A Ukrainian-Russian dual citizen has pleaded guilty in the United States to helping run an international money-laundering network that recruited more than 15,000 people as money mules for cybercriminals.
Oleg Korniev, 42, admitted that the organisation, known as Your Mule Cashout or YMCO, helped hackers move stolen money from US victims to Eastern Europe.
US prosecutors say the network handled at least $10 million stolen from more than 750 US bank accounts at over 35 financial institutions.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Fake Jobs Recruited Thousands of Money Mules
YMCO allegedly recruited US residents through spam emails and fake companies.
The victims were made to believe they were applying for legitimate jobs processing payments for businesses.
After being “hired”, they were instructed to receive money into their own bank accounts, withdraw it and send it overseas through services such as Western Union and MoneyGram.
In reality, prosecutors say the funds had been stolen by cybercriminals. The money was then sent to cash-out contractors in countries including Moldova, Ukraine, Russia and Latvia.
The mules themselves were allegedly never paid for the work they believed they were performing.
Korniev Admits Laundering at Least $7 Million
As part of his guilty plea, Korniev admitted that he intended to launder more than $9.7 million received from cybercriminals and actually laundered at least $7 million.
He also admitted that YMCO was responsible for more than $14.7 million in actual and intended losses to confirmed victims.
Korniev agreed to pay restitution to known victims and forfeit cash seized when he was arrested in Georgia.
The broader organisation had operated since at least September 2007, showing how long the laundering infrastructure remained active.
Korniev Helped Run the Organisation
Prosecutors say Korniev was not simply a mule or low-level intermediary.
He helped develop YMCO’s policies and procedures, managed employees, hired and fired staff, rewarded or punished workers based on performance and obtained illegal services needed to keep the operation running.
That makes the case significant because law enforcement is targeting the financial infrastructure that allows cybercrime to function rather than only the hackers who carry out the initial theft.
Cybercriminals can steal money remotely, but they still need accounts, people and payment channels to move it without immediately exposing themselves.
Network Worked Across Several Countries
BleepingComputer reported that YMCO also operated similar schemes in Germany, Italy, the United Kingdom and Australia.
The organisation offered laundering services to cybercriminals in exchange for a percentage of the stolen money.
By using ordinary bank accounts belonging to apparently legitimate individuals, the network could make transfers look less suspicious before the funds were moved abroad.
This layered structure is a common feature of international cybercrime.
Four Other Members Were Convicted Earlier
Korniev is not the first YMCO member to face prosecution.
Four other people linked to the organisation were previously arrested overseas, extradited to the Western District of North Carolina and pleaded guilty to conspiracy to commit money laundering.
They received prison sentences ranging from about 37 months to 63 months.
Each was also ordered to pay more than $9.1 million in restitution to US victims.
The Korniev case shows that investigators continued pursuing the organisation years after those earlier arrests.
He Faces Up to 50 Years in Prison
Korniev pleaded guilty to conspiracy to commit money laundering, money laundering, conspiracy to commit computer fraud, conspiracy to commit access-device theft and aggravated identity theft.
He faces a mandatory minimum of two years in prison and a maximum possible sentence of 50 years.
A sentencing date has not yet been announced.
The final sentence will be decided by a federal judge after considering US sentencing guidelines and other factors.
What this means for you
Money-mule recruitment often looks like an ordinary work-from-home job involving payment processing or money transfers. If an employer asks you to receive money in your personal bank account and forward it elsewhere, especially overseas, that is a major warning sign that your account may be used to launder stolen funds.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
