SECTION 1: WHAT IT IS

Definition and Ecosystem Role

Mule networks are the fiat layering and integration layer of the ransomware supply chain. They operate downstream of the crypto cash-out point — receiving fiat proceeds from exchanges, OTC brokers, or high-risk VASPs and dispersing them across networks of individual mule accounts and shell company structures to obscure origin and create the transactional distance required for integration into the legitimate economy. Node 09 is a Phase C node in the EDP Disruption Playbook, alongside Nodes 05 (Loaders) and 06 (Leak Sites). It represents the terminal stage of the ransomware monetization chain: the point at which criminal proceeds become usable criminal wealth.

Mule networks serve a specialized function that cyber crews are both unable and unwilling to perform in-house. Professional mule operators maintain standing inventories of accounts across multiple banks and jurisdictions, expertise in local AML thresholds and transaction monitoring triggers, and established relationships with integration-stage asset acquisition networks. TRM Labs documents that ransomware and other cybercrime groups outsource the layering and integration function to specialist networks precisely to minimize their direct exposure to banking KYC — maintaining their focus on intrusion and extortion while delegating the financially complex and compliance-exposed downstream work.

The defining operational characteristic of mule networks is velocity. UK research based on 2024 bank data found that over 50% of funds left identified mule accounts within one hour of arrival; in many cases, funds moved within 15 minutes. This speed is the core of the layering function: real-time payment rails (Faster Payments, instant P2P apps) allow criminal proceeds to clear multiple account layers before any transaction monitoring flag can produce an investigative response.

The Three Stages: Placement, Layering, Integration

Placement: Criminal proceeds enter the banking system from the crypto cash-out layer (OTC broker or exchange). This typically occurs via wire transfer from a high-risk VASP or shell company account to initial mule accounts. Placement is the highest-risk stage for detection — it represents the first point of contact between the illicit crypto proceeds and the regulated banking system.

Layering: Sequential electronic transfers disperse placed funds across multiple mule accounts, shell company accounts, and jurisdictions. Common layering methods include: rapid serial transfers between personal and business accounts (smurfing across mule networks); cross-border wires via correspondent banks for round-amount sham invoices or consulting fees; purchasing financial instruments or re-entry into virtual asset ecosystems to add additional transactional layers; and circular payments between controlled entities. The UK data showing >50% of funds leaving within one hour represents the layering stage in operation.

Integration: Layered funds re-enter the legitimate economy via asset acquisition (real estate, vehicles, luxury goods), business acquisition, or pseudo-legitimate income streams (dividends from front companies, loans from criminal-controlled lenders, fake revenue from service businesses). Integration is the lowest-risk stage for detection: by the time funds reach integration, the transactional trail is typically too diffuse and cross-jurisdictional for standard financial intelligence tools to reconstruct.

Scale and Structural Context

CONFIRMED BioCatch reported nearly 2 million money-laundering accounts flagged by 257 financial institutions across 21 countries in 2024. This figure represents the supply side of the mule account ecosystem — the standing inventory of controlled accounts available for layering operations at any given time. This scale makes individual-account-level disruption operationally infeasible; effective disruption must target the herder and professional crew tier rather than individual mules.

ANALYST INFERENCE The same mule networks that service ransomware cash-out also service fraud, business email compromise, romance scam proceeds, carding, and other cybercrime verticals. This cross-vertical function creates an important disruption multiplier: mule network disruption degrades the post-cash-out infrastructure for the entire cybercrime ecosystem, not just ransomware. This cross-cutting effect should be a primary argument for prioritizing mule network disruption in interagency resource allocation discussions.

SECTION 2: KEY ACTORS AND EXAMPLES

Archetypes and Named Examples

Velocity and Channel Data: UK Mule Network Study

The most granular available dataset on mule network operational behavior comes from 2024 UK banking data analyzed in Outseer/RUSI-based research. The dataset covers £7.2M moved from identified mule accounts over a two-month window.

Recruitment Ecosystem

CONFIRMED KPMG's "Money Mules: FinCrime's Trojan Horse" documents multi-stage recruitment funnels: social media and messaging app advertising drives prospects to handlers, who then provide scripts specifying how and when to move funds. Mules are told they are processing legitimate payments, working as "financial agents," or acting as "payment processors" for foreign companies. Commission rates of 5-10% of moved funds are standard.

CONFIRMED Group-IB's UNC2891 case documented threat actors placing Google ads and Telegram posts to recruit mules specifically for ATM cash-out operations, illustrating the cross-over between cyber operations and physical cash extraction networks. The use of legitimate advertising platforms (Google Ads) for mule recruitment represents an ongoing platform-governance challenge with direct implications for mule network scaling capacity.

