He has none and has been trying to depict Audacity as a Russian malware vector for over a year now, but without providing any source.

Technically it's been over 4 years