From Fake Job Offers to a Guilty Plea: A Timeline of the 15,000-Mule Network That Laundered Cybercrime Cash
A leader of the Your Mule Cashout laundering operation has pleaded guilty in the U.S. Here is how the scheme recruited mules through fake job ads and moved stolen money overseas, step by step.
When criminals empty a business bank account, they still need a way to turn the stolen balance into money they can spend. Starting in 2007, a group called Your Mule Cashout (YMCO) sold that service. One of its leaders has now admitted his role in a U.S. court.
How the case unfolded
September 2007: The operation begins
YMCO starts up as a laundering service for cybercriminals. Over time it uses more than 15,000 money mules living in the United States.
The recruiting pipeline
According to court documents, YMCO sent spam emails from fake companies. Recruits went through what looked like a normal hiring process and were told they would be processing payments for legitimate businesses.
The money trail
Cybercriminals deposited stolen funds into the mules’ bank accounts. The mules allegedly wired the money through Western Union and MoneyGram to “cash-out contractors” in Moldova, Ukraine, Russia or Latvia. Prosecutors say YMCO also ran similar schemes in Germany, Italy, the United Kingdom and Australia, and processed more than $10 million taken from over 750 U.S. accounts at more than 35 banks.
More than a decade ago: Four arrests
Four other people tied to YMCO were arrested abroad, extradited to the Western District of North Carolina and pleaded guilty to conspiracy to commit money laundering. They received sentences of 37 to 63 months, and each was ordered to pay more than $9.1 million in restitution to U.S. victims.
Thursday, October 8, 2026: The plea
Oleg Korniev, 42, a Ukrainian-Russian dual citizen, pleaded guilty to money laundering, aggravated identity theft, and conspiracies to commit money laundering, computer fraud and access device theft. He was one of YMCO’s leaders, hiring, firing, rewarding and punishing workers and helping shape how the operation ran. He admitted the scheme caused more than $14.7 million in actual and intended losses to confirmed victims and that he laundered at least $7 million of the $9.7 million it received from cybercriminals.
What comes next
Korniev faces at least two years and up to 50 years in prison.
Sergiu Gatlan reported the plea and the scheme’s history for BleepingComputer, including the Justice Department’s comment that it will pursue mules and their recruiters wherever they operate and however long it takes.
What this means for your company
Money mules are the reason stolen business funds can disappear within hours. That makes speed the most important part of your response if a fraudulent transfer goes out.
- Know your bank’s fraud line and have it written down where your finance staff can find it. The faster a bank hears about a bad transfer, the better the odds of a recall.
- Use dual approval and positive pay for outgoing payments, and verify any new or changed payee by calling a number you already have.
- Protect banking logins with phishing-resistant multifactor authentication, and keep online banking on a dedicated, well-patched device if you can.
- Warn your hiring managers and staff about “payment processing” jobs. Mule recruiters target ordinary people, and an employee who takes one on can drag your business into a fraud investigation.
Need help tightening payment controls or locking down the accounts your finance team relies on? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
