Today, the Attorney General and the Department of Justice’s Joint Criminal Opioid and Darknet Enforcement (JCODE) team, and international law enforcement partners announced the results of Operation RapTor, including the arrests of 270 dark web vendors, buyers, and administrators in Austria, Brazil, France, Germany, the Netherlands, South Korea, Spain, Switzerland, the United Kingdom, and the United States.
Operation RapTor resulted in the highest number of seizures of any JCODE operation, including more than $200 million in currency and digital assets, over two metric tons of drugs, 144 kilograms of fentanyl or fentanyl-laced narcotics, and over 180 firearms.
Operation RapTor was a global, coordinated effort by law enforcement in the United States, Europe, South America, and Asia to disrupt fentanyl and opioid trafficking, as well as the sales of other illicit goods and services, on the darknet, or dark web.
Operation RapTor builds on the successes of prior years’ operations and takedowns of marketplaces, which resulted in the seizure of darknet infrastructure from Nemesis, Tor2Door, Bohemia, and Kingdom Markets, providing investigators across the world with investigative leads and evidence. JCODE and Europol’s European Cybercrime Centre (EC3) continue to compile intelligence packages to identify entities of interest.
These leads allow U.S. and international law enforcement agencies to identify darknet drug vendors and buyers, resulting in a series of coordinated, but separate, law enforcement investigations, reflected in the statistics announced today.
In furtherance of Operation RapTor and in its first action as a JCODE member agency, the Office of Foreign Assets Control (OFAC) additionally sanctioned Iranian national Behrouz Parsarad for his role as the founder and operator of Nemesis Market following the seizure of the market. Parsarad was also indicted by a federal grand jury in the Northern District of Ohio on drug trafficking charges related to the illegal business he ran on the dark web.
“This historic international seizure of firearms, deadly drugs, and illegal funds will save lives,” said Attorney General Pam Bondi. “Criminals cannot hide behind computer screens or seek refuge on the dark web – this Justice Department will identify and eliminate threats to the American people regardless of where they originate.”
The impact of Operation RapTor can be attributed to the tireless work of U.S. and international law enforcement partners. For example:
On December 16, 2024, Rui-Siang Lin pleaded guilty to charges brought by the U.S. Attorney’s Office for the Southern District of New York of narcotics conspiracy, money laundering, and conspiracy to sell adulterated and misbranded medication for owning and operating Incognito Market, one of the largest narcotics marketplaces on the internet.
According to court documents and statements made in court, Incognito Market was an online narcotics bazaar that started on the dark web in October 2020. Until it shut down in March 2024, Incognito Market sold more than $100 million of narcotics—including hundreds of kilograms of cocaine and methamphetamine.
Incognito Market was available globally to anyone with internet access using the Tor web browser on the “dark web” or “darknet.”
Incognito Market was designed to facilitate seamless narcotics transactions, incorporating many features of legitimate e-commerce sites such as branding, advertising, and customer service. Upon visiting the site, users were met by a splash page and graphic interface, which is pictured below:
Incognito Market homepage
While concealing their identities with a unique username or “moniker,” users were able to search thousands of listings for narcotics of their choice. Incognito Market sold illegal narcotics, including heroin, cocaine, LSD, MDMA, oxycodone, methamphetamine, ketamine, and alprazolam, as well as misbranded prescription medication. An example of listings on Incognito market is below:
Listings for various drugs on the Incognito Market.
Listings included offerings of prescription medication that were falsely advertised as being authentic.
For example, in November 2023, while operating in an undercover capacity on Incognito Market, a law enforcement agent purchased and received several tablets purported to be oxycodone. Testing revealed that these tablets were not oxycodone and were, in fact, fentanyl pills.
In a second example, in January 2025, the U.S. Attorney’s Office for the Central District of California secured a 17-year sentence for Adan Ruiz, of Orange County, and a 15-year sentence for Omar Navia, of Los Angeles, for supplying fentanyl-laced pills to a drug trafficking ring that sold these drugs to more than 1,000 customers nationwide via the darknet.
In imposing the sentences, U.S. District Judge David O. Carter called this case “the most sophisticated fentanyl distribution ring that this court has seen.”
Navia and Ruiz admitted in their plea agreements that, from at least August 2021 to December 2022, they supplied fentanyl-laced pills to Michael Ta, 26, of Westminster, and Rajiv Srinivasan, 38, of Houston, who used the darknet and encrypted messaging applications to sell more than 120,000 fentanyl-laced pills, 20 pounds of methamphetamine, and other drugs directly to more than 1,000 customers in all 50 states, causing several fatal overdoses.
According to court documents and statements made in court, Srinivasan and Ta used the “redlightlabs” darknet account to advertise and sell counterfeit M30 oxycodone pills containing fentanyl and other illicit drugs.
