The Australian Federal Police (AFP) has assisted in a major international operation that dismantled an alleged offshore money-laundering network accused of washing more than $542 million for cybercriminals, including a ransomware group linked to an attack on an Australian business.
The operation, led by Europol, targeted a money-laundering service known as AudiA6, which investigators allege helped cybercriminals convert illicit cryptocurrency proceeds into traditional currencies while charging commissions of between three and 10 per cent.
AFP involvement began in November 2025 after investigators identified activity linked to two foreign administrators allegedly operating the service from Georgia.
AFP Cybercrime Commander Graeme Marshall said the investigation demonstrated the importance of international cooperation in combating cybercrime.
“The AFP and our partners have the same goal – to disrupt cybercrime activity and hold alleged offenders to account.”
Commander Marshall said, “The strong relationship between our law enforcement partners is critical to achieving this goal. The work of our investigators and analysts in this operation was valuable to our international partners, and I’m proud of their efforts that contributed to this outcome in Europe.
“Cybercriminals are active around the world, and we will always work together to disrupt their illegal activity.”
Authorities allege AudiA6 laundered more than $542 million between 2022 and 2025 and was actively promoted on the cybercrime forum Dark2Web. Investigators also believe the service processed part of a ransom payment made by an Australian business that was targeted in a ransomware attack in 2024.
In that incident, cybercriminals allegedly infiltrated the company’s systems and demanded payment in exchange for not publishing stolen data online. The Australian investigation remains ongoing.
Europol cybercrime and cryptocurrency specialists, supported by AFP investigators and analysts, traced illicit cryptocurrency flows and mapped the network’s infrastructure used to move criminal proceeds across multiple jurisdictions.
Enforcement action was carried out on 10 June 2026, resulting in the arrest of two men in Georgia. Authorities searched three properties, seized more than 30 servers, and took down 25 domains linked to the operation.
Investigators also froze approximately $1.1 million in cryptocurrency assets and seized a further $141,000 in cryptocurrency.
Websites associated with AudiA6 and Dark2Web on both the clear web and dark web were replaced with law enforcement seizure notices as part of the operation.
Law enforcement agencies in France, Germany, Iceland and the United States also seized servers and domains linked to the alleged criminal infrastructure.
The multinational operation involved agencies from Canada, France, Georgia, Germany, Iceland, Japan, Poland, Switzerland, the United Kingdom, the United States and Australia.
Support our Journalism
No-nonsense journalism. No paywalls. Whether you’re in Australia, the UK, Canada, the USA, or India, you can support The Australia Today by taking a paid subscription via Patreon or donating via PayPal — and help keep honest, fearless journalism alive.
