Loading story…
An international law enforcement operation coordinated by Europol and Eurojust dismantled the AudiA6 cryptocurrency laundering service, which investigators say washed more than EUR 336 million (about $380 million) between 2022 and 2025 for ransomware groups and other cybercriminal networks. Authorities linked the service to more than 15 international investigations involving ransomware and major cryptocurrency theft, describing AudiA6 as an industrial-scale laundering pipeline that relied on thousands of fraudulent exchange accounts, stolen or purchased identities, and more than 6,000 KYC records tied to money mule accounts.
The crackdown included coordinated arrests, searches, domain takedowns, server seizures, cryptocurrency freezes, and the seizure of vehicles, properties, and Telegram accounts across multiple jurisdictions. Investigators said the case advanced after Polish authorities arrested a Ukrainian suspect in September 2025, with forensic analysis leading to additional arrests in Georgia; the U.S. Department of Justice identified Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev as senior AudiA6 members now in Georgian custody. Europol also said the same suspects were tied to administration of the Dark2Web cybercrime forum, underscoring the role of specialized laundering services in sustaining the ransomware ecosystem.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
In September 2025, Polish authorities arrested a Ukrainian suspect tied to AudiA6. Forensic analysis of his devices helped investigators identify key operators later arrested in Georgia.
Authorities said the AudiA6 cryptocurrency laundering service processed more than EUR 336 million between 2022 and 2025 for ransomware groups and other cybercriminal networks. Investigators linked the service to over 15 international ransomware and major cryptocurrency theft investigations.
On 2026-06-10, the U.S. Department of Justice announced charges against Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev for allegedly operating the AudiA6 cryptocurrency laundering service. Prosecutors said the defendants were arrested in Georgia and face extradition to the Eastern District of Pennsylvania.
On 2026-06-10, coordinated law enforcement actions led to arrests, searches, domain takedowns, server seizures, cryptocurrency freezes, and asset seizures across multiple jurisdictions targeting AudiA6. Authorities also said suspects were linked to administration of the Dark2Web cybercrime forum.
In December 2025, TRM Labs said its on-chain analysis independently identified AudiA6 as a ransomware off-ramp. The firm traced about USD 7 million in funds stolen in the LastPass breach from Wasabi Wallet to the service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
14 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityonline.info
Open sourceinfosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourceeuropol.europa.eu
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourcepog.gov.ge
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Jun 29, 2026
The FBI, in collaboration with law enforcement agencies from Germany and Finland, dismantled the online infrastructure of E-Note, a cryptocurrency exchange allegedly used to launder over $70 million in proceeds from ransomware attacks and other cybercrimes. The U.S. Department of Justice announced the seizure of E-Note’s servers, mobile applications, and associated websites, as well as the unsealing of an indictment against Mykhalio Petrovich Chudnovets, a Russian national accused of operating the platform and facilitating money laundering for cybercriminal groups since at least 2010. Authorities also seized customer databases and transaction records, highlighting the scale and operational sophistication of the laundering network, which evolved from ad-hoc money mule arrangements to a streamlined online service. Prosecutors allege that E-Note played a significant role in enabling transnational cybercriminals, including those targeting healthcare and critical infrastructure, to move illicit funds quickly and covertly across borders. While Chudnovets has been charged with money laundering conspiracy, it remains unclear whether he is in U.S. custody, as he is believed to be in Russia. The takedown underscores ongoing international efforts to disrupt the financial infrastructure supporting ransomware and other cybercrime operations, and demonstrates the increasing focus on targeting the enablers of cybercriminal economies.
Jun 29, 2026
French and Ukrainian law enforcement, supported by Europol in **Operation Ratatouille**, dismantled **XSS.is**, a major Russian-language cybercrime forum, and arrested its alleged 38-year-old administrator in Kyiv. Authorities also seized the associated **`thesecure.biz`** Jabber server and other infrastructure used to support transactions among malware developers, exploit sellers, spammers, initial access brokers, and ransomware affiliates. Investigators said the forum had operated for nearly 20 years, amassed more than **50,000 members**, and generated more than **EUR 7 million** for the suspect through escrow services. The takedown hit what researchers described as a key trust and escrow layer in the cybercrime supply chain rather than a simple discussion board. Analysis of leaked XSS.is data and access telemetry indicated a predominantly Russian-speaking user base centered in the CIS region, with heavy activity around web vulnerabilities, malware, exploit kits, crypting, and sales of shells, databases, and RDP access. Although the forum briefly resurfaced on a new Tor address, trust reportedly collapsed after balances were wiped and moderators disappeared, while activity shifted to other forums including **RAMP** and **DarkForums**; investigators are now positioned to mine seized forum, database, and messaging data to correlate aliases, emails, IP addresses, and other identifiers across the underground ecosystem.
Jul 2, 2026