[Back to the takedown index](https://takedownindex.org/takedowns)

# Huione Group backend infrastructure seizure

June 2026, Cryptocurrency laundering
Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation)

Source linked. Verified August 21, 2026.

What was taken down?

Cloud-computing account and associated backend infrastructure seized.[[1]](#source-1)

[See what happened](#what-happened)

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not established

[See people and accountability](#people)

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

[See what happened afterward](#afterward)

## What happened

DOJ seized a cloud-computing account alleged to host backend infrastructure used by Huione Group subsidiaries to facilitate laundering of proceeds from cyber-scam operations.[[1]](#source-1)

**Date:** June 2026

**Target:** Huione Group money-laundering backend, cloud hosting backend

**Activity:** Cryptocurrency laundering

**Operational lead:** FBI

**Partners**

DOJ[[1]](#source-1)

- [United States Department of Justice](https://takedownindex.org/organizations/united-states-department-of-justice), prosecuting

**Jurisdiction:** Not established

**Outcome:** Cloud-computing account and associated backend infrastructure seized.

**Status:** Completed

**Legal mechanism:** US seizure warrant.

**Group accounted for:** Not established

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not established

The cited record does not say how large the group was or whether everyone involved has been identified.

[See the organizations and roles behind this action](https://takedownindex.org/takedowns/huione-group-backend-infrastructure-seizure/organizations)

## What happened afterward

Not established in the public record. No later activity is recorded against this entry.[[1]](#source-1)

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### What each part of this entry rests on

The audit recorded which sources carry which part of the record. These are those sources.

- Identity, dates and counts, [[1]](#source-1) [DOJ seizes cloud infrastructure behind Huione Group money-laundering backend](https://takedownindex.org/sources/us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back)
- Agencies and roles, [[1]](#source-1) [DOJ seizes cloud infrastructure behind Huione Group money-laundering backend](https://takedownindex.org/sources/us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back)

### Official sources

1.
[DOJ seizes cloud infrastructure behind Huione Group money-laundering backend](https://takedownindex.org/sources/us-doj-doj-seizes-cloud-infrastructure-behind-huione-group-money-laundering-back)

US DOJ, June 23, 2026, Source grade P1

Establishes the seizure of a Huione Group-linked cloud-computing backend account.

[Open source](https://www.justice.gov/opa/pr/justice-department-seizes-backend-infrastructure-used-huione-group-money-laundering-services)

Coverage note. Notable because the action targeted a cloud-hosting account rather than a conventional public-facing domain.

Research context

## How this entry was checked

Source linked

Every claim in this entry traces to a source the audit opened and read. Nothing on the record needed changing.

Verified: August 21, 2026

Sources cited: 1

Research cutoff: August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [GRU DNS-hijacking router network disruption (APT28)](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)
- [Aisuru/KimWolf/JackSkid/Mossad IoT DDoS botnet disruption](https://takedownindex.org/takedowns/aisuru-kimwolf-jackskid-mossad-iot-ddos-botnet-disruption)
- [SocksEscort proxy network disruption](https://takedownindex.org/takedowns/socksescort-proxy-network-disruption)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about/corrections-and-updates)