Service Providers Help Pig Butcher Scammers Scale Operations: Infoblox
None
<p>The evolution over the past decade or so of online fraud and scam operations run by Asian crime groups has been well documented as they moved from smaller, tucked-away offices in cities and towns to industrial-scale compounds located in remote places like Myanmar, <a href="https://securityboulevard.com/2025/07/cambodia-arrests-more-than-1000-in-cyberscam-crackdown/" target="_blank" rel="noopener">Cambodia</a>, and Laos, along the borders with China and Thailand.</p><p>These operations can pull in <a href="https://www.uscc.gov/sites/default/files/2025-07/Chinas_Exploitation_of_Scam_Centers_in_Southeast_Asia.pdf" target="_blank" rel="noopener">as much as $60 billion in a year</a>, and in recent years have spilled out of Southeast Asia to places in <a href="https://securityboulevard.com/2025/09/african-authorities-arrest-260-suspects-in-romance-sextortion-scams/" target="_blank" rel="noopener">Africa</a>, South America, and elsewhere. They’ve grown in size and complexity, according to researchers with Infoblox, which offers automated management and security of network services and security.</p><p>The “major Chinese-speaking criminal groups have managed to infiltrate a growing number of countries in Southeast Asia, securing vast amounts of land to build cities and special economic zones dedicated to crime operations,” Infoblox senior threat researchers Maël Le Touz and John Wòjcik <a href="https://www.infoblox.com/blog/threat-intelligence/scaling-the-fraud-economy-pig-butchering-as-a-service/" target="_blank" rel="noopener">wrote in a report</a>. “They have established sophisticated global money laundering and human trafficking networks dedicated to staffing these operations with tens of thousands of slave workers brought in from countries around the world and forced to scam from bases in Cambodia, Laos, Myanmar, the Philippines, and elsewhere.”</p><p>These compounds run a range of pig butchering operations, from romance to investment to sextortion scams, targeting victims around the world. Key players in these operations are service providers that are driving what Le Touz and Wòjcik described as a “robust, booming pig butchering-as-a-service (PBaaS) economy.”</p><p>Like similar phishing-, ransomware-, and malware-as-a-service models, the service providers supply the scammers with the infrastructure, tools, and expertise they need to rapidly scale their operations, they wrote.</p><h3>PBaaS Makes Scams Easier, Cheaper</h3><p>“Large scam compounds such as the Golden Triangle Economic Zone (GTSEZ) are now using ready-made applications and templates from PBaaS providers,” they wrote. “This decentralized service-based business model also makes attribution more difficult, as countless criminal networks can use the same template.”</p><p>In addition, providing these capabilities means that the technical expertise or money for the infrastructure that was needed at one point “can now be purchased as an off-the-shelf service offering everything from stolen identities and front companies to turnkey scam platforms and mobile apps, dramatically lowering the barrier to entry,” the Infoblox researchers added.</p><p>Such service providers have been part of the picture for a while. The United Nation’s Office on Drugs and Crime (UDODC) wrote in a report last year that the evolution of organized crime in Southeast Asia “has been marked by the proliferation of industrial scale cyber-enabled fraud and scam centres, driven by sophisticated transnational syndicates and interconnected networks of money launderers, human traffickers, data brokers, and a growing number of other <a href="https://www.unodc.org/roseap/uploads/documents/Publications/2025/Inflection_Point_2025.pdf" target="_blank" rel="noopener">specialist service providers and facilitators</a>.”</p><h3>Focusing on Two Service Providers</h3><p>However, Infoblox focused on two service provider operations in particular to illustrate the prominent role such organizations play in the expanding PBaaS economy. One group that Le Touz and Wòjcik called “Penguin” – it goes by such names as “Heavenly Alliance,” “Overseas Alliance,” and “Penguin Account Store” – sells fraud kits, scam templates, and databases that contain a wide range of personal data that includes bank records, travel history, political leanings, and information about relatives.