QQAAZZ

QQAAZZ is a transnational cybercrime-linked money laundering organization that has operated since at least 2016 as a cash-out and laundering service for other criminal actors. The group is known for laundering proceeds from computer fraud and banking theft, including funds associated with major crimeware ecosystems such as TrickBot, Dridex, and GozNym. It advertised itself on Russian-speaking cybercriminal forums as a global bank-drops service and functioned as a financial enablement layer for malware operators rather than as a primary malware developer. QQAAZZ used shell companies, fraudulent and legitimate identity documents, and hundreds of corporate and personal bank accounts to receive and move stolen funds through the banking system. The organization transferred money among accounts under its control and also converted proceeds into cryptocurrency while using tumbling services to obscure fund flows. Reporting indicates the group retained a substantial percentage of stolen proceeds as fees before returning the remainder to its cybercriminal clients. The organization had a multilayered membership structure spanning multiple countries in Europe and Eurasia, with members and defendants identified from Latvia, Georgia, Bulgaria, Romania, Belgium, and Russia among others. Law enforcement actions tied to the group included coordinated searches, arrests, and parallel prosecutions across several countries. QQAAZZ is best characterized as a financially motivated criminal laundering network that enabled post-compromise monetization for banking trojan and broader cybercrime operations.