FBI's Trojan Shield Sting Nets Global Arrests

The FBI and international partners ran a covert encrypted-device platform for years to intercept criminal communications, leading to hundreds of arrests worldwide.

Operation Trojan Shield (known as Operation Ironside by Australian authorities) was a multi-year covert law enforcement operation in which the FBI, the Australian Federal Police, Europol, and partners in over a dozen countries distributed more than 12,000 purpose-built encrypted devices to criminal organizations worldwide. Unlike prior takedowns of encrypted communications providers such as Phantom Secure, Sky Global, and EncroChat, this operation involved the FBI covertly operating the platform itself, allowing investigators to receive a copy of every message sent by users for analysis.

The operation resulted in hundreds of arrests across Australia and Europe, the seizure of narcotics and criminal proceeds, and disruption of transnational organized crime networks involved in drug trafficking and violence. While not a traditional cyber-espionage or malware campaign, the story is notable from a threat-intelligence perspective as it illustrates law enforcement's evolving use of technical deception—running an entire encrypted communications platform as a honeypot—to defeat criminal reliance on hardened, encrypted devices.

This is fundamentally a law enforcement success story rather than a disclosure of an active cyber threat; there are no malware families, exploited vulnerabilities, or ongoing attacker TTPs relevant to network defenders. The primary significance is the erosion of trust in encrypted device ecosystems used by organized crime, and the signal that similar law enforcement operations may target other encrypted platforms in the future.

Source reporting: https://www.fbi.gov/news/stories/fbi-global-partners-announce-results-of-operation-trojan-shield-060821