WASHINGTON — In a major cross-border cybercrime enforcement action, the Federal Bureau of Investigation (FBI), working in tandem with French law enforcement, has dismantled a pair of illicit websites dedicated to the distribution of child sexual abuse material (CSAM) and non-consensual artificial intelligence-generated deepfake media.

The coordinated international sweep resulted in the seizure of the domains NudeLeaksTeens and NLTVIDS, effectively cutting off a global hub for the monetization and dissemination of stolen and manipulated explicit imagery targeting minors. According to the U.S. Department of Justice and court records unsealed in the Eastern District of Virginia, French authorities in Paris arrested a 25-year-old French resident suspected of operating as the primary administrator for both platforms.

The operation underscores a rapidly evolving and deeply disturbing frontier in digital crime, where traditional child exploitation converges with modern generative artificial intelligence and the mass compromise of everyday social media accounts.

Main Facts of the Operation

The takedown of NudeLeaksTeens and NLTVIDS represents a critical blow to international networks trafficking in illicit digital content of minors. Court documents filed by Arlington County police detective and FBI cybercrime task force member John Bamford reveal that the websites operated as commercial clearinghouses for explicit material.

The sites offered a vast array of illegal content, including verified CSAM and non-consensual "intimate" deepfake media. These AI-generated fabrications superimpose the faces of real individuals—often underage girls—onto explicit videos or photos without their knowledge or consent.

According to investigators, the administrators employed deceptive legal disclaimers, explicitly stating on the homepage that they disavowed child pornography and did not host files directly on their servers. Instead, the sites relied on external links and third-party hosting services, while actively advertising, bundling, and selling access to explicit portfolios.

The platforms featured a dedicated digital currency system, allowing users to purchase individual files or curated bundles organized by victim. In one particularly egregious example highlighted in the warrant, a digital collection containing 189 gigabytes of material concerning 315 different young girls was offered for sale for $64.90.

Much of the raw material utilized by the perpetrators was harvested directly from popular mainstream social media ecosystems, including Snapchat, TikTok, Instagram, and Facebook. Victims and their families reported that attackers routinely hacked into private accounts or covertly recorded interactions to build these illicit portfolios.

Chronology of the Investigation

Law enforcement’s path to dismantling the network unfolded over several years, tracking a trail of digital extortion, account compromises, and international collaboration:

• 2022–2023: Investigators note that explicit collections tied to known serial offenders—such as Reuben Oswaldo Yeverino Rosales—were actively promoted and commercialized on the domains. Rosales was eventually convicted and sentenced to over 34 years in federal prison for child sexual exploitation and cyberstalking.
• 2024: U.S. law enforcement agencies officially identified NudeLeaksTeens and NLTVIDS during ongoing cybercrime intelligence sweeps, recognizing their role in advertising hacked, leaked, and stolen CSAM targeting young girls.
• October 2, 2025: Detective John Bamford filed a formal seizure warrant in the U.S. District Court for the Eastern District of Virginia, targeting the underlying domain registries.
• April 2026: Federal courts in Texas sentenced Andrew Venegas to 30 years in prison after he pleaded guilty to child sexual exploitation and receipt of CSAM. Evidence from the Venegas prosecution provided crucial links regarding how bad actors utilized extortion and social media hacking to secure victim imagery.
• October 2026: The FBI formally executed domain seizures against NudeLeaksTeens and NLTVIDS. Simultaneously, the cybercrime division of the Paris Prosecutor’s Office arrested the 25-year-old French national suspected of running the infrastructure. VeriSign, the Reston, Virginia-based domain registry controlling the seized domains, cooperated with the execution of the warrants.

Supporting Data and Technical Infrastructure

The operational blueprint of NudeLeaksTeens and NLTVIDS reflects a sophisticated understanding of how to evade traditional hosting-provider takedowns while maximizing profit.

