UK Law Enforcement Dismantles Long-Running “SocialPharma” Darknet Drug Network

On December 15, 2025, the South East Regional Organised Crime Unit (SEROCU) announced that four men were sentenced to 47-years in total for running a nationwide dark net drug supply network under the brand name “SocialPharma.” The investigation, led by SEROCU’s Cyber team with support from specialist partners, dismantled one of the UK’s most persistent and sophisticated darknet pharmacy operations, responsible for flooding the country with counterfeit pharmaceuticals and controlled substances over a number of years.

TRM Labs is proud to have supported SEROCU as investigators traced digital asset flows and mapped SocialPharma’s activity across platforms.

Background

Established in 2018, SocialPharma operated as an “online pharmacy,” but in reality functioned as a large-scale criminal enterprise that sold counterfeit tablets and a wide range of controlled drugs, including heroin, methamphetamine, cocaine, ketamine, and other substances, through an extensive footprint across the darknet. Over time, the group built an almost continuous presence across major marketplaces, operating under slight name variations as platforms were shut down or seized. SocialPharma operated on Apollon, ASAP, Berlusconi, Bohemia, Cartel, Empire, Incognito, Nightmare, Torrez, White House Market, Versus, DarkMarket (as “SocialPharma1”), and Dark0de Reborn (as “socialpharma”).

To further insulate themselves from market failures and law-enforcement shutdowns, the operators also launched their own Televend vendor shop, enabling direct, off-market transactions with customers. Even after the collapse of multiple darknet marketplaces worldwide, SocialPharma remained active. By 2025, the group had fully embraced Telegram-based distribution, operating within the Tesseract bot community and offering benzodiazepines (Pregabalin, Tramadol, Diazepam), stimulants (cocaine, amphetamine, MDMA, 4-MMC, methamphetamine), opiates (DHC, codeine, Oxycodone, heroin), dissociatives (ketamine), prescription drugs, cannabis, and cannabis-derived products.

Across these platforms, SocialPharma collected at least £4.3 million in Bitcoin, and evidence recovered from devices included one defendant boasting about laundering £2.5 million through his personal account. The group’s resilience across nearly every major darknet market of the last half-decade allowed it to build a reputation for reliability within criminal communities while making it significantly harder for law enforcement to disrupt.

“Groups like this operate almost entirely online, convinced that pseudonyms and cryptocurrency will shield them from view,” said Phil Ariss, TRM Labs’ Director of Law Enforcement Relations for Europe. “What SEROCU demonstrated is that when blockchain intelligence is paired with strong traditional investigative work, those assumptions fall apart — identities can be uncovered, and these operations can be dismantled.”

The Organization

The investigation ultimately revealed a clear division of labor inside the group. Osvaldas Novikovas, 32, was identified as the driving force behind SocialPharma, responsible for overall operations and supply. Jordanas Avizienius, 27, served as his operational lieutenant, managing sales, marketplace vendor accounts, Telegram channels, and encrypted communications with customers. Marius Sutrinavicius, 44, ran what investigators described as the “packing house”—preparing orders, pressing counterfeit tablets, packaging drugs, and arranging postal shipments across the UK. Javed Afzal Khan, 55, supplied pharmaceutical products into the network, providing raw materials that were later rebranded, diluted, or repackaged.

The Investigation

SEROCU’s Cyber team built the case through an integrated investigative approach, combining blockchain tracing, digital forensics, intelligence development, operational surveillance, and traditional policing. Investigators linked years of darknet vendor activity and Telegram communications to the defendants, correlated order volumes with postal data, and followed cryptocurrency payments from darknet customers through SocialPharma-controlled wallets and into cash-out infrastructure. The Medicines and Healthcare products Regulatory Agency’s Criminal Enforcement Unit played a critical supporting role, advising on pharmaceutical evidence and the dangers posed by the counterfeit medicines being circulated.

‍Public Safety Risks‍

The public safety risks were significant. Heroin seized from the group contained traces of fentanyl, a synthetic opioid far more potent than heroin or morphine, where even microgram quantities can trigger fatal overdose. Counterfeit pharmaceutical tablets produced or distributed by SocialPharma were of unknown potency and composition, manufactured outside any regulatory oversight. For vulnerable users, every order carried a heightened risk of serious injury or death.

Charges and Sentencing

In July, Novikovas, Avizienius, and Sutrinavicius pleaded guilty to conspiracy to supply Class A and Class B drugs, including counterfeit pharmaceutical tablets, heroin, methamphetamine, cocaine, and ketamine. Avizienius also admitted possession of criminal property. At trial, Khan pleaded guilty to conspiracy to supply Class A and Class C drugs and was later convicted by a jury of additional Class A and Class B offenses involving cocaine, ketamine, and heroin. On December 12, 2025, at Kingston Crown Court, Novikovas received 13 years and 6 months’ imprisonment, Avizienius 10 years and 6 months, Sutrinavicius 8 years and 3 months, and Khan 15 years.

Conclusion

This case demonstrates how UK investigators are rapidly advancing their capabilities to disrupt cyber-enabled drug trafficking networks operating across darknet markets, encrypted messaging platforms, and cryptocurrency payment channels. Through coordinated cyber expertise, financial intelligence, and close partnership with regulatory and international partners, SEROCU and its collaborators identified long-standing offenders, documented years of illicit activity, and removed a prolific supplier from the ecosystem. For darknet vendors that rely on platform-hopping, pseudonym rotation, and cryptocurrency anonymization, the message is clear: resilience online does not equate to immunity offline. Persistent, intelligence-led investigations can—and will—reach them.