Cybercrime
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.
By
|
October 12, 2026 (7:24 AM ET)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/) [+ Whatsapp](whatsapp://send?text=Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/) + Email
A dual citizen of Ukraine and Russia pleaded guilty in a US court for his role in a sophisticated money laundering organization used by cybercriminals.
The individual, Oleg Korniev, 42, was a leader of Your Mule Cashout (YMCO), an international network of money mules and internet infrastructure that allowed hackers to transfer funds outside the US.
According to court documents, YMCO allowed cybercriminals to conceal the theft of money from the bank accounts of US companies and transfer it abroad, primarily to Eastern European countries.
In exchange for the money laundering services, the cybercriminals paid YMCO a percentage of the stolen funds.
YMCO is estimated to have recruited more than 15,000 US residents as money mules, and to have laundered at least $10 million stolen from over 750 US bank accounts.
The organization deceived the money mules into believing they were making genuine transfers for legitimate companies.
Advertisement. Scroll to continue reading.
It falsely claimed that the individuals would receive transfers from businesses to their personal accounts and that their job was to withdraw the money and wire it to overseas accounts.
Instead, the money mules withdrew stolen proceeds and wired them to YMCO conspirators out of the country, and never received payment for these services.
The court documents allege that Korniev helped create policies and procedures within YMCO, that he hired and managed employees, and rewarded or punished them based on performance. He also secured illegal services that supported YMCO’s operations.
Korniev admitted in court to causing over $14.7 million in actual and intended losses, and to laundering at least $7 million from cybercriminals. He agreed to provide full restitution to known victims, and to forfeit cash seized upon his arrest in the Republic of Georgia.
He pleaded guilty to money laundering, computer fraud, access device theft, and aggravated identity theft charges, and faces between 2 and 50 years in prison.
Four other members of YMCO were previously arrested abroad and extradited to the US. They pleaded guilty, received sentences of 37 to 63 months in prison, and were ordered to pay over $9.1 million in restitution each.
Related: Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Related: Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Related: Qilin Ransomware Suspect Arrested in Japan, Extradited to Germany
Related: FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware
Written By
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
- Google Domains Impacted by Recent ccTLD Hijacks
- Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
- US Disrupts Chinese State-Sponsored Hacking Tools
- Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
- Cisco Patches a Dozen Critical Vulnerabilities
- SonicWall and Splunk Patch Critical Vulnerabilities
- Rein Security Raises $25 Million to Guard AI Agents at Runtime
- Fake Decryption Tools Masked $11M Markup in Ransomware Recovery Scheme
Latest News
- IonQ to Acquire Zero Trust Firm Elisity for Up to $1.3 Billion
- Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
- Canonical Websites Disrupted in Second DDoS Attack This Year
- iRhythm Data Breach Impacts at Least 360,000 People
- Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
- Critical SonicWall Vulnerability Exploited Days After Disclosure
- Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
- Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
Trending
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Critical SonicWall Vulnerability Exploited Days After Disclosure
Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
iRhythm Data Breach Impacts at Least 360,000 People
Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US
Security Awareness Training Isn’t Dead, but It Needs a Rethink
Canonical Websites Disrupted in Second DDoS Attack This Year
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?
October 14, 2026
Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.
## Virtual Event: Zero Trust & Identity Strategies Summit 2026
October 14, 2026
Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
People on the Move
Rapid7 has named Rik Ferguson as VP of Security Intelligence.
Cytactic has appointed Tim Brown as CSO.
Scott Simkin has joined Vega as CMO.
Expert Insights
## AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)
## Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)
## Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)
## “We Think the Security Control Is Working” Is No Longer Good Enough
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)
## This Key Will Self-Destruct: An Open Standard for Revocable API Keys
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)
- + Flipboard + Reddit [+ Whatsapp](https://web.whatsapp.com/send?text=Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/) [+ Whatsapp](whatsapp://send?text=Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US https://www.securityweek.com/mastermind-of-15000-mule-cybercrime-laundering-network-pleads-guilty-in-us/) + Email
Popular Topics
Security Community
- Virtual Cybersecurity Events
- Webcast Library
- CISO Forum
- AI Risk Summit
- ICS Cybersecurity Conference
- Cybersecurity Newsletters
Stay Intouch
About SecurityWeek
News Tips
Got a confidential news tip? We want to hear from you.
Advertising
Reach a large audience of enterprise cybersecurity professionals
Daily Briefing Newsletter
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.