Loading story…
Thailand has escalated its ongoing border conflict with Cambodia by targeting compounds believed to house cybercriminal operations, including scam centers generating billions in illicit profits. The Thai government has framed recent artillery and air strikes, including attacks on casino and hotel complexes in the border city of Poipet, as part of a broader campaign against transnational criminal groups responsible for large-scale online fraud. These groups, operating throughout Cambodia and Southeast Asia, are estimated by the United Nations to generate $41 billion annually through online scams.
Thai officials have stated that military actions will continue until Cambodia takes decisive steps to dismantle these scam operations. The caretaker Thai Prime Minister emphasized at an international anti-scam conference that peace is contingent on Cambodia's efforts to combat cybercrime, rejecting calls for a ceasefire and linking national security directly to the fight against cyber-enabled fraud. The conflict highlights the intersection of geopolitical tensions and the growing threat posed by organized cybercrime in the region.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Thailand intensified its confrontation with Cambodia, publicly framing the border dispute as part of a campaign against cybercriminal compounds operating in casino and hotel complexes near the frontier. The escalation included military strikes and heightened diplomatic tensions.
The United States imposed sanctions on Cambodian individuals and entities allegedly linked to online scam compounds and related criminal activity. The action increased international pressure over alleged official complicity in the scam-center ecosystem.
A U.N. report described cyber-enabled scam centers in Southeast Asia as a multibillion-dollar criminal industry built on human trafficking and forced labor, with many compounds concentrated along the Thailand-Cambodia border. The report helped frame the issue as both a cybercrime and humanitarian crisis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and policy groups are intensifying efforts against **transnational online scam operations** centered in Southeast Asia, particularly Cambodia, where criminal networks have been linked to fraud compounds, human trafficking, and abuse of workers. Reporting highlights recent enforcement actions including Cambodia's extradition of **Chen Zhi** to China, a new U.S. executive order targeting cyber-enabled fraud, and a Thai-led operation with international partners and **Meta** that removed **150,000** fake profiles and arrested **21** suspects tied to scam activity. The broader picture is that scam syndicates are adapting quickly, shifting locations, fragmenting into smaller cells, and exploiting gaps between law enforcement, regulators, and private-sector platforms. On-the-ground reporting from Cambodia describes the human cost inside alleged scam compounds, including forced labor, torture, and coercion of workers recruited under false pretenses. One former guard said he was ordered to use electric shocks and beat Chinese workers inside a heavily secured compound on Bokor Mountain, even as publicized crackdowns were underway elsewhere. That account reinforces concerns that abrupt enforcement alone can displace operations while leaving trafficked workers vulnerable and limiting intelligence collection on how the scam ecosystem functions. A separate report on fake shipment-tracking phishing in the Middle East and Africa is **not** part of the same event, as it covers a different scam trend and geography rather than the Cambodia-centered scam-compound crackdown.
Jun 29, 2026
The United States government has established a dedicated Scam Center Strike Force to target large-scale cyber scam operations based in Southeast Asia, which have defrauded Americans of at least $10 billion in 2024 alone. This multi-agency task force, comprising the Department of Justice, Treasury, FBI, Secret Service, and State Department, will focus on investigating, disrupting, and prosecuting the leaders and infrastructure behind these scam centers, particularly in Burma (Myanmar), Cambodia, and Laos. The operations often involve romance scams, fraudulent investment schemes, and cryptocurrency-related fraud, with many scam centers relying on forced labor and human trafficking to sustain their activities. In conjunction with the task force's launch, the US Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against the Democratic Karen Benevolent Army (DKBA), an armed group supporting scam compounds in Myanmar, as well as several companies in Thailand linked to Chinese organized crime. The US has already seized over $410 million in cryptocurrency assets and is pursuing further forfeitures. These actions build on previous sanctions against other transnational criminal organizations, such as the Prince Group, and reflect a broader US strategy to dismantle the infrastructure enabling large-scale cyber fraud and to provide restitution and education to victims.
Jun 29, 2026
Cambodian authorities shut down **190 online scam centers** as part of an intensified national crackdown on transnational fraud operations, according to government statements cited by Reuters. The enforcement action reportedly included the arrest of **173 senior figures** and the deportation of roughly **11,000 foreign nationals**, reflecting the scale and international composition of the scam-compound ecosystem operating in the country. The reporting was published as part of an ISMG “breach roundup” that also briefly noted other, separate security developments (including the European Parliament disabling AI tools on lawmakers’ devices, a *Notepad++* updater supply-chain exposure being patched, an Apple iOS zero-day fix, and emergency remediation for an actively exploited **BeyondTrust** RCE, among others). Those items were presented as additional headlines rather than as part of the Cambodia enforcement action.
Jun 29, 2026