Srsly Risky Biz: When pig butcherers fly

Summary

Risky Bulletin Podcast Summary

Episode: Srsly Risky Biz: When Pig Butcherers Fly
Host: risky.biz (Adam Boileau)
Guests: Tom Uren
Release Date: April 24, 2025

---

Introduction

In the April 24, 2025 episode of Risky Bulletin, hosts Adam Boileau and Tom Uren delve into pressing cybersecurity issues, primarily focusing on the alarming rise of pig butchering scams and the evolving challenges within the U.S. Cybersecurity and Infrastructure Security Agency (CISA). This comprehensive discussion sheds light on sophisticated cyber fraud mechanisms and the implications of diminished support for critical cybersecurity initiatives.

---

The Rise of Pig Butchering Scams

Overview

Tom Uren presents an in-depth analysis of pig butchering scams, a burgeoning cyber fraud technique that surpasses traditional ransomware in scale and complexity. These scams involve intricate operations that defraud victims on a massive scale while simultaneously exploiting the perpetrators themselves.

Key Points:

• Scope and Scale: Pig butchering scams have expanded far beyond their origins in the Mekong Delta, now affecting hundreds of thousands globally. The financial impact of these scams eclipses that of ransomware by a significant margin.

• Dual Victimization: These operations not only defraud individuals but also entangle the scammers in a web of corruption and forced labor, creating a cycle of victimization on multiple levels.

• UN Report Insights: The United Nations Office on Drugs and Crime highlights that these scam compounds operate predominantly in poorly governed regions like Myanmar and Southeast Asia. Activities include online romance scams, cryptocurrency investment frauds, and illegal gambling, often utilizing forced labor obtained through kidnapping or deceit.

Notable Quotes:

• "The sheer amount of people being defrauded, amount of dollar value coming out of these pig butchering scams... it's just really, really hard to grasp."
  — Adam Boileau [01:19]

• "If you said to me, Tom, go to a Singaporean jail for 15 months and come out and you'll have access to hundreds of millions of dollars of assets all over the world, I would have to think very, very hard about that."
  — Tom Uren [04:59]

---

Chinese Government Involvement and Money Laundering Networks

Expansion and Adaptation

As international pressure mounts, particularly from the Chinese government targeting these scam compounds, the operators adapt by diversifying into legitimate businesses and expanding geographically to regions with lax governance. This strategic shift aims to obfuscate illicit activities and sustain their operations amidst increasing crackdowns.

Money Laundering Ecosystem:

• The operation's profitability has fostered a robust money laundering network, collaborating with entities like Mexican cartels.

• These networks leverage advanced, hard-to-trace techniques that outpace traditional Western money laundering methods in efficiency and scale.

Global Reach:

• Beyond Southeast Asia, these syndicates are encroaching into the Pacific Islands, Africa, South America, and regions like Georgia, posing a significant threat to global cybersecurity and economic stability.

Notable Quotes:

• "It's like the Belt and Road but, but for crime... go build crime infrastructure in Vanuatu or wherever else and establish yourself as a base of operations."
  — Adam Boileau [07:40]

• "These money laundering organizations or these crime syndicates are the market leaders in cyber enabled fraud, money laundering and underground banking globally."
  — Tom Uren [06:07]

---

Challenges and Policy Responses

Governmental Response:

The UN report emphasizes the need for concerted international action, including capacity building to identify and manage corrupt financial flows. However, policymakers are struggling to keep pace with the rapidly evolving threat landscape, often lagging in awareness and strategic response.

Economic Implications:

The immense profits generated by these scams create a highly corrupting influence in affected regions, undermining legitimate economic development and fostering environments conducive to further criminal activities.

---

The State of CISA and the Secure by Design Initiative

Staffing Reductions and Program Impact

Tom Uren discusses significant staffing cuts at CISA, particularly within the Secure by Design initiative, which aims to enhance software security practices among vendors. The departure of key personnel threatens the sustainability and effectiveness of this strategic program.

Program Significance:

• Secure by Design: Intended as a "carrot" to incentivize vendors to adopt robust security measures, the initiative provides roadmaps and purchasing guides to influence market behaviors favorably.

• Challenges Ahead: With a reduced workforce, maintaining momentum for long-term strategic programs becomes difficult, potentially relegating important cybersecurity enhancements to lower priority.

International Collaboration:

There is hope that international cybersecurity authorities, such as the Australian Cybersecurity Authority, can step in to sustain and advance initiatives like Secure by Design, fostering a more resilient global cybersecurity framework.

