Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network

Chainalysis

Global Law Enforcement Dismantles AudiA6 Crypto Laundering Network

First seen 11 Jun 2026, 20:35 UTC • •72.7

Article Content

1 / 21

Browse articles

ThreatCluster •June 12, 2026 at 20:10 UTC

•AudiA6 laundered over $389 million for cybercriminals between 2022 and 2025.
•Two administrators were arrested in Georgia, facing extradition to the U.S. for money laundering.
•The operation involved multiple international law enforcement agencies and resulted in significant asset seizures.

On June 11, 2026, international law enforcement agencies, including the U.S. Secret Service and Europol, announced the dismantling of the AudiA6 cryptocurrency laundering network, which laundered over $389 million from 2022 to 2025. The operation led to the arrest of two key administrators, Ruslan Tkachuk and Alexander Ledenev, in Georgia. AudiA6 was linked to ransomware attacks and operated alongside the Dark2Web forum, facilitating connections among cybercriminals. Authorities seized numerous assets, including 173 vehicles and significant amounts of cryptocurrency. The operation was supported by intelligence sharing and blockchain analysis, marking a significant blow to cybercrime financing. The network's infrastructure was disrupted, with seizure notices placed on its websites.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 144d ago How this analysis works

Timeline

2022-01-01

AudiA6 begins operations

The AudiA6 network starts providing laundering services for cybercriminals, facilitating illicit cryptocurrency transactions.

2025-09-01

Arrest of key suspect in Poland

A Ukrainian national linked to AudiA6 was arrested in Poland, providing crucial leads for the investigation.

Bleepingcomputer

2026-06-10

Arrests made in Georgia

Two senior members of AudiA6 were arrested in Adjara, Georgia, as part of a coordinated international operation.

2026-06-11

Global operation announced

Law enforcement agencies publicly announced the dismantling of AudiA6 and its infrastructure, detailing the scale of the operation.

2026-06-12

Details of the operation released

Further details about the operation, including asset seizures and the extent of laundering activities, were disclosed by various sources.

More articles in this cluster (20)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Ransomware

Organization (1)

AudiA6

Indicator (2)

deliverly.top
inboxly.top

Affected Platform (2)

Dark2Web
Telegram

Relationships

Ransomware targets Dark2Web
Ransomware targets Telegram
Ransomware related to AudiA6
Ransomware related to deliverly.top
Ransomware related to inboxly.top

Following this threat?

Track AudiA6 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to…

Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects…