In this article
Investigations by Albania’s Special Prosecution Office against Corruption and Organized Crime (SPAK) show that criminal groups in Albania used the latest technology not only to organize murders, targeted attacks, drug trafficking and corruption, but also to keep their rivals and victims under surveillance.
The “Metamorfoza” case files showed that phones with encrypted messaging apps had become essential tools for organized crime.
Untappable phones spread through the criminal world after 2010, when the first PGP platforms began offering services through Ennetcom for BlackBerry, and later through Phantom Secure, Ciphr, IronChat, EncroChat and Sky ECC for Samsung and iPhone.
It was the decoding of conversations traced on the Sky ECC network, which authorities in the Netherlands, Belgium and France broke into and shut down, that helped the Special Prosecution Office unravel 36 incidents and bring proceedings against 76 people suspected of links to at least 7 dangerous criminal groups.
SHTEG has analyzed the investigation files, which show that criminal groups invested substantial sums in technology. Decoding their encrypted conversations revealed how crime operated in Albania.
Investing in “high-tech work”
Criminal groups considered untappable phones indispensable. They guaranteed secure communication, particularly when organizing drug trafficking and murders.
These devices, which cost 3,000–5,000 euros including the subscription, depending on the platform and model, could be lent or given as gifts when someone was recruited as a lookout for a targeted attack, as a link to someone who might be in prison, or to an official needed “for work”.
In conversations decoded during the investigations, Arben Ndoka says he has bought 15 devices with Sky ECC, while Ismail Zeneli also sends his group phones with Ciphr from England.
But beyond these investments, there was also “shared use” when goals and interests “converged”.
The investigations indicate that in the spring of 2020, Behar Bajri used Emiljano Shullazi’s Sky ECC phone to speak from the cells of the “Jordan Misja” detention facility with businessman Pëllumb Gjoka, who was seeking to secure his release through the influence and contacts of prosecutor Xhevahir Lita.
In another instance, in July 2020, Gjoka’s driver, Edmond Preka, would lend his Sky ECC phone to the senior police official nicknamed “Zeqo”, who passed information to Gjoka to help Bajri.
In August 2020, Bujar Ajeti gave Erzen Breçani a Sky ECC phone after Breçani had obtained information for him about a venue where eavesdropping was suspected. The phone belonged to Nuredin Dumani.
Dumani had given it “for work” to Enver Diva, who had been involved in a targeted attack in Tirana. The two user handles Dumani used were “Cimicimi” and “Qabone”.
The files also show phones shared “for work” between Hektor Xheçuka and Florenc Kelmendi, Ervis Martinaj and Erigers Mihasi, and Deivis Bajramaj and Albert Zaja.
But phones were not the only investment in technology. Online DVR camera systems, GPS tracking devices and long-range drones were another part of the “high-tech” equipment that criminal groups were found to be using to organize drug trafficking, surveillance and targeted attacks.
In the case of an explosives attack on 15 September 2020, Sky ECC communications indicate that Elson Reçi had fitted a GPS tracker to the victim’s car to monitor their movements, and had triggered the explosive with a remotely controlled detonator from at least 100 meters away.
The use of GPS tracking devices was a matter of debate among criminal groups, because small GPS devices generally have only a few days of battery life. Yet, as Ismail Zeneli tells Bujar Ajeti in a conversation in February 2021, while his group was following the relatives of people they were targeting: “…there are GPS devices that last three months, too. You can find anything!”
In November 2020, Aleks Ndreka, known as “Leksi i Druve”, suggests in a conversation with Prekë Kodra that, for a targeted attack on behalf of Behar Bajri, they could use a GPS device fitted to a speedboat the potential victim had expressed interest in buying.
“He’ll go out on the lake [Shkodra] and with a fast jet ski you can catch him, and he’ll have nowhere to run. Ideally, dress like border police,” Ndreka says. “We’ll put a GPS with a number on it, and whenever it has power, it will send a signal showing where it is. It’s the size of a matchbox.”
