Loading threat actor…
Huione Group is a Cambodia-based illicit financial and service ecosystem that has been identified as a major enabler of transnational cybercrime, cryptocurrency laundering, and Southeast Asia-based fraud operations. It has been described as comprising an online marketplace, money-laundering services, and cryptocurrency trading infrastructure, including support for its own stablecoin ecosystem. Security and financial crime reporting consistently place it at the center of laundering and settlement activity for proceeds derived from crypto theft, online investment fraud, and pig-butchering scams. Huione Group has been accused by U.S. authorities of laundering at least $4 billion in illicit proceeds between 2021 and early 2025. Reported activity includes processing funds tied to cyber-enabled fraud, scam compounds, and stolen cryptocurrency. It has also been linked to laundering proceeds associated with North Korean cyber operations, including activity attributed to Lazarus Group and entities associated with the Reconnaissance General Bureau. Reported assessments indicate the group acted as a middleman capable of moving stolen virtual assets across blockchain ecosystems and converting them into fiat currency. Operationally, Huione Group appears to function less like a single-purpose threat actor conducting intrusions and more like a criminal service provider and financial hub supporting a broader illicit ecosystem. Its services have reportedly enabled scammers and cybercriminals to obtain laundering support, move value across chains, access trading infrastructure, and procure tools used in fraud operations, including AI-enabled services for creating fraudulent personas and scaling social-engineering campaigns. It has been associated with Chinese-language guarantee-service style markets that support organized scam networks operating across Southeast Asia. The group is closely associated with large-scale pig-butchering and online investment scam infrastructure, including laundering proceeds from romance and investment fraud schemes. It has also been cited as a key platform used by organized criminal networks that operate scam compounds and forced-labor fraud centers in the region. Its role in these ecosystems is primarily financial facilitation, settlement, and marketplace support rather than direct malware deployment, although it has reportedly handled proceeds from major cryptocurrency thefts and other cybercrime. Known aliases include Huione and Huione Group. Reported affiliated branding and entities include Huione Pay. Huione Group has been subjected to significant U.S. sanctions and financial restrictions, including measures intended to cut it off from access to the U.S. dollar financial system. Reporting in 2025 and 2026 indicated disruption to parts of its withdrawal and payment operations, though criminal demand for comparable laundering and guarantee services has continued to shift to other platforms.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Cambodia-based platform used to launder and move billions in funds from crypto thefts, cybercrime, and pig butchering scams. Sanctioned by U.S. officials and reportedly stopped processing withdrawals, but may rebrand or continue operations under a different name.
Huione is a service provider facilitating scam operations by offering AI-powered tools for creating fake personas and providing money laundering services to obfuscate illicit cryptocurrency proceeds.
Huione Group is a Cambodian multinational conglomerate involved in large-scale money laundering, cryptocurrency fraud, and acting as a middleman for North Korea's cybercrime operations, including laundering stolen cryptocurrency and facilitating investment fraud and romance scams ('pig butchering').
Huione Group is a Cambodian multinational conglomerate involved in large-scale money laundering, cryptocurrency fraud, and acting as a middleman for North Korea's cybercrime operations, including laundering stolen cryptocurrency and facilitating investment fraud and romance scams ('pig butchering').
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.