CREDIBLE Herder-level operators in structured networks may simultaneously supply mule accounts to multiple cybercrime verticals — ransomware, fraud, business email compromise, carding, romance scam proceeds. This cross-vertical function makes herder disruption more strategically valuable than its ransomware-specific revenue contribution alone would suggest.

SECTION 3: INFRASTRUCTURE DEPENDENCIES

Upstream Dependencies

OTC brokers (Node 01 / Module 12): OTC broker fiat payouts are the primary upstream input to mule networks for high-value ransomware proceeds. After conversion from cryptocurrency, OTC desks initiate wires to mule account clusters directly or via shell company intermediaries. OTC disruption reduces the volume and "cleanliness" of fiat entering mule network pipelines.

Exchanges and money launderers (Node 02 / Module 13): High-risk exchange fiat withdrawals and wire transfers from money laundering networks also feed mule accounts. Exchange off-ramp compliance improvements reduce the volume reaching mule networks via this pathway.

Shell company infrastructure: Mule networks depend on shell company accounts as both receiving entities (placement-stage wires from OTC/exchange arrive at shell company accounts before dispersal to individual mules) and integration vehicles. Shell company formation services are a separate criminal supply chain not currently represented as a dedicated EDP node.

Real-time payment rails (Faster Payments, RTP, SEPA Instant): Mule networks' velocity advantage depends entirely on the availability of real-time payment rails that provide irrevocable, instant settlement. These are regulated infrastructure — engaging payment network operators and their member banks on real-time mule detection is a structural intervention point.

Downstream Dependencies

Real estate sector: Integration via property purchase is the highest-value single integration channel. Real estate provides durable asset storage, legitimate income streams (rental), and resale liquidity. Beneficial ownership registries, enhanced due diligence on cash purchases, and anti-money-laundering requirements for real estate agents are the primary regulatory chokepoints.

Business front companies: Front businesses (bars, logistics companies, retail outlets) generate pseudo-legitimate revenue streams that integrate criminal proceeds as normal trading income. These entities are harder to identify than real estate purchases and require transaction monitoring across the business banking sector.

Luxury goods and financial instruments: High-value moveable assets (vehicles, jewelry, art, precious metals) and financial instruments (insurance policies, investment accounts) provide liquid integration vehicles. Regulatory requirements for luxury goods dealers and high-value asset sellers vary significantly across jurisdictions — creating exploitation opportunities in lower-regulation markets.

Critical Chokepoints

Cross-Module Linkages

SECTION 4: DISRUPTION LEVERAGE POINTS

Primary Leverage Points

Compounding Actions

• Phase A and B financial actions (Nodes 01, 02, 08) compound mule network disruption by reducing the volume and quality of fiat entering the mule pipeline. Fewer OTC-converted funds and tighter exchange compliance means fewer high-value flows for herder networks to process — degrading their revenue and making the criminal business case for maintaining large account inventories weaker.
• Liability framework reform is the highest structural leverage point for real-time rail disruption. Reimbursement liability frameworks — which require banks to compensate mule-facilitated fraud victims unless they can demonstrate adequate fraud controls — create a direct financial incentive for bank investment in real-time mule detection. The UK's Authorised Push Payment (APP) fraud reimbursement framework is the leading model.
• Network-level SAR analysis produces dramatically higher-quality intelligence than individual account-level reporting. Financial intelligence units that can analyze SAR data across multiple institutions simultaneously identify herder-level coordination patterns invisible in single-institution reporting — the key to targeting herders rather than individual mules.
• Cross-vertical disruption effect: any herder network prosecution that disrupts a major structured mule network degrades cash-out capacity for fraud, BEC, carding, and romance scam verticals simultaneously — multiplying the operational disruption value beyond the ransomware-specific calculation.
• Coordinate integration-stage controls with FVEY financial regulators: beneficial ownership registry requirements and enhanced due diligence for real estate and luxury goods transactions are the primary tool for preventing completion of the laundering cycle. These regulatory actions do not require LE cooperation with Russia and are therefore not constrained by the Russian state protection framework.

SECTION 5: RESILIENCE AND REPLACE DIFFICULTY

Replace Difficulty Assessment

Node 09 carries a MEDIUM replace difficulty rating in the EDP Dependency Map — reflecting a genuine internal split between the highly replaceable retail mule tier and the moderately difficult-to-replace herder and professional crew tiers. The key driver of the MEDIUM aggregate rating is account supply: nearly 2 million mule accounts were active in 2024 (BioCatch), providing enormous redundancy at the individual account level. Individual mule arrests and account freezes do not meaningfully reduce network capacity because the recruitment pipeline continuously replenishes the account supply.