Srinivasan also used the encrypted messaging application Wickr to communicate with and sell drugs to customers. Srinivasan received virtual currency as payment for the drugs and then routed that virtual currency through cryptocurrency exchanges.
The court record also shows that Ta communicated with Srinivasan about drug orders, obtained fentanyl-laced pills and methamphetamine from sources of supply, stored those drugs in his residence, and mailed out packages with drugs to customers who had ordered them from Srinivasan on the “redlightlabs” account.
Ta and Srinivasan admitted in their plea agreements to causing the fentanyl overdose deaths of three victims. Both defendants further admitted to distributing fentanyl-laced pills to two additional victims, both of whom suffered fatal drug overdoses shortly after they received the pills from Ta and Srinivasan. Prosecutors wrote in a sentencing memorandum, “The five victims of defendants’ crimes ranged in age from 19 to 51.
They lived across the country, from California to Florida, Colorado to Arkansas. Each of the five victims leaves behind a family that the defendants’ actions have forever and fundamentally changed. [Ta and Srinivasan] also victimised countless others as part of an epidemic of addiction and despair plaguing our district and our country.”
In a third example, in February 2024, the U.S. Attorney’s Office for the Eastern District of Virginia charged Joshua Vasquez, Joseph Vasquez, and Rafael Roman by criminal complaint with conspiracy to distribute 500 grams or more of methamphetamine.
Joshua Vasquez, Joseph Vasquez, and Roman conspired to sell counterfeit Adderall containing methamphetamine on darknet markets such as Bohemia and Tor2Door.
The defendants allegedly sold drugs on darknet marketplaces in exchange for cryptocurrency under the monikers “NuveoDelux,” “Mrjohnson,” and “AllStateRx.”
According to court documents and statements made in court, these three prolific darknet vendors were collectively responsible for fulfilling over 13,000 drug orders shipped throughout the United States, ranging in size from user quantities, e.g., five pills, to “reseller” quantities, e.g., 10,000 pills.
Joshua and Joseph Vasquez collectively ran the NuveoDeluxe and AllStateRx accounts. A fourth co-conspirator, Gregory Castillo-Rosario, who was arrested in October 2024, ran the Mrjohnson account. Roman assisted his co-conspirators by pressing counterfeit Adderall pills, packaging them, and distributing drug orders into the mail using the U.S. Postal Service.
The conspiracy also laundered funds associated with darknet drug proceeds.
While executing search warrants in New Jersey and New York, federal law enforcement officers seized more than $330,000, close to 80,000 counterfeit Adderall pills, one firearm, and two industrial pill press machines.
Additionally, two vehicles and several pieces of property were seized during the search warrants. An additional 30 kilograms of suspected counterfeit Adderall pills were seized on May 2, 2024, in New York. Photographs of some of the seized items are below:
Figure 3: Counterfeit Adderall pills laced with methamphetamine stored in 5-gallon buckets
Figure 4: Bags ready to be shipped to customers nationwide.
Figure 5: Illegal pill press machines used by drug traffickers to make counterfeit pharmaceutical pills.
Figure 6: Trash bags full of counterfeit Adderall pills laced with methamphetamine.
Joshua Vasquez pleaded guilty on April 24, 2024, and was sentenced on July 25, 2024, to 12 years in prison. Joseph Vasquez pleaded guilty on April 15, 2024, and was sentenced on August 8, 2024, to 10 years in prison.
Roman pleaded guilty on May 30, 2024, and was sentenced on November 14, 2024, to 10 years in prison. They all pleaded guilty to conspiracy to create a counterfeit substance and distribute 500 grams or more of a mixture and substance containing methamphetamine.
In a fourth example, a San Fernando Valley man, Brian McDonald, 23, was sentenced to more than 20 years in federal prison in the Central District of California for using darknet marketplaces to sell hundreds of thousands of dollars’ worth of fentanyl-laced pills and cocaine to buyers nationwide. He admitted in court documents to causing one fatal fentanyl overdose.
From at least April 2021 until May 2023, McDonald and others conspired to sell fentanyl and cocaine via multiple darknet marketplaces. McDonald operated under the monikers “Malachai Johnson,” “SouthSideOxy,” and “JefeDeMichoacan.”
McDonald created, monitored, and maintained the darknet vendor profiles, including by updating drug listings and shipment options, tracking drug orders, and offloading Monero cryptocurrency received as drug deal payments into cryptocurrency wallets that McDonald controlled.
McDonald recruited and hired accomplices to help package and ship the narcotics they sold on the darknet. McDonald directed and helped these accomplices package and ship the narcotics.
McDonald purchased bulk quantities of fentanyl and cocaine and then directed others to complete hundreds of drug sales involving large quantities of both fentanyl and cocaine.
