FBI takes down alleged money laundering service for ransomware groups

The FBI and international partners in Germany and Finland took down the online infrastructure of a cryptocurrency exchange that allegedly laundered funds for transnational cybercriminal groups, the Justice Department said Wednesday. 

According to a DOJ announcement, the exchange E-Note was used to process funds stolen by criminals in cyberattacks on healthcare entities and critical infrastructure, among other targets. Its payment service and money mule network processed more than $70 million connected to ransomware attacks since 2017, they alleged. 

The DOJ also unsealed an indictment in the Eastern District of Michigan against Mykhalio Petrovich Chudnovets, a 39-year-old Russian national who allegedly operated E-Note and faces a money laundering charge that carries up to 20 years in prison. Chudnovets has laundered money for cybercriminals since 2010, court documents allege.  

Law enforcement seized servers, mobile applications, and three websites — “e-note.com,” “e-note.ws,” and “jabb.mn” — linked to the operation. Police also seized Chudnovets’ customer databases and transaction records, the DOJ said. 

The Michigan State Police, German Federal Criminal Police Office and the Finnish National Bureau of Investigation also participated in the investigation. 

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

James Reddick

James Reddick

has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.

 

Total
0
Shares
Previous Post

FTC orders crypto platform Nomad to distribute $37.5 million after 2022 theft

Next Post

Millions impacted by PornHub, SoundCloud data breaches

Related Posts

Unpatched Gogs Zero-Day Exploited Across 700+ Instances Amid Active Attacks

A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in the
Read More

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 (CVSS score: 9.1), allows an attacker to bypass authentication and access the configuration pages, resulting in the upload and execution of arbitrary payloads.  The
Read More

CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw impacting Digiever DS-2105 Pro network video recorders (NVRs) to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2023-52163 (CVSS score: 8.8), relates to a case of command injection that allows post-authentication remote code
Read More