The service, known as ‘AudiA6’, was used by cyber criminals involved in ransomware attacks to cash in on stolen digital assets and hide the movement of illicit funds from authorities. The criminal group behind the website is also reportedly running a separate cybercrime forum known as ‘Dark2Web’, which acts as a marketplace used to advertise illegal services and connect cybercriminal actors around the world.
Cybercriminals, posing as customers of the service, would transfer the stolen cryptocurrencies to a wallet controlled by the criminal group and, within about an hour, receive the “cleaned” funds back through a complex series of transactions designed to hide the origin of the money. Operators charged commissions between 3% and 10%.
On June 10, action took place in Georgia, resulting in:
- Two alleged administrators arrested in Georgia
- 3 properties discovered in Georgia
- 25 domains were removed and more than 30 servers were seized
- More than 80 vehicles and several properties seized in Georgia
- EUR 692,000 in cryptocurrencies were seized and over EUR 86,000 in cryptocurrencies were seized
international judicial cooperation
Eurojust supported investigative authorities, the United States Secret Service (USS) and the IRS Criminal Investigation (IRS-CI) through its US Liaison Desk at the Agency, as well as the Polish Central Cybercrime Bureau and the Regional Prosecutor’s Office in Łódź through the Polish National Desk. The Georgian Contact Desk worked with the Investigations Department of the Prosecutor General’s Office of Georgia to prepare for the Day of Action on June 10.
The action was also preceded by the arrest of one of the co-offenders in Poland in September 2025. The detention of the suspects in Georgia resulted from an investigation conducted by the Polish Central Cybercrime Bureau on the basis of red diffusion published by the regional prosecutor’s office in Łódź.
In cooperation with the Polish and French national desks at Eurojust, as well as liaison prosecutors from the US, Georgia and Iceland, a number of coordination meetings were held at Eurojust to prepare for the execution of judicial measures in France, Poland, Georgia and Iceland. Due to the complex nature of global investigations, Eurojust’s work proved valuable in assisting authorities in a number of ways, including issuing mutual legal assistance (MLA) requests in several jurisdictions.
Europol’s European Cybercrime Center analyzed the criminal money trail behind the laundering service. Europol’s cybercrime and cryptocurrency experts trace illicit crypto flows, help map the laundering infrastructure used to move criminal profits across borders and support European law enforcement authorities with intelligence development ahead of the final stages of investigations.
creation of fake accounts
Thousands of fake accounts were opened using stolen or purchased identities at the center of the money laundering service. Over 6,000 Know Your Customer (KYC) records linked to Money Mule accounts were identified during the investigation. Many of the mule accounts were linked to Russian-speaking intermediaries who were specifically recruited to help move criminal proceeds through cryptocurrency exchanges.
The group used both commercial email providers and email addresses associated with domains they controlled to register Money Mule accounts with various cryptocurrency exchanges. The domain is being made public to help cryptocurrency exchanges identify and block accounts associated with this money laundering service.
- designli.pictures
- phenontx.eu
- smplfy.in
- sumato-soft.org
- technobrains.dev
- let.email
- trayo.app
- deliverly.top
- inboxly.top
- postfast.eu
- postino.click
- inboxally.agency
- mailora.eu
- postify.email
- quix.express
- flowcom.click
- cube.black
- delivelett.com
- lettermail.eu
The officials involved in Eurojust coordination were:
- United States of America: U.S. Attorney’s Office for the Eastern District of Pennsylvania; United States Secret Service (USS), IRS Criminal Investigation (IRS-CI), Federal Deposit Insurance Corporation Office of Inspector General (FDIC OIG), Homeland Security Investigations (HSI)
- France: Public Prosecutor’s Office Paris Cyber Crime Unit; Gendarmerie National Cyber Crime Unit
- poland: Regional Prosecutor’s Office in Lodz, branch of the Central Cybercrime Bureau in Lodz
- Georgia: Investigation Department of the Prosecutor General’s Office of Georgia
- iceland: Director of Public Prosecutions; Reykjavik Metropolitan Police
<a href=