Herder-tier and professional laundering crew disruption is more durable because it removes operational knowledge — specifically, expertise in bank-specific AML thresholds, real-time rail timing, cross-border correspondent banking routes, and integration-stage asset acquisition channels. This knowledge is not widely distributed and takes time to rebuild after a network disruption.

Historical Reconstitution and Case Record

Rosfinmonitoring Pipeline: Structural Limitations

ANALYST INFERENCE The EDP Dependency Map identifies Rosfinmonitoring as a co-primary owner of Node 09 disruption via the FNS referral and Rosfinmonitoring pipeline. This reflects the theoretical bilateral financial intelligence cooperation framework. In practice, this pathway is structurally constrained for ransomware-linked mule flows for two reasons: first, Rosfinmonitoring operates under the same Russian state protection framework (Dark Covenant 3.0) that provides implicit tolerance for high-value ransomware operators; second, Russian financial intelligence cooperation on cybercrime has historically been selectively responsive — useful for cases the Kremlin wants actioned, not for cases where the operators are protected. The Rosfinmonitoring pathway should be maintained as a formal channel but not relied upon as a primary disruption mechanism for ransomware-connected mule flows.

SECTION 6: INDICATORS AND KPIs

Ecosystem Health Indicators

Disruption KPIs

Alert Thresholds

SECTION 7: SOURCES AND CONFIDENCE

Primary Sources

Financial Crime Research and Industry:

• KPMG — "Money Mules: FinCrime's Trojan Horse Unveiled": mule archetypes; multi-stage recruitment funnel documentation; layering and integration role; cross-vertical function of herder networks.
• Outseer / RUSI-based analysis — "Following the Fraud: What New UK Research Reveals About Money Mule Networks": channel mix data (57% Faster Payments, 20% debit card, 10% ATM); £7.2M two-month sample; velocity data (>50% within 1 hour, <15% at 24 hours); primary quantitative source for mule network operational behavior.
• BioCatch — "Nearly 2 Million Money Laundering Accounts Reported in 2024": global mule account scale (2 million accounts, 257 institutions, 21 countries); primary source for account inventory baseline.
• Napier AI — "What is layering in money laundering?": layering methods and cross-border typologies; definitional framework for placement/layering/integration stages.
• Unit21 — "The 3 Stages of Money Laundering": placement/layering/integration examples across banking and crypto; integration-stage asset typologies.
• Group-IB — UNC2891 money mule network case: Google Ads and Telegram recruitment; structured ATM cash-out network; documented cross-over between cyber operations and physical cash extraction.

Law Enforcement and Government:

• Europol — Operation Eagle II (2024): 26-country coordinated mule network disruption; arrest and account freeze statistics.
• UK Payment Systems Regulator — APP fraud reimbursement framework (October 2023): mandatory reimbursement liability model; structural incentive for bank detection investment.

Blockchain Analytics and Financial Intelligence:

• TRM Labs — "Ransomware in 2024: Latest Trends, Mounting Threats and the Government Response": outsourcing of layering and cash-out functions by ransomware and cybercrime groups; specialist mule network subcontracting model.

Confidence Assessment by Topic

Intelligence Gaps

• Ransomware-specific mule flow attribution: The available dataset (BioCatch, UK bank data) covers all cybercrime mule flows, not ransomware-specific flows. Isolating the mule network capacity dedicated specifically to ransomware cash-out layering is not currently possible from open sources.
• Russian-based mule network operators: The herder and professional laundering crew tier serving RU-language ransomware groups is not publicly documented. Identifying these operators — and screening for FSB protection relationships before any attribution action — is the primary HUMINT requirement for this node.
• Integration-stage asset acquisition volumes: The total value of ransomware proceeds integrated via real estate, luxury goods, and front companies is not quantified in any available open source. This gap limits policy prioritization for integration-stage regulatory action.
• Mule network herder prosecution baseline: An accurate cross-FVEY baseline for herder-tier versus retail mule prosecution rates does not exist in publicly available statistics. Establishing this baseline is prerequisite to measuring whether disruption actions are reaching the right tier of the network.

SECTION 8: ANALYST ASSESSMENT

Key Takeaway

Mule networks are the final operational stage of the ransomware monetization chain and the most difficult node to fully disrupt because of the structural asymmetry between the account supply (nearly 2 million flagged accounts in 2024) and any realistic law enforcement interdiction capacity. Individual mule arrests and account freezes do not degrade network capacity at scale — the recruitment pipeline continuously replenishes the account supply. The strategic insight for Node 09 disruption is that the leverage point is not the accounts but the velocity: real-time payment rails are the operational enabler, and structural intervention at the payment network level is the only mechanism that can disrupt the layering function without depending on individual account identification.

