MalwarePublished 11 Jun 2026

Authorities dismantle 'AudiA6' ransomware crypto-laundering service

Source Bleeping Computer

Description

Law enforcement has dismantled the “AudiA6” cryptocurrency service allegedly used by ransomware actors and other cybercriminals to launder more than $380 million. [...]

Impact

The AudiA6 service enabled cybercriminals, including ransomware operators, to launder over $380 million in cryptocurrency, facilitating the monetization of illicit proceeds and complicating law enforcement efforts to trace and recover stolen funds. The platform's operation supported multiple ransomware campaigns and other cybercrime activities worldwide, contributing to the persistence and profitability of these threats. The takedown disrupts a major laundering infrastructure, potentially hindering ongoing and future ransomware operations that relied on AudiA6 for money laundering.

Defensive guidance

This threat has been mitigated by law enforcement through the dismantling of the AudiA6 service, arrests of key operators, seizure of domains and assets, and freezing of cryptocurrency funds. No direct patch or remediation is applicable as this is a criminal infrastructure takedown rather than a software vulnerability. Cryptocurrency exchanges and platforms are advised to block accounts linked to the fraudulent KYC records identified in the investigation to prevent further abuse. Monitoring and blocking of related domains and Telegram accounts used by the network are also recommended.

Summary

AudiA6 was a professional cryptocurrency mixing service exploited by ransomware groups and other cybercriminals to launder proceeds from illicit activities, including ransomware attacks and large-scale cryptocurrency theft. The service obscured the origin of funds by routing them through complex transaction paths and returned cleaned cryptocurrency to users. Investigations revealed an industrial-scale operation with thousands of fraudulent exchange accounts created using stolen or purchased identities, many linked to Russian-speaking intermediaries recruiting money mules. The disruption of AudiA6 involved arrests of two administrators, seizure of domains and assets, and freezing of cryptocurrency funds. The platform was connected to more than 15 international ransomware investigations and facilitated laundering of approximately 10,333 bitcoins, including nearly 400 BTC from darknet markets and ransomware groups.

References

bleepingcomputer.com/news/legal/authorities-dismantle-audia6-ransomware-crypto-laundering-service/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Jun 2026, 16:00 UTC

References

Community reviews

Related threats