Between Two Nerds: Releasing the hounds on scam compounds - Risky Bulletin

Summary

Risky Bulletin: Episode Summary Title: Between Two Nerds: Releasing the Hounds on Scam Compounds
Host/Author: risky.biz
Release Date: April 28, 2025

1. Introduction to Scam Compounds

Tom Muren (A) opens the discussion by introducing the topic of scam compounds, specifically the notorious pig butchering operations. These are highly organized criminal networks involved in extensive online scams, including romance fraud, cryptocurrency investment scams, illegal gambling, and more.

"So the scam compounds, they are highly organized. They take people from pretty much all over the world... they do online scams. So romance scams, cryptocurrency, investment scams, illegal gambling, and it's like just tremendously lucrative."
[00:27] A

2. The Scope of the Problem

The conversation highlights the vast scale of these operations, noting reports that indicate these compounds generate billions of dollars annually. A United Nations report detailed the seizure of US$2 billion from ten individuals involved in money laundering, primarily Chinese nationals who have since acquired citizenships globally.

"So it turns out that these compounds generate like billions of dollars... they seized US$2 billion worth of assets from these 10 people."
[00:20] A

3. Comparison with Ransomware Groups

Grok (B) and Tom discuss the differences between scam compounds and ransomware groups. While ransomware groups are primarily cyber-centric and pose direct cyber threats by disrupting systems, scam syndicates operate more like traditional organized crime, focusing on financial theft without necessarily disrupting critical infrastructure.

"I don't know if I'd classify scam organizations as cyber organizations... they're certainly cyber criminals, but I don't know if they're cyber organizations."
[08:18] B

4. National Security Implications

The debate centers around whether these scam syndicates should be considered national security threats. Tom argues for their inclusion due to the substantial financial resources they amass, which could potentially fuel further criminal activities and corruption.

"I think that allowing these people to accumulate billions and billions of dollars is going to make them less of a threat going forward."
[07:24] B

5. Challenges in Offensive Cyber Operations

Targeting ransomware groups with offensive cyber operations makes strategic sense due to their reliance on specific cyber infrastructure. However, scam syndicates present a different challenge as they are less dependent on bespoke cyber tools and more on traditional, often non-digital, criminal methods.

"The problem is that these organizations are so different from ransomware groups, which are in a way like the perfect target for offensive cyber operation."
[22:51] B

6. Potential Cyber Strategies and Limitations

The hosts explore potential cyber strategies to disrupt scam compounds, such as targeting their communication channels or financial transactions. However, they acknowledge significant limitations, including the adaptability of these groups and their use of mainstream services like WhatsApp and Gmail, which are harder to regulate without broader implications.

"I think that the actual powerful players within these environments... are just straightforward criminals who are doing this thing. I don't think that they're exposed."
[13:49] B

7. Discussion on Money Laundering and Cryptocurrency

Money laundering is identified as a critical component of scam syndicates, with operations often involving cryptocurrency exchanges. The discussion touches on the challenges of sanctioning these exchanges and the potential for state actors like North Korea to exploit these vulnerabilities.

"But it also seems like there would be a reluctance to actually conduct an operation to mess with the financial system... like North Korea does it all the time."
[26:15] B

8. The Role of State Actors

A speculative and somewhat humorous suggestion is made about allowing state actors, particularly North Korea, to target scam syndicates. While acknowledging the potential benefits, the hosts recognize the significant risks, such as undermining trust in the international financial system.

"So at this point it's yes, scam syndicates are a national security threat... but yes, we fully endorse North Korea going after them."
[30:09] B

9. Conclusion and Final Thoughts

In wrapping up, the hosts reiterate the complexity of treating scam compounds as national security threats and the difficulties in addressing them through current cyber operations frameworks. They emphasize the need for coordinated efforts between law enforcement, cybersecurity agencies, and financial institutions to effectively combat these pervasive criminal networks.

"It seems like these are cyber organizations to a degree... but they are not using any boutique or tailored cyber infrastructure."
[20:06] B

Notable Quotes:

"They have to have a massive organization behind it, right?"
[02:45] A
"Prevention is better than cure perspective."
[07:19] A
"Hack into a bank that's doing money laundering so you can access the billions of dollars in scam cash."
[28:35] B
"The loss of trust and faith in the international financial system would be so big that it's hard to imagine a scenario where it would be a worthwhile trade-off."
[27:11] B

This episode provides a comprehensive exploration of scam compounds' operational dynamics, their impact on global finance, and the intricate challenges faced by cybersecurity and law enforcement agencies in mitigating their influence. The nuanced discussion underscores the need for evolving strategies to address the multifaceted nature of modern cybercrime.

Transcript

A (0:03)

Hello everyone, this is Tom Muren. I am here for another between two nerds discussion with the Gruk. G'day Grok, how are you?

B (0:10)

G'day Tom. Fine, and yourself?

A (0:12)

I'm well. This week's episode is brought to you by DropZone AI. They automate all the mundane stuff that tier one SOC analysts have to do so that the analysts can focus on more interesting and more important stuff. Find them@DropZone AI. So Grok, I've been thinking about scam compounds, so called pig butchering compounds. And there was another UN report this week that I wrote about. So it turns out that these compounds generate like billions of dollars. So one of the sort of asides in the report was that some people who were involved in these compounds were done for money laundering in Singapore. Ten of them, they were Chinese nationals originally, but now have citizenships all over the world. And they seized US$2 billion worth of assets from these 10 people. And it's because they were convicted for sort of somewhat mundane money laundering crimes. The like. I think the biggest jail sentence one of them got was like 18 months. If you get caught for 18 months and you've got hundreds of millions of dollars and they had assets all over the world, right, why would you ever stop? And so what I've been thinking about is I've advocated, and I think you also believe that ransomware criminals were good targets for offensive cyber operations, for good targets for places like cyber command, ASD, the UK's cyber force, like that made sense to target those organizations. So the question today we're going to address is does it make sense for those kinds of offensive cyber organizations to tackle these kind of scam compound syndicates? And so just to sketch out, there's like some pretty significant differences between the two. So the scam compounds, they are highly organized. They take people from pretty much all over the world, many, many different countries. They take them to these compounds either forcibly or on false pretenses and then they basically enslave them so they become forced labor. Some of the compounds have tens of thousands of people. They think that there's hundreds of thousands involved and they do online scams. So romance scams, cryptocurrency, investment scams, illegal gambling, and it's like just tremendously lucrative. So it's not clear from the reports what the management or organizational structure is, I guess, but there's obviously there's got to be one. Like there's got to be a massive organization behind it, right? And around these organizations have grown up money laundering, I guess, service providers Sort.

B (3:11)

Of an ecosystem of support infrastructure.

A (3:14)

Yeah, yeah, yeah. And it's, I think because they've got so much money, it attracts other criminal enterprise to do whatever they need to do. So that's the sort of thumbnail sketch of what we're talking about. And the one reason it's particularly concerning is that they're starting to push out into different parts of the world. So they've been located in areas like Myanmar or Cambodia where the often on border areas where there's poor governance. And so the neighboring states, China, Thailand, the Philippines is also involved, have started to push back very significantly because it's like a serious problem. And so they're, the good news is they're being forced to adapt.