Notable Quotes:

• "It's a very worthwhile program, but it's not going to change things overnight. It's a long term, it's a strategic program basically."
  — Tom Uren [12:07]

• "So a little bit of intervention in that market, both in terms of education of buyers and some carrots and guidance and stuff to make it easier for vendors to do the right thing. It's just super important."
  — Adam Boileau [13:07]

---

Conclusion

The episode underscores the escalating complexity of cyber threats, exemplified by the sophisticated pig butchering scams and the precarious state of critical cybersecurity initiatives like Secure by Design. Hosts Adam Boileau and Tom Uren highlight the urgent need for enhanced international cooperation and sustained governmental support to combat these multifaceted challenges effectively.

Listeners are encouraged to engage further by subscribing to the Risky Biz newsletter and exploring additional content on the Risky Biz website.

---

Notable Resources:

• Risky Biz Newsletter: Offers insights and updates on cybersecurity trends and threats.
• Secure by Design Initiative: A strategic program aimed at improving software security practices among vendors.

---

This summary captures the essence of the April 24, 2025 episode of Risky Bulletin, presenting the critical discussions on advanced cyber fraud schemes and the strategic challenges faced by national cybersecurity programs.

Transcript

[Tom Uren]

Foreign.

[Adam Boileau]

Hey, everyone, and welcome to Seriously Risky Business. I'm Adam Boileau. Pacray has the week off this week, so the inmates are well and truly running the asylum here at Risky Biz. My fellow lunatic Tom Uren is here with me. How you doing, Tom?

[Tom Uren]

Good, Adam. How are you?

[Adam Boileau]

I'm doing well as well back. Back from being sick last week, so, yeah, it's nice to be. Nice to be feeling a bit more myself. Today's episode is sponsored by Dev, who help you manage fleets of devices using Microsoft Intune, but also doing so without ending up like Tom and I being a little bit mad. This show is also supported by the William and Flora Hewlett foundation and the folks over at Lawfare who syndicate Tom's fine work. Now, Tom, this week your big feature piece was looking at the spread of forced labor cyber scamming, kind of beyond its origins in the Mekong Delta out towards the rest of the world. And I know when Pat and I started talking about this topic on the main show, really kind of, it took me a while to get my head around the sheer scale of this type of fraud. Like we spent so much time worrying and talking about ransomware, and this is, you know, eclipses ransomware by an order of magnitude. Like the sheer amount of people being defrauded, amount of dollar value coming out of these pig butchering scams, and also the kind of, the. The nate. The dual victimization nature where it victimizes the victims of the people being defrauded, but it also victimizes the people carrying out the fraud. Getting your head around it's just really, really hard. And you've written this week about a report that came out of the United nations about, about, you know, this kind of pig butchering scam. What are the UN got to say?

[Tom Uren]

Yeah, yeah. So it's from the UN Office of Drugs and Crime. So the background is that they're these scam compounds in poorly governed areas, mostly in Myanmar, but also in other areas in Southeast Asia. And they run online romance scams, cryptocurrency investment scams, illegal gambling, and most of the workforce is there either on false pretenses or they've just been kidnapped and are forced to work in these compounds. And the numbers are staggering, hundreds of thousands. And there's been a significant pushback over the last year or so. People have really realized that these are a huge problem. The Chinese people have particularly been affected. A lot of them are in those compounds. And the Chinese government has really started to fight back against the compounds going even to the extent of supporting a proxy war in Myanmar. And so the compounds have had things like their power cut, their Internet access cut. And they're basically adapting. So the story of this report is how they're adapting. And one way they're adapting is that they're trying to move into air quotes, legitimate businesses, and expand that way. And another way is geographically. So they're moving to other countries where governance is also relatively weak. And so this is kind of a good news, bad news story. Good news is that people are having some impact on them. The bad news is that there's just so much money involved, it's, it's like insane. The, there's a case in Singapore which I don't talk about in the write up, but they arrested 10 people involved in money laundering. And it seems like this was related to the illegal gambling part of these operations. And the 10 of them, they seized around US$2 billion worth of assets. And because they were charged with specific money laundering offenses, they couldn't tie what they were doing back to the scam compounds or the illegal gambling or whatever. They, they each got somewhere between 13 and 15 months imprisonment. And you know, the Singaporean government seized from them hundreds of millions of dollars, typically each. And then the report says that they also had assets all over the world. And so I think, you know, if you said to me, Tom, go to a Singaporean jail for 15 months and come out and you'll have access to hundreds of millions of dollars of assets all over the world, I would go, I would have to think very, very hard about that.

[Adam Boileau]

That seems like, at least at that point, right? Like how, how bad could it really be?

[Tom Uren]

And especