Loading story…
Oleg Korniev, a 42-year-old Ukrainian-Russian dual citizen, pleaded guilty to money laundering, identity theft and computer fraud offenses tied to his operation of Your Mule Cashout (YMCO). The international organization recruited more than 15,000 U.S.-based money mules through fake employment offers and laundered at least $10 million stolen by cybercriminals from more than 750 U.S. bank accounts. The mules transferred proceeds to overseas cash-out contractors, primarily in Eastern Europe.
Korniev admitted personally laundering at least $7 million and acknowledged that YMCO caused more than $14.7 million in actual and intended losses to confirmed victims. He agreed to full restitution for known victims and forfeiture of seized cash. Sentencing is pending, with a minimum prison penalty of two years and a maximum of 50 years. The case highlights how fraudulent recruitment and domestic mule accounts enable cybercriminals to move stolen funds across borders.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
The U.S. federal court case against Serghei Ivanovich Tomuz, a Moldovan national accused of managing YMCO’s cash-out team in Moldova, was terminated. Tomuz had reportedly been arrested at a Romanian border crossing in May 2022 and contested extradition to the United States.
Your Mule Cashout (YMCO) began operating in September 2007. The organization recruited more than 15,000 U.S. money mules through fake employment offers and laundered at least $10 million stolen from more than 750 U.S. bank accounts.
Korniev pleaded guilty to money laundering, aggravated identity theft, and conspiracy offenses involving money laundering, computer fraud, and access device theft, admitting that he personally laundered at least $7 million and that YMCO caused more than $14.7 million in actual and intended losses. He agreed to full restitution for known victims' actual losses and forfeiture of the cash seized during his arrest.
YMCO leader Oleg Korniev was arrested in the Republic of Georgia, where authorities seized cash from him.
The four convicted participants received prison sentences ranging from approximately 37 to 63 months. Each was ordered to pay more than $9.1 million in restitution to U.S. victims.
The four extradited YMCO participants pleaded guilty to conspiracy to commit money laundering.
Authorities arrested four YMCO participants overseas and extradited them to the Western District of North Carolina to face prosecution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcebleepingcomputer.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The US Department of Justice announced multiple guilty pleas from US citizens and a Ukrainian national for their roles in facilitating North Korean IT workers' fraudulent employment at US companies and laundering millions in illicit proceeds. The scheme involved US nationals providing their identities, hosting company laptops, and even taking drug tests on behalf of North Korean operatives, enabling them to bypass vetting processes and earn over $2 million in salaries. Ukrainian national Oleksandr Didenko also pleaded guilty to wire fraud and identity theft, having stolen and sold US citizen identities to North Korean IT workers, and operated a site that managed hundreds of stolen identities and coordinated laptop farms across several US states. Authorities seized more than $15 million in cryptocurrency linked to North Korean facilitators, and Didenko agreed to forfeit over $1.4 million. The Justice Department highlighted these convictions and asset seizures as significant progress in disrupting North Korea's use of remote IT work and cryptocurrency theft to fund its regime. The cases underscore the complexity and international reach of North Korea's cyber-enabled financial schemes, as well as the ongoing efforts by US law enforcement to identify and prosecute both domestic and foreign enablers.
Aug 26, 2026
Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a `RICO` conspiracy tied to a cybercriminal network that stole roughly **$230 million to $260 million** in cryptocurrency from victims. Prosecutors said Tangeman laundered at least **$3.5 million** between October 2023 and May 2025 for the group, which allegedly stole more than **4,100 Bitcoin** from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases. Authorities said the organization, identified by law enforcement as the **Social Engineering Enterprise**, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including **AnyDesk** to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, **Kunal Mehta**, has also pleaded guilty and is awaiting sentencing.
Jun 29, 2026
Aleksei Olegovich Volkov, a Russian national, pleaded guilty in the United States to charges related to his role as an initial access broker (IAB) for the Yanluowang ransomware group. Volkov provided access to at least seven U.S. organizations between July 2021 and November 2022, enabling the deployment of ransomware that resulted in ransom demands ranging from $300,000 to $15 million. He received a percentage of the ransom payments, including $94,259 from a $500,000 ransom and $162,220 from a $1 million ransom, and was ordered to pay nearly $9.2 million in restitution to affected organizations. Volkov's activities were uncovered through digital forensics, including chat logs, cryptocurrency records, and social media accounts, and he was extradited to the U.S. after being apprehended in Rome. The indictment and plea agreement detail Volkov's collaboration with co-conspirators, his use of aliases such as "chubaka.kor," and his involvement in negotiating ransom payments and providing network credentials to the Yanluowang group. The attacks affected a range of U.S. businesses, including engineering firms, banks, and telecommunications providers, with some victims able to restore from backups and avoid ransom payments. Volkov faces up to 53 years in prison for charges including access device fraud, aggravated identity theft, and conspiracy to commit money laundering and computer fraud.
Jun 29, 2026