Europol/DOJ Dismantle AudiA6 Crypto-Laundering Service — €336M Processed for Ransomware Gangs Since 2021, Two Arrested in Georgia

An 11-country coalition executed coordinated takedowns on June 10, seizing 25 domains, 30+ servers, and over 80 vehicles, while arresting two suspected administrators (Ukrainian and Russian nationals) in Georgia for operating AudiA6, a mixer-as-a-service that laundered more than €336M in ransomware and cybercrime proceeds via 6,000+ KYC-verified money mule accounts at legitimate exchanges. The operators also ran Dark2Web, a darknet cybercrime forum used to connect ransomware affiliates with buyers of illicit services; Europol linked AudiA6 to more than 15 active international ransomware investigations. The U.S. DOJ charged both individuals with conspiracy to launder monetary instruments, each facing up to 20 years in prison.

DOJ charged both individuals with conspiracy to launder monetary instruments, each facing up to 20 years in prison.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.