Loading story…
The FBI, in collaboration with law enforcement agencies from Germany and Finland, dismantled the online infrastructure of E-Note, a cryptocurrency exchange allegedly used to launder over $70 million in proceeds from ransomware attacks and other cybercrimes. The U.S. Department of Justice announced the seizure of E-Note’s servers, mobile applications, and associated websites, as well as the unsealing of an indictment against Mykhalio Petrovich Chudnovets, a Russian national accused of operating the platform and facilitating money laundering for cybercriminal groups since at least 2010. Authorities also seized customer databases and transaction records, highlighting the scale and operational sophistication of the laundering network, which evolved from ad-hoc money mule arrangements to a streamlined online service.
Prosecutors allege that E-Note played a significant role in enabling transnational cybercriminals, including those targeting healthcare and critical infrastructure, to move illicit funds quickly and covertly across borders. While Chudnovets has been charged with money laundering conspiracy, it remains unclear whether he is in U.S. custody, as he is believed to be in Russia. The takedown underscores ongoing international efforts to disrupt the financial infrastructure supporting ransomware and other cybercrime operations, and demonstrates the increasing focus on targeting the enablers of cybercriminal economies.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Following the takedown, investigators began analyzing years of transaction and customer records to identify additional users and criminal networks linked to the service, while also soliciting information from the public about funds moved through E-Note.
U.S. prosecutors in the Eastern District of Michigan announced charges against Russian national Mykhalio Petrovich Chudnovets for conspiracy to launder monetary instruments in connection with operating E-Note. He faces up to 20 years in prison and was not reported to be in U.S. custody.
The FBI, Michigan State Police, and law enforcement partners in Germany and Finland seized E-Note's servers, domains, websites, mobile apps, customer databases, and transaction records as part of a coordinated takedown.
Investigators said E-Note moved more than $70 million in illicit proceeds since 2017, including funds tied to ransomware attacks and other cybercrime affecting U.S. healthcare and critical infrastructure organizations.
According to the unsealed indictment, Mykhalio Petrovich Chudnovets allegedly operated E-Note as a cryptocurrency exchange and payment processing service for cybercriminals from 2010 onward.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcehackread.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States unsealed charges against two Russian nationals accused of operating the cryptocurrency services **Cryptex** and **PM2BTC**, alleging they ran billion-dollar money-laundering infrastructure used by cybercriminals to process ransomware proceeds, darknet market payments, fraud revenue, and sanctions-evasion transactions. Treasury simultaneously moved against the network: FinCEN labeled PM2BTC a **primary money laundering concern** and barred certain fund transfers involving the service, while OFAC sanctioned Cryptex and alleged facilitator Sergey Sergeevich Ivanov. The action was coordinated with the U.S. Secret Service, Dutch law enforcement, and a State Department reward offer of up to **$10 million** for information on Ivanov. The case extends a broader U.S. campaign against Russian cybercrime finance channels that previously targeted **Hydra Market** and the exchange **Garantex**. Treasury has described Hydra as a major darknet marketplace that enabled ransomware-as-a-service, stolen data sales, and other illicit trade, while Garantex allegedly processed more than **$100 million** tied to illicit actors despite anti-money-laundering deficiencies. Together, the latest charges and sanctions show U.S. authorities escalating efforts to cut ransomware operators and other Russian-linked cybercriminals off from the virtual-currency services they rely on to move and cash out illicit funds.
Jun 29, 2026
Ukrainian, French, and U.S. authorities disrupted the **Egregor** ransomware operation through coordinated raids in Ukraine that led to the arrest of three suspected members and targeted alleged ring leaders and affiliate associates. Investigators linked the case to attacks on French organizations including **Ubisoft**, **Gefco**, and **Ouest France**, while Ukrainian officials said Egregor had struck more than **150 companies** and caused losses exceeding **$80 million**. After the operation, Egregor’s leak site went offline, indicating a major blow to the group, which researchers and investigators have also tied to the former **Maze** ransomware ecosystem. In a parallel international action, the U.S. Department of Justice announced a global disruption of **NetWalker**, another ransomware-as-a-service operation, charging Canadian national **Sebastien Vachon-Desjardins**, seizing about **$454,530** in cryptocurrency, and taking down a dark web site used to communicate with victims. The DOJ said NetWalker hit healthcare providers, municipalities, schools, universities, law enforcement, and emergency services, with healthcare organizations particularly targeted during the COVID-19 pandemic. French investigators said ransomware cases remain difficult because attackers move faster than judicial processes, forcing police to rely on infrastructure mapping, indicators of compromise, and private-sector intelligence to identify operators and support cross-border takedowns.
Aug 15, 2026
An international law enforcement operation coordinated by **Europol** and **Eurojust** dismantled the **AudiA6** cryptocurrency laundering service, which investigators say washed more than **EUR 336 million** (about **$380 million**) between 2022 and 2025 for ransomware groups and other cybercriminal networks. Authorities linked the service to more than **15 international investigations** involving ransomware and major cryptocurrency theft, describing AudiA6 as an industrial-scale laundering pipeline that relied on thousands of fraudulent exchange accounts, stolen or purchased identities, and more than **6,000 KYC records** tied to money mule accounts. The crackdown included coordinated arrests, searches, domain takedowns, server seizures, cryptocurrency freezes, and the seizure of vehicles, properties, and Telegram accounts across multiple jurisdictions. Investigators said the case advanced after Polish authorities arrested a Ukrainian suspect in September 2025, with forensic analysis leading to additional arrests in Georgia; the U.S. Department of Justice identified **Ruslan Igorevich Tkachuk** and **Alexander Vladimirovich Ledenev** as senior AudiA6 members now in Georgian custody. Europol also said the same suspects were tied to administration of the **Dark2Web** cybercrime forum, underscoring the role of specialized laundering services in sustaining the ransomware ecosystem.
Aug 11, 2026