In other cases, the groups also seek camera equipment capable of sending live images from a location to their phones. In June 2020, Klaodor Haka suggests to Pëllumb Gjoka, who is suspected of having ordered someone to be followed so they could be killed, that they park a car in the area where the person lives and install a DVR camera in its trunk.
“In the trunk, with a card and a monthly internet plan, so it’s online all the time. That way you can keep an eye on him, because you have it online in real time,” Haka advises.
Leonard Duka’s group, which was in conflict with Ervis Martinaj, invests in a different direction.
In August 2020, Leonard instructs Drianto Bardhi to buy a drone capable of lifting up to 12 kg and equipped with “infrared” cameras. The conversations do not make clear why the group wanted such a drone, but the camera specifications and lifting capacity suggest that it would be used at night, probably to move narcotics or even heavy weapons.
In the conversations they exchange on Sky ECC, the Duka brothers say they will use various weapons in a possible attack on Martinaj and his men. In one episode, the group says it has bought a large-caliber sniper rifle which, because of its size, could only be moved in a van.
In parallel, the Duka brothers also discussed hacking Martinaj’s phone as a way to obtain direct information about him.
Erlis Duka tells his brother Leonard that a contact of his knows where Martinaj gets his phones and that, when he comes to collect a new one, they could “install a monitoring program on it”. With this option, Erlis stressed, Martinaj could be “caught alive”.
Cars, venues and the schemes used to launder money
Because of their feuds, criminal groups in Albania protected themselves by largely restricting their movements to areas or venues where they had influence. Investigations by the Special Prosecution Office show that they had invested in their security by buying armored cars.
The brothers Durim and Valter Bami, who were being followed by groups from Lezhë, Kurbin, Shijak and Shkodër, kept luxury cars such as Mercedes-Benz, BMW and Range Rover, at least two of which were said to be armored.
According to Sky ECC communications, those following the Bami brothers had identified two armored BMW cars, one of them with Russian license plates.
In the Shkodër group, conversations indicate that Behar Bajri had ordered two armored Audi cars after his release from prison in 2020. The Albanian authorities had impounded them, and Bajri sought prosecutor Xhevahir Lita’s help to have them released, offering a bribe of 10 thousand euros.
In the “Duka Clan”, according to Altin Gega, Leonard Duka had an armored Mercedes-Benz E-Class, which the group used whenever it was considered necessary for journeys outside Tirana. An official identified as “Olci/Olsi/Olti”, who, according to the group, provided security for Ervis Martinaj, was also said to use a similar “E-Class” vehicle.
“Olci is guarding [Visi] along with the state, because he has 20 cars following him around,” Leonard Duka says in one conversation.
Armored cars are purchased to order. The cost varies according to type, structure, make and level of armoring. For high-riding cars, luxury makes or models, the cost can reach twice the value of the standard version of the same model, amounting to 75–150 thousand euros.
Range Rover emerges as the most widely used make among the criminal groups mentioned in the “Metamorfoza” files, followed by BMW, Mercedes-Benz and Volkswagen, mainly Golf models.
By contrast, information shared within the “Duka Clan” shows that, in Vlorë, people close to Fatmir Hyseni preferred the American luxury car brand Lincoln.
In September 2020, Erlis Duka considers at least two cars, one of them with Greek license plates, to be under surveillance by rival groups, adding in the information he sends his brother Leonard that “they suspect we’re getting around in those cars from Vlorë”.
According to Sky ECC communications, the Bami brothers and the Nikël group frequented several complexes and restaurants in the Bubq and Fushë-Krujë area, at least one of which, according to Behar Bajri, belonged to them.
They were investors in a five-story hotel in Rinas and owners of another venue in the Komuna e Parisit neighborhood of Tirana. While in the capital, they preferred the area known as “Oxhaku”, generally spending time at a venue near Xhanfize Keko Street.
In the conversations, Arben Ndoka is presented as the owner of a bottled-water business, but the authorities have been unable to establish a direct link between him and any such business.
Leonard Duka and Ervis Martinaj, meanwhile, speak as co-investors in a luxury venue in the former Bllok district, a hotel in Rinas, several vehicles and various items of equipment for the sports-betting business.
Duka calculates investments of around 7 million euros in joint ventures with Martinaj over 15 years of friendship, which, by 2020, clearly appears to have turned into a feud following the murder of Santiago Malko in 2019. In their discussion of the split, a sum of around 2 million euros emerges, which Duka gives Martinaj an ultimatum to return within a week.
To launder money, Albanian criminal groups mainly open sham businesses. Arian Tuku provides one such example. In July 2020, in a conversation with an unidentified user, he says he launders the proceeds of drug trafficking by “running invoices through” sham businesses.
“Open a construction company in Albania, brother. Taxes are really cheap here. Put 6–7 workers on the books, issue invoices as if they’re doing construction work,” Tuku recommends.
One year after this conversation, “Eurocompany”, which is registered in Tuku’s name, billed turnover of 1.8 million euros and more than 475 thousand euros in profit.
Hotels appear to be another method, as they can conceal clandestine gambling operations. In this arrangement, corruption of law-enforcement officials appears to play a key role.
Investigations by the Special Prosecution Office reveal a case in which Oltian Bistri, the former head of the Operational Force, leaked police operations to benefit businessman Pëllumb Gjoka. In his conversations, Bistri implies monthly payments of 1,500 euros for himself and other officials.
“Work” and “orders” straight from the phone
Encrypted communication platforms made it easier to coordinate international drug trafficking. Secure behind their phones, Albanian criminal groups established contacts and routes across oceans.
This emerged during SPAK’s investigations, when the decoding of conversations on the Sky ECC platform exposed the groups of Ismail Zeneli and Albert Prenga. Together with Eralbi Breçani, Besmir Murati and Dedan Gjoni, the former head of the crime division in Elbasan, they coordinated on Sky ECC with other, unidentified people who remain under investigation.
Ergys Dashi, identified by the nickname “Pika”, stood out in Zeneli’s group. He took charge of deals and drug shipments directly from South American countries such as Ecuador, Colombia and Brazil.
Dashi appeared to be the most knowledgeable. He had information about all the international transport companies. In the conversations, he recommended Seko, Hapag Lloyd, MSC-Mediterranean Shipping Company and Maersk, promising that his contacts could ensure trouble-free passage on these companies’ services through transit countries to the ports of Rotterdam in the Netherlands and Antwerp in Belgium, where Zeneli had associates.
Dashi also explained how cocaine could be hidden in containers. He offered several options, but for safety recommended refrigerated containers on exotic-fruit shipping routes, where, he said, the loads could be concealed in the engine section, wrapped in plastic film that “makes it undetectable by scanners”.
“What I’ve sent you is a company! I’d been buying bananas for 4 months. It’s 95% safe as a job,” Dashi said in one exchange in which he recommended “a 69 kg run” from Brazil.
Around a year after these conversations, in January 2022, Dashi would be killed in a mafia-style attack in a bar in Guayaquil, Ecuador. The 34-year-old was reputed to have extensive contacts among the cartels. The authorities suspect his murder was linked to drug deals.
Zeneli’s group appears to have placed great trust in Sky ECC communications, so much so that some of its members struck deals with third parties they had never met. Eralbi Breçani says in the conversations that he knew some of the contacts dispatching the shipments only over the phone.
These conversations mention people nicknamed Batmani, Mosko and Primo, who are suspected of being partners in the drug deals, as a 25% share of the profits is mentioned for them.
To ensure that a shipment was not exposed and stolen en route, only Dashi or Zeneli kept the identification numbers of the “contaminated containers”. They continuously tracked their progress through online platforms, passing the numbers to the group only on the day the load was to be removed from the destination port.
The conversations also reveal another practice: the parties guaranteeing passage through transit points were promised shares of the profits, which, depending on the circumstances, quantity and level of attention from other groups, could reach 40%.
In Albert Prenga’s group, which mainly transported cannabis from Spain to Germany, the files reveal how narcotics were moved by land using encrypted Sky ECC phones.
Two people traveled in a “clean car”, without drugs, watching along the route for checkpoints or a police presence. Throughout the journey, they communicated through Sky ECC, and the car carrying the load was driven according to their instructions on avoiding checks.
In this activity, SPAK suspects that the groups made payments and withdrew money through transfers from sham companies opened in Spain, or through the so-called “Hawala” system, a longstanding network for off-the-books money transfers originating in India but widespread in countries in Africa and South America.
Money is transferred this way through an illegal network of intermediaries who charge commissions and guarantee that the sums will be passed on through their associates in the desired countries. Clients are given a unique security code that allows them to collect the money from the associate.
The history and scale of the “Metamorfoza” cases
At least 127 people appear in the communications between Albanian criminal groups on Sky ECC decoded by the Special Prosecution Office. It has not been possible to identify 44 of them (34.6%), who remain listed as PIN codes or nicknames in the investigation files.
Nevertheless, the investigations into these cases, divided into “Metamorfoza 1, 2, 3”, have clarified 36 criminal incidents that took place between 2019 and 2021 and dealt a heavy blow to some of Albania’s most dangerous groups of the past decade.
What stood out in these investigations was the involvement of officials as accomplices to crime, whether by providing information or by taking part in corruption or drug trafficking.
“Metamorfoza 1” began in the spring of 2023, following criminal proceedings “No. 9” and “No. 41”.
The first proceedings began in January following a criminal complaint by Lulë Zefi and her son, Donald Zefi. They claimed that, as heirs to around 39 hectares of land in Velipojë inherited from Drande Hotaj, they had discovered unlawful transfers by other heirs, with businessman Pëllumb Gjoka benefiting behind them.
The Special Prosecution Office opened an investigation into a structured criminal group, document forgery and money laundering. But in July 2023, SPAK merged this case with another set of proceedings involving businessman Gjoka.
Since March, Gjoka had also been under investigation by the National Bureau of Investigation (BKH), which, working with Eurojust, Europol and the French judicial authorities, included him among the suspects in other criminal activities. These notably included corruption, unlawful possession of weapons, participation in a structured criminal group and creating the conditions for the murder of Gjin Ndoji (2020) and the attacks on Kleant Musabelliu, Dorian Duli and Ibrahim Lici (2020–2021).
On 23 July 2023, the Special Court approved SPAK’s request for the arrest of Gjoka and 14 other suspects: Behar Bajri, Denis Bajri, Ervis Martinaj, Edmond Preka, Klaodor Haka, Prekë Kodra, Astmer Bilali, Aleks Ndreka, Bardhyl Mavraj, Eljon Hato, Arsad Bashli, Ardrit Hasanbegaj, the former head of the crime division in the Shkodër police, Oltian Bistri, the former head of the Operational Force, and Xhevahir Lita, a former prosecutor in Shkodër.
The police were able to arrest only six of those wanted: the three former law-enforcement officials, businessman Gjoka, his driver Preka and former athlete Bilali.
Behar Bajri, also known by the surnames Bajroviq and Rustemi, was arrested in France in September 2023, while Aleks Ndreka, known as “Leksi i Druve”, was arrested in Italy in June 2024. In May, the case against them was referred for trial.
Arsad Bashli, Bardhyl Mavraj, Denis Bajri, Eljon Hato, Klaodor Haka, Prekë Kodra and Ervis Martinaj remain wanted. Martinaj’s family reported him missing in August 2022.
“Metamorfoza 2” began in April 2023 following SPAK’s criminal proceedings “No. 78”, based on suspicions of a structured criminal group involved in international drug trafficking through direct routes from Ecuador, Colombia and Brazil.
