The joint investigation began in 2022, Europol revealed, and ended with 51 arrests in multiple countries. In addition to the Ghost administrator, 38 people were arrested in Australia, 11 in Ireland, one in Canada and one in Italy. The Italian suspect is believed to have ties to Sacra Corona Unita, a powerful mafia-style criminal organization based in the Apulia (Puglia) region of southern Italy.

Researchers were able to decrypt Ghost’s operations, allowing them to read users’ messages. Europol officials said that up to 50 lives could potentially be saved after decrypting the messages, preventing further injuries or killings. However, no specific details have been provided on how law enforcement cracked the platform’s encryption.

“Encrypted telephone communications pose a challenge to modern policing, but we are now making significant progress,” said Justin Kelly, Assistant Commissioner of the Irish Garda Síochána.

According to Europol Deputy Director Jean-Philippe Lecouffe, Ghost had a smaller user base compared to other known criminal communication platforms. Organized crime syndicates are increasingly turning to multiple encrypted platforms, fragmenting the market into multiple smaller networks.

Lecouffe was referring to the major operation against EncroChat in 2020, which led to over 6,500 arrests worldwide and the seizure of €900,000 in cash. After EncroChat was taken down, SkyECC emerged as a replacement, before it too was “unlocked” in 2021, resulting in further large-scale raids and arrests.