Herder-tier prosecution remains the highest-value targeted action because it removes operational knowledge that individual accounts do not provide. The cross-vertical function of professional herder networks — simultaneously servicing ransomware, fraud, BEC, and other cybercrime cash-out — means that a single successful herder prosecution produces disruption value across the entire cybercrime ecosystem, not just the ransomware supply chain. This multiplier effect is the primary argument for dedicating HUMINT and financial intelligence resources to herder identification rather than accepting the current state of near-exclusive retail mule prosecution.

Priority Recommendation

Immediate: Reorient mule network disruption metrics from retail mule arrest counts to herder-tier prosecution rates. Current FVEY reporting on mule network enforcement emphasizes arrest totals and account freeze volumes — metrics that reflect operational activity but not strategic disruption. Establishing a cross-FVEY herder prosecution rate baseline and setting a measurable target for shifting the prosecution mix toward herder-tier actors is prerequisite to evaluating whether Node 09 disruption is producing durable ecosystem-level effects.

Near-term: Engage payment network operators (Pay.UK, The Clearing House, EBA Clearing) directly on real-time mule detection model development. The >50% fund-exit-within-one-hour velocity characteristic of mule networks means that any detection mechanism operating on a next-day or end-of-day cycle is structurally ineffective. The UK APP fraud reimbursement liability framework — which creates a financial incentive for bank investment in real-time detection — is the regulatory model; equivalent frameworks in the US and EU would substantially expand the functional reach of payment-rail-level mule disruption.

Medium-term: Develop a cross-FVEY integration-stage regulatory action program targeting the primary integration vehicles (real estate, luxury goods, front companies). Integration-stage disruption does not require LE cooperation with Russia and is not constrained by the FSB protection framework — it operates in the jurisdictions where the assets are acquired. Beneficial ownership registry requirements and enhanced due diligence for cash transactions in real estate and luxury goods markets are viable regulatory actions that close the terminal stage of the laundering chain.

Sequencing note: Node 09 is a Phase C node. Its disruption value is contingent on the effectiveness of Phase A and B actions upstream. If OTC brokers (Node 01), exchanges (Node 02), and mixers (Node 08) are effectively disrupted, fewer funds reach the mule network pipeline and at lower "cleanliness" — increasing the compliance risk for every mule account that receives a transfer. Phase C mule actions are most effective when Phase A financial pressure has already reduced the volume and raised the risk profile of fiat entering the mule network.

Connection to EDP Disruption Playbook

Node 09 (Mule/Money Laundering Networks) is a Phase C node alongside Nodes 05 (Botnet/Loader Ecosystems) and 06 (Leak Site Hosting Stack). Phase C targets delivery and monetization — the operational outputs that convert ransomware capability into criminal profit. Node 09 represents the monetization side of Phase C: without functional mule networks, ransomware proceeds remain in cryptocurrency, subject to ongoing blockchain forensics and OFAC pressure. Mule network disruption is therefore the terminal-stage complement to the crypto-side financial actions in Phases A and B.

The Phase C sequencing is load-bearing for Node 09: Phase A and B actions that reduce the volume of fiat reaching mule networks compound the effectiveness of Phase C mule disruption. The full compound effect of the EDP playbook — financial pressure at every stage of the monetization chain — is most visible at Node 09 because it is the point where all upstream disruption actions manifest as reduced inflow volume, degraded "cleanliness" of received funds, and increased compliance risk per transaction.

Dependency Map Update Recommendations

Follow-On Research

• Establish cross-FVEY herder prosecution rate baseline: compile national prosecutorial statistics to determine current herder-tier versus retail mule prosecution mix; set measurable target for shifting the mix toward herder-tier actions.
• Identify Russian-based herder and professional laundering crew operators serving RU-language ransomware groups: HUMINT and financial intelligence priority; Dark Covenant 3.0 screening required before any attribution action.
• Model payment network operator intervention points for real-time mule detection: engage Pay.UK, The Clearing House, and EBA Clearing on technical feasibility of network-level real-time mule classification models; assess APP fraud liability framework replication in US and EU jurisdictions.
• Quantify integration-stage ransomware proceeds: commission or task financial intelligence analysis to estimate the total value of ransomware proceeds integrated via real estate, luxury goods, and front companies in FVEY jurisdictions annually — prerequisite for integration-stage regulatory action prioritization.
• Assess Rosfinmonitoring pipeline utility: conduct a structured review of any historical cases where Rosfinmonitoring acted on ransomware-linked financial intelligence referrals; determine whether a residual cooperation pathway exists and under what conditions it is actionable.