In November 2023, Swedish authorities seized two mobile phones from a suspected drug trafficker in a small town in Sweden. At first glance, the case appeared routine—another local narcotics investigation involving a mid-level criminal figure.
But when forensic specialists began examining the data inside the devices, investigators realized they had stumbled upon something far larger.
Encrypted communications, foreign contacts and logistical records pointed beyond Sweden’s borders. What initially seemed like a localized criminal operation revealed connections to individuals and businesses across Europe, Asia and Australia.
Women in Cyber Policing: Nominations Open for Excellence Awards 2026
The emerging picture, later formalized under an international investigation known as Operation Candy, showed that the trafficker was only a small part of a far more complex ecosystem.
Instead of a single organised crime group, investigators uncovered multiple interconnected networks involved in large-scale drug trafficking and money laundering. These groups were linked through facilitators, logistics operators and a network of corporate entities designed to obscure financial flows and ownership structures.
Many of the central figures behind the system had previously been unknown to law enforcement.
Only after investigators unlocked the digital data contained in the seized phones did the structure of the network begin to emerge.
A Network Spanning Europe, Asia and Australia
The forensic analysis of the phones opened a trail that led investigators across several continents.
Authorities discovered that members of the network were running an online drug distribution operation from Thailand that supplied customers across the Nordic region. At the same time, individuals in Sweden managed domestic drug distribution while coordinating parallel money-laundering structures designed to recycle criminal profits.
Other nodes in the network appeared elsewhere.
In Germany, customs officials intercepted 1.2 tonnes of illicit drugs destined for Australia. The shipment, concealed inside containers listed as materials used in road construction, had been arranged through the same criminal ecosystem uncovered in Sweden.
Instead of immediately halting the shipment, investigators removed the drugs and allowed the containers to continue their journey as part of a controlled operation.
When the containers reached Melbourne in April 2025, authorities replaced the narcotics with inert material and allowed the delivery to proceed under surveillance. The shipment eventually reached a warehouse in Victoria’s central highlands before being transported to a factory in the Melbourne suburb of Sunshine.
Two men, aged 32 and 52, were arrested in connection with the attempted importation and now face charges in Australia.
Elsewhere in the network, investigators identified a high-value target in Spain believed to be facilitating large-scale narcotics trafficking operations.
Taken together, the findings revealed a decentralised criminal system—one capable of trafficking drugs, laundering profits and coordinating logistics across multiple jurisdictions while remaining largely invisible to authorities.
Simultaneous Raids Across Multiple Countries
After more than two years of investigative work, authorities moved to dismantle key parts of the network.
On March 4, law enforcement agencies carried out coordinated operations across several countries. Roughly 20 house searches were conducted in Spain, Sweden and Thailand, targeting individuals believed to be central to the criminal system.
The actions were coordinated through command posts across Europe, including a central operational hub at Europol, where investigators from multiple countries worked side by side.
The raids resulted in 13 arrests across Spain, Sweden and Thailand—four in Spain, six in Sweden and three in Thailand. Combined with earlier arrests in Australia, the operation has led to a total of 15 people being taken into custody.
Authorities also seized criminal assets worth approximately €4 million, with investigators continuing to trace additional financial holdings linked to the network.
The arrests were the culmination of cooperation among law enforcement agencies from Sweden, Germany, Spain, Thailand and Australia, alongside the support of Europol and Eurojust.
Mats Berggren, acting deputy head of operations for the Swedish Police Authority, described the investigation as evidence of the changing nature of organised crime.
“The borderless nature of organised crime is a challenge,” Berggren said. “But this operation shows that criminals cannot hide behind country borders or digital borders when law enforcement works together.”
Crime Networks Embedded in the Legal Economy
The investigation also highlighted a broader transformation in how organised crime operates.
Rather than functioning as rigid hierarchical groups, many modern criminal networks operate as flexible alliances linked by logistics providers, financial intermediaries and digital communication channels.
In Operation Candy, investigators found that the networks relied heavily on legitimate-looking corporate structures spread across multiple jurisdictions. Companies were used to manage shipping logistics, disguise ownership arrangements and move illicit profits through complex financial channels.
These structures allowed leadership figures to remain several layers removed from the operational aspects of the crimes.
According to Europol’s latest assessment of the European Union’s most threatening criminal networks, 86 percent of such groups misuse legitimate business structures to conceal criminal activity and launder profits.
Industries such as logistics, construction and real estate are particularly vulnerable to infiltration.
Andy Kraag, head of Europol’s European Serious and Organised Crime Centre, said the case illustrates the evolving architecture of global organised crime.
“What started as two phones seized in a small Swedish town turned out to be a global criminal enterprise,” Kraag said. “These networks move tonnes of drugs across continents, hide profits behind layers of companies and coordinate through encrypted communications.”
For investigators, the operation also underscored the increasing role of digital evidence in modern criminal cases. Data extracted from smartphones, encrypted messaging platforms and online marketplaces is now often the key to understanding the structure of networks that operate simultaneously in the physical and digital worlds.
As Operation Candy demonstrated, what begins as a small local investigation can, through digital traces, expose a system that spans continents.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
