The service, known as ‘AudiA6’, was used by cybercriminals involved in ransomware attacks to cash out stolen digital assets and conceal the movement of illicit funds from authorities. The criminal group behind the website are also allegedly running a separate cybercrime forum known as ‘Dark2Web’, which acts as a marketplace used to advertise illicit services and connect cybercriminal actors worldwide.
Cybercriminals as customers of the service, would transfer stolen cryptocurrency to wallets controlled by the criminal group and, within around an hour, receive “cleaned” funds back through a complex chain of transactions designed to conceal the origin of the money. The operators charged commissions between 3% and 10%.
Actions on 10 June took place in Georgia, resulting in:
- Two alleged administrators were arrested in Georgia
- 3 properties were searched in Georgia
- 25 domains were taken down and more than 30 servers were seized
- Over 80 vehicles and multiple properties were seized in Georgia
- EUR 692 000 in cryptocurrency was frozen and over EUR 86 000 in cryptocurrency seized
International Judicial Cooperation
Eurojust supported the investigative authorities, the United States Secret Service (USSS) and IRS Criminal Investigation (IRS-CI) through its US Liaison Desk at the Agency as well as the Polish Central Cybercrime Bureau and the Regional Prosecutor’s Office in Łódź through the Polish National Desk. The Georgian Liaison desk worked with the Investigation Department of the Office of the Prosecutor General of Georgia to prepare for the action day on 10 June.
The actions also preceded by arrest of one of the co-perpetrators in Poland in September 2025. The detention of the suspects in Georgia took place on the basis of the red diffusion published by the Regional Prosecutor’s Office in Łódź as a result of its investigation conducted by the Polish Central Cybercrime Bureau.
Several coordination meetings were held at Eurojust in order to prepare the execution of judicial measures in France, Poland, Georgia and Iceland, with the support of the Polish and French National Desks at Eurojust, as well as Liaison Prosecutors from the U.S., Georgia, and Iceland. Due to the complex nature of the global investigation, Eurojust work proved valuable in helping authorities in a variety of ways, including with the issuance of Mutual Legal Assistance (MLA) requests in several jurisdictions.
Europol’s European Cybercrime Centre analysed the criminal money trail behind the laundering service. Europol’s cybercrime and cryptocurrency experts traced illicit crypto flows, helped map the laundering infrastructure used to move criminal profits across borders and supported European law enforcement authorities with intelligence development ahead of the final phase of the investigation.
Creation of fake accounts
Central to the money laundering service w thousands of fake accounts opened using stolen or purchased identities. Over 6,000 Know Your Customer (KYC) records linked to money mule accounts were identified during the investigation. Many of the mule accounts were connected to Russian-speaking intermediaries recruited specifically to help move criminal proceeds through cryptocurrency exchanges.
The group used both commercial email providers and email addresses linked to domains under their control to register money mule accounts with various cryptocurrency exchanges. The domains are being made public to help cryptocurrency exchanges identify and block accounts associated with this money laundering service.
- designli.pictures
- pheontx.eu
- smplfy.in
- sumato-soft.org
- technobrains.dev
- lett.email
- trayo.app
- deliverly.top
- inboxly.top
- postfast.eu
- postino.click
- inboxally.agency
- mailora.eu
- postify.email
- quix.express
- flowcomm.click
- qube.black
- deliverlett.com
- lettermail.eu
The authorities involved in the Eurojust coordination were:
- United States of America: U.S. Attorney’s Office for the Eastern District of Pennsylvania; United States Secret Service (USSS), IRS Criminal Investigation (IRS-CI), Federal Deposit Insurance Corporation Office of Inspector General (FDIC OIG), Homeland Security Investigations (HSI)
- France: Public Prosecutor’s Office Paris Cybercrime Unit; Gendarmerie National Cybercrime Unit
- Poland: Regional Prosecutor’s Office in Łódź, Branch in Łódź of the Central Cybercrime Bureau
- Georgia: Investigation Department of the Office of the Prosecutor General of Georgia
- Iceland: Director of Public Prosecutions; Reykjavík Metropolitan Police
Leave a comment