DOJ/Europol Dismantle AudiA6 Crypto Laundering Network That Washed $389M for Ransomware Gangs; Dark2Web Forum Also Seized

A coordinated June 10 operation by DOJ, USSS, IRS-CI, Europol, and 11 partner nations dismantled AudiA6, an industrial-scale cryptocurrency laundering service that processed over 10,333 BTC (~$389M) since 2021 by routing funds through 6,000+ fraudulent KYC-verified exchange accounts — a primary cashout rail for ransomware operators. Two administrators, Ukrainian national Ruslan Tkachuk (37) and Russian national Alexander Ledenev (25), were arrested in Batumi, Georgia; authorities seized 25 domains, 30+ servers, and 80+ vehicles, and also took down the Dark2Web cybercrime forum linked to the same operators. The takedown severs a critical financial pipeline for ransomware affiliates and is linked to funds from at least 15 ransomware campaigns, including laundering proceeds from the 2022 LastPass breach.

The takedown severs a critical financial pipeline for ransomware affiliates and is linked to funds from at least 15 ransomware campaigns, including laundering proceeds from the 2022 LastPass breach.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.