</p><p>“The scammers leverage this info to identify and target wealthy victims,” they wrote. “Personal data is also used to establish trust and enrich social engineering tactics. After all, who other than your bank would call with knowledge of your recent transactions? And who else could possibly know about your income records besides the government?”</p><p>Penguin also sells account data from social media platforms like Tinder and WhatsApp and login information from Adobe, Apple’s developer platforms, and other sites that likes were obtained via information stealers. The information is relatively cheap, with pre-registered social media accounts starting at 10 cents.</p><p>In addition, the service provider also offers of items needed for running a large-scale pig-butchering operation, including pre-registered SIM cards, 4G and 5G routers, IMSI catchers – devices that mimic cell towers to intercept mobile phone calls, texts, and location data, stolen pictures used to lure victims.</p><p>There also is a social customer relationship management (SCRM) platform called “SCRM AI” used by bad actors for mass account takeovers and automated engagement with victims on social media, they wrote, as well as BCD Pay, a payment processor platform with roots in illegal gambling.</p><h3>The UWORK CRM Platform</h3><p>Infoblox also called out UWORK, one of dozens of customer relationship management (CRM) platforms available via Telegram and other social media sites that coordinates operators and victims. The Justice Departments says UWORK was used by three people – including two Chinese nationals – arrested in February 2025 for running a fake investment platform in <a href="https://www.justice.gov/usao-cdca/pr/three-defendants-arrested-federal-complaints-alleging-they-knowingly-received-more-13" target="_blank" rel="noopener">investment scams</a> that stole more than $13 million from victims.</p><p>Users of the UWORK platform can create websites link with email and Telegram to automate customer contacts and updates and use a Know Your Customer (KYC) panel that requires victims to upload proof of their identity.</p><p>“When the website is up and running, the admin can create multiple profiles for the agents running the scams and set very precise rules,” the researchers wrote. “However, the admins don’t run the scams (interface with the victims) – this is done by ‘first-level agents,’ possibly including forced labor.”</p><p>There are dashboards that show profitability metrics of the complete operation.</p><h3>Mixing with Real Trading Platforms</h3><p>PBaaS providers also can integrate their platforms with popular online trading platforms like MetaTrader so scammers can display real-time financial information to appear more credible and automate the supply of mobile applications for Android or iOS. Some also release their apps on legitimate online stores and hide their real functionality by posing as news apps or other legitimate solutions.</p><p>Le Touz and Wòjcik said website templates can cost as little as $50, with a complete pack – including one with admin access, VPS hosting, a mobile app, and other features – can come in at about $2,500.</p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/01/service-providers-help-pig-butcher-scammers-scale-operations-infoblox/" data-a2a-title="Service Providers Help Pig Butcher Scammers Scale Operations: Infoblox"><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Fservice-providers-help-pig-butcher-scammers-scale-operations-infoblox%2F&linkname=Service%20Providers%20Help%20Pig%20Butcher%20Scammers%20Scale%20Operations%3A%20Infoblox" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Fservice-providers-help-pig-butcher-scammers-scale-operations-infoblox%2F&linkname=Service%20Providers%20Help%20Pig%20Butcher%20Scammers%20Scale%20Operations%3A%20Infoblox" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Fservice-providers-help-pig-butcher-scammers-scale-operations-infoblox%2F&linkname=Service%20Providers%20Help%20Pig%20Butcher%20Scammers%20Scale%20Operations%3A%20Infoblox" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Fservice-providers-help-pig-butcher-scammers-scale-operations-infoblox%2F&linkname=Service%20Providers%20Help%20Pig%20Butcher%20Scammers%20Scale%20Operations%3A%20Infoblox" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Fservice-providers-help-pig-butcher-scammers-scale-operations-infoblox%2F&linkname=Service%20Providers%20Help%20Pig%20Butcher%20Scammers%20Scale%20Operations%3A%20Infoblox" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>