Full Report
French and Dutch law enforcement led an international operation to disrupt MATRIX, a private chat platform linked to drug trafficking, arms trafficking, money laundering and other serious crimes.
Analysis Summary
# Incident Report: Takedown of Encrypted Criminal Messaging Service MATRIX
## Executive Summary
International law enforcement, led by French and Dutch authorities, successfully dismantled a sophisticated, encrypted messaging service named MATRIX used extensively by organized criminals for activities like drug and arms trafficking, and money laundering. The service, which boasted nearly 8,000 users and layered security, was uncovered following the investigation into the 2021 murder of journalist Peter R. de Vries. The operation resulted in the seizure of infrastructure, the arrest of three suspects, and the decryption of over 2.3 million messages, exposing criminal communications.
## Incident Details
- Discovery Date: Sometime before the announcement, initially discovered via a convicted criminal's phone related to the 2021 Peter R. de Vries murder.
- Incident Date: The final international operation culminating in the takedown occurred on a "Tuesday" preceding the announcement.
- Affected Organization: Encrypted messaging service MATRIX (not to be confused with matrix.org).
- Sector: Criminal Infrastructure/Cybercrime Support Services.
- Geography: Infrastructure dispersed across several countries, with the majority of servers in Germany and France. Arrests made in Spain, France, and the Netherlands.
## Timeline of Events
### Initial Access
- Date/Time: Not specified when the initial intelligence gathering began, but the service was discovered via a criminal's phone post-2021 murder conviction.
- Vector: Investigation into criminal activity (specifically the Peter R. de Vries murder case) provided the initial lead.
- Details: The platform was highly technical, featuring its own operating system, apps for secure communication, and anonymous web browsing, primarily installed on Google Pixel phones.
### Lateral Movement
- Not applicable, as this was a service takedown rather than an intrusion into a victim organization. Law enforcement activities involved mapping and dismantling the external MATRIX infrastructure.
### Data Exfiltration/Impact
- Details: Over three months of focused investigation allowed police to intercept and decrypt more than 2.3 million messages sent by suspected criminals across 33 languages.
- Impact: Disruption of criminal communications related to drug trafficking, arms trafficking, and money laundering.
### Detection & Response
- Detection: The service was initially discovered through evidence seized from a convicted criminal.
- Response actions taken: Coordinated international operation involving French and Dutch law enforcement, leading to the dismantling of over 40 servers, the arrest of three key suspects (including the suspected owner/operator), and the seizure of significant assets and communication devices. A splash page was deployed on the seized website to notify users.
## Attack Methodology
*Note: In this context, "Attack Methodology" describes the architecture used by criminals (MATRIX) to conduct their illicit activities.*
- Initial Access (to MATRIX service): Invitation only, relied on users trusting the security claims.
- Persistence: Unknown on the user side, but the service infrastructure was robust, spread across multiple countries.
- Privilege Escalation: Not applicable to end-users, but the platform provided anonymity layers.
- Defense Evasion: Utilized a dedicated, complex operating system, encrypted communications (superior to previous platforms like Sky ECC/EncroChat), and its own currency for subscriptions.
- Credential Access: Not applicable; access was subscription-based.
- Discovery: Law enforcement performed detailed analysis and decryption efforts over three months.
- Lateral Movement: Not applicable to the service itself.
- Collection: Interception and deciphering of messages happening in real-time or near real-time during the investigation phase.
- Exfiltration: Law enforcement selectively extracted and analyzed the 2.3 million intercepted messages.
- Impact: Facilitation of serious transnational organized crime activities.
## Impact Assessment
- Financial: Suspects possessed €145,000 in cash and approximately €500,000 in cryptocurrencies, which were seized.
- Data Breach: Over 2.3 million messages from nearly 8,000 users were intercepted and deciphered.
- Operational: Significant disruption to organized criminal networks dealing in drugs, arms, and money laundering.
- Reputational: A splash page now informs users that their communications were read.
## Indicators of Compromise
*Note: The report does not list specific technical IoCs related to malware or intrusion, but rather the digital footprint of the criminal service.*
- Network indicators: Infrastructure comprising over 40 servers located primarily in Germany and France (defanged: blocked or geographically restricted during takedown).
- File indicators: Confiscation of over 970 mobile phones.
- Behavioral indicators: Use of an invitation-only, highly complex encrypted service (MATRIX) featuring its own OS and browser for secure communications.
## Response Actions
- Containment measures: International law enforcement operation to simultaneously dismantle servers located across several countries.
- Eradication steps: Seizure of the core infrastructure (over 40 servers).
- Recovery actions: Arrest of three active suspects, including the suspected owner/operator, preventing the immediate resumption of the service.
## Lessons Learned
- Criminals are constantly evolving and increasing the complexity of their communication tools (e.g., MATRIX is noted as more complex than Sky ECC or EncroChat).
- The landscape shifts towards smaller, more numerous service providers following major takedowns (like Sky ECC and EncroChat).
- Investigative techniques can successfully penetrate even highly sophisticated, purpose-built encrypted platforms.
## Recommendations
- Continue sharing intelligence across international borders (Europol/EU member states) to efficiently track and dismantle decentralized, multi-national criminal infrastructure.
- Prioritize long-term, deep-dive technical analysis necessary to break new layers of encryption and proprietary operating systems used by criminal communication platforms.
- Maintain vigilance regarding new, smaller encrypted platforms that spring up to replace dismantled services.