Loading story…
Sophos detailed a Cambodia-linked cryptocurrency fraud operation dubbed Sour Grapes that used misdirected SMS messages and long-running Telegram chats to lure victims into a classic pig-butchering scam. Operators posed as a fabricated woman named "Harley" and directed targets to fake crypto trading and liquidity-mining platforms that impersonated legitimate financial and cryptocurrency brands, steering deposits through Crypto.com-funded transactions before moving funds across rapidly changing wallets and domains.
Investigators tied the infrastructure to Chinese-speaking operators and identified evidence pointing to Phnom Penh and Sihanoukville, alongside more than 500 related domains built from nearly identical scam kits. Blockchain analysis found the operation collected more than $3 million in cryptocurrency over roughly five months, with some funds traced to Tokenlon according to Chainalysis, underscoring how industrialized scam compounds in Southeast Asia continue to scale social-engineering fraud through reusable infrastructure and fast-moving payment channels.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos published research on a cryptocurrency pig-butchering operation dubbed 'Sour Grapes,' linking it to Chinese-speaking scam infrastructure and operators in Cambodia, including evidence pointing to Phnom Penh and Sihanoukville. The report said the operation used misdirected SMS, Telegram conversations, a fabricated persona, and fake crypto trading apps, and identified more than 500 related domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported on a Cambodia-based **pig-butchering** operation that used fraudulent online relationships and investment lures to steal money from victims. The campaign relied on scam infrastructure designed to build trust over time, then direct targets into fake cryptocurrency or investment platforms where deposits were ultimately controlled by the operators. The report highlights how the operation functioned as an organized criminal enterprise, with infrastructure, social-engineering workflows, and financial fraud mechanisms supporting the scheme. The activity underscores the continued threat from transnational scam networks that blend romance fraud, fake trading services, and cryptocurrency payment channels to extract large sums from victims while obscuring the actors behind the operation.
Jun 29, 2026
US authorities sentenced Chinese national **Jingliang Su** to **46 months** in federal prison for laundering proceeds from a Cambodia-based “**pig butchering**” fraud operation that stole **~$36.9M** from **174** US victims, according to reporting on the Justice Department case. Court filings described a three-stage playbook—social engineering outreach via social media/dating/texts, steering victims to **fraudulent crypto investment platforms**, and then blocking withdrawals or demanding additional “fees”—with Su acting as a financial conduit; the court also ordered **~$26.9M** in restitution. Separate reporting detailed the operational reality behind similar “pig butchering” scam centers in the **Golden Triangle** region of **northern Laos**, including the **Boshang compound**, where leaked internal chats and a whistleblower account described industrialized fraud run like a sales organization with quotas and scripted victim engagement. The material also described **forced labor and debt bondage** conditions—confiscated passports, coercion, and violence for rule-breaking or escape attempts—highlighting that many scam operators are themselves trafficking victims compelled to conduct online romance/crypto-investment scams at scale.
Jun 29, 2026
Authorities and researchers warned that **pig-butchering** operations have grown into a global criminal enterprise that combines online relationship and investment fraud with human trafficking. INTERPOL said victims from 66 countries had been trafficked into scam centres by March 2025, with most taken to Southeast Asia and additional activity emerging in the Middle East, West Africa, and Central America. The centres reportedly recruit workers through fake job ads, then detain and coerce them into running social-engineering scams under debt bondage and severe abuse, while criminals increasingly use AI-generated job postings, deepfake profiles, and other synthetic content to scale the fraud. The scams typically target victims on social media and messaging platforms, steering them into fraudulent cryptocurrency investments and draining funds over time. California regulators have urged consumers to recognize and report the schemes, while legal analysis in the United States found at least 81 federal civil forfeiture actions tied to pig-butchering by March 2026. Those seizures have disrupted some networks and recovered stolen crypto, but often only a small share of losses, and victim repayment remains difficult because cases depend heavily on foreign exchanges, stablecoin issuers, and complex claims processes; one exceptional case involving **Chen Zhi** and the **Prince Group** reportedly led to the seizure of about **$15 billion** in cryptocurrency.
Aug 12, 2026