Evasion Tactics

Rather than storing prohibited files directly on their servers—which would have invited immediate intervention from hosting providers and cloud vendors—the site operators utilized a "referral" model. They posted disclaimers claiming immunity under the argument that they merely linked to "non-affiliated sites." Behind the scenes, however, the administrators maintained tight curation over the content, bundled victims into commercial packages, and directed users toward encrypted communication channels and cryptocurrency transactions to complete sales.

The Source of the Material

Data gathered by the FBI indicates that the content distributed on the sites originated from a mix of vectors:

1. Hacked Social Media Accounts: Perpetrators systematically targeted the personal accounts of young girls on platforms like Snapchat, TikTok, Instagram, and Facebook, locking victims out and extracting private photos and videos.
2. Extortion: Offenders coerced victims into providing explicit media through direct threats or manipulation.
3. AI Deepfakes: As generative video and image tools have grown more accessible and sophisticated, operators increasingly incorporated synthetic media, creating convincing fake explicit videos to harass victims and drive traffic.

Official Responses and Legal Frameworks

The success of the international operation highlights the growing importance of cross-border law enforcement cooperation and the utilization of recently enacted legislative tools designed to combat digital harassment and exploitation.

U.S. and French Law Enforcement

Federal agencies in the United States and France have ramped up coordination to tackle borderless cybercrimes. The involvement of the Paris Prosecutor’s Office was vital in identifying, locating, and apprehending the primary suspect on European soil, demonstrating that international borders will not shield operators of illicit dark-web or fringe-web platforms from justice.

The Role of VeriSign

Following the execution of the search warrants, Reston, Virginia-based domain registry VeriSign confirmed its compliance with federal orders. David McGuire, a spokesperson for VeriSign, stated that the company promptly executed its responsibilities under the warrant and emphasized that VeriSign maintained no corporate or operational relationship with the websites or their administrators.

Legislative Impact: The TAKE IT DOWN Act

The investigation highlights the vital role of the TAKE IT DOWN Act, a landmark piece of legislation passed by U.S. lawmakers last year. The law explicitly criminalizes the creation and distribution of non-consensual "intimate" deepfake media featuring real people, closing crucial legal loopholes that previously allowed creators of synthetic explicit content to evade prosecution.

Furthermore, the TAKE IT DOWN Act grants the Federal Trade Commission (FTC) robust enforcement authority and empowers federal courts to issue rapid removal orders compelling websites and hosting providers to scrub non-consensual explicit material from the internet. Detective Bamford noted in court filings that the platforms’ activities directly violated the core prohibitions outlined in the statute.

Implications for the Future of Cyber Safety

The dismantling of NudeLeaksTeens and NLTVIDS sends a stern warning to administrators of underground networks trafficking in stolen digital media and AI-generated exploitation. However, cybersecurity experts and law enforcement analysts warn that the case exposes systemic vulnerabilities across the modern digital landscape.

1. The Deepfake Threat Matrix: The integration of AI-generated deepfakes into CSAM networks marks a dangerous evolution. As tools for generating synthetic media become democratized, bad actors no longer need to rely solely on stolen photos; they can fabricate explicit content entirely from publicly available social media profile pictures.
2. Social Media Security Responsibilities: The heavy reliance on platforms like Snapchat, TikTok, Instagram, and Facebook as sourcing grounds for exploiters puts renewed pressure on Big Tech companies. Analysts argue that platforms must implement more robust account security measures—such as mandatory multi-factor authentication (MFA)—and faster abuse-reporting channels to prevent the mass compromise of minor accounts.
3. Cryptocurrency and Financial Tracking: Because sites like NudeLeaksTeens and NLTVIDS relied heavily on cryptocurrency and alternative payment methods to monetize abuse, financial intelligence units and blockchain analytics firms will remain central to future cross-border operations.

As the unnamed 25-year-old French suspect faces extradition and prosecution, federal authorities maintain that investigations into the wider networks, buyers, and secondary distributors associated with these sites remain ongoing.