The scam industry has undergone massive transformations over the past decade. The cliché image of the once-iconic Nigerian prince duping Westerners from a local cybercafé is now obsolete.
One of the key drivers fueling the ongoing sha zhu pan (pig butchering) epidemic is the emergence of service providers supplying criminal networks with the tools, infrastructure, and expertise enabling them to scale dramatically.
Western Africa remains a hotbed for digital fraud, but industrial-scale scam operations scattered throughout Southeast Asia have superseded it in both scale and efficiency.
Over the past decade, major Chinese-speaking criminal groups have infiltrated Southeast Asian countries, securing vast amounts of land to build special economic zones dedicated to crime operations.
These networks have established sophisticated global money laundering and human trafficking operations, staffing these complexes with tens of thousands of slave workers forced to scam from bases in Cambodia, Laos, Myanmar, the Philippines, and beyond.
These providers have noted a booming pig butchering-as-a-service (PBaaS) economy remarkably similar to malware and phishing-as-a-service models that fuel global cybercrime.
The Infrastructure of Fraud
Research has identified two specific actors operating within the PBaaS ecosystem. The first, known as the “Penguin Account Store” or “Heavenly Alliance,” offers customers access to materials needed to run social engineering operations at the heart of these crimes.
The second, “UWORK,” provides the technical platforms necessary to manage scams and their agents at scale.
The Penguin operation began with shè gōng kù (社工库), a database of personally identifiable information belonging to Chinese citizens, typically obtained by state agencies through corruption or hacking.
This extensive data including years of bank records, travel history, and political information enables scammers to identify and target wealthy victims with unprecedented precision.
The group now sells a comprehensive toolkit: pre-registered social media accounts starting at $0.10, bulk SIM cards, stolen credentials, 4G/5G routers, and “character sets” packages of stolen pictures from social media profiles used to lure victims.
Penguin even offers an SCRM AI platform to automate the scamming process, alongside BCD Pay, an anonymous peer-to-peer payment solution with deep roots in illegal online gambling.
The Management Platform
UWORK operates within a different niche but with equally troubling implications. The platform provides centralized control over multiple agents through comprehensive customer relationship management tools.
![Archived homepage of the lion-forex[.]com website showing a login to fake investment platform Lion Brokers.](https://www.infoblox.com/blog/wp-content/uploads/pig-butchering-as-a-service-figure-8.png "Criminal Networks Get a Boost from New Pig-Butchering-as-a-Service Toolkits 2")
Chinese criminal actors arrested in February 2025 for defrauding victims of over $13 million leveraged UWORK’s products.
The admin panel offers everything required to run large-scale operations: multiple email templates, user and agent management, profitability metrics broken down by individual agent, and tools designed to evade detection.
Victims are required to upload identity proof through a Know Your Customer panel information that inevitably feeds future fraud schemes.
Complete PBaaS packages including websites, VPS hosting, mobile apps, trading platform integration, company incorporation in tax havens, and financial regulator registration cost as little as $2,500.
Such low barriers to entry, combined with potential returns exceeding 70,000%, have made pig butchering schemes economically irresistible to criminal enterprises.
The decentralized service-based model enables rapid scaling while complicating attribution, as countless criminal networks utilize identical templates.
As PBaaS continues to mature, these scams are anticipated to become increasingly automated, global, and adaptive.
Countering this ecosystem requires a fundamental strategic shift toward targeting the service providers, facilitators, and infrastructure that make mass-scale fraud possible.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.