The investigations focused mainly on four intercepted shipments in the Netherlands (446 kg of cocaine, 2021), Brazil (69 kg of cocaine, 2021) and Germany (250 kg of cocaine and 166 kg of marijuana, 2021), whose authorities suspected that the orders had been placed by Albanian groups.
Here, too, information from parallel investigations by BKH and foreign agencies led to another set of proceedings, “No. 158”, which was joined to the earlier proceedings in May, with charges of unlawful possession of weapons, bribery of public officials, the attempted murder of brothers Albert and Edmond Nela (2020), and money laundering.
On 17 November 2023, the Special Court approved SPAK’s request for the arrest of Artan Sulejmani, Albert Prenga, Bajram Grabova, Ervin Mata, Ismail Zeneli, Besmir Murati, Bujar Ajeti, Jonida Babameto, a former officer in the Border Directorate, Dedan Gjoni, the former head of the crime division in the Elbasan police, Erzen Breçani, the former deputy director of the Tirana police, and his son Eralbi Breçani.
Of the 11 people declared wanted, the police were able to arrest only 6: the three former law-enforcement officials, Breçani’s son, Murati and Ajeti, who was also known in Kukës as Bujar Gjermizi.
Ismail Zeneli, known as Luan Sadria or “Daja”, who, alongside his involvement in drug trafficking, was seeking to have the Nela brothers killed in revenge for the murder of his brother Guxim Sadria, was arrested in Spain in December 2023. He was extradited to Albania in August of this year.
The police did not find Prenga, Sulejmani, Grabova or Mata.
The case against this group was referred for trial on 7 August, when it was striking that Mata was not among the defendants, while Adrian Cenaj had been added to the list, suspected of helping with efforts to organize the murders of the Nela brothers.
“Metamorfoza 3” began after a failed attack on Aleks Ndreka in March 2022, when SPAK opened criminal proceedings “No. 59”, primarily on the basis of his criminal complaint.
By 2023, circumstances connected with this case, as well as testimony from the killer-turned-cooperating witness Nuredin Dumani, had provided indications of the activities of 7 different criminal groups. This led to three further sets of proceedings: “No. 66”, “No. 33” and “No. 50”.
The investigations raised suspicions of involvement in murders, attempted murders, international drug and arms trafficking, corruption and money laundering. But it was the decoding of Sky ECC communications that moved these proceedings forward.
The Sky ECC conversations revealed the conflicts and connections linking criminal groups from Shkodër, Kurbin, Lezhë and Shijak against the Nikël group, which, to “settle scores”, joined forces with the so-called Duka Clan and a faction of the Vlorë group.
On 15 May 2024, SPAK drew up a single list of 50 people suspected of involvement in at least 18 criminal episodes and requested arrest measures from the Special Court. Among the names that stood out were former law-enforcement officials such as Henerigert Mitri, the former director of the Lezhë police, and Klodian Shahini, his former subordinate, as well as Armando Ndreca, the brother of Socialist MP Eduard Ndreca.
The police managed to execute 19 of the arrest warrants.
Subsequent police operations led to the arrests of Astrit Avdyli, Ilia Ndoka, Xhelal Rraja and Marklen Haka.
Leonard Duka was extradited from Belgium, while Fabio Ballabani, Durim Bami and Elson Reçi were arrested in Germany and Dubai.
On Wednesday, 11 September 2024, former police director Mitri turned himself in to the police, bringing the number of people expected to answer before the courts in “Metamorfoza 3” to 28, while 22 others remain wanted, among them Arben Ndoka, Endrit Dokle, Fatmir Hyseni and Erlis Duka.
*Revised by the author. Originally produced and published for Shteg.org – a project of the Network for Reporting Corruption and Organized Crime in Albania. Republication rights belong exclusively to the author and “RRKOKSH”.
* This article was reviewed and corrected on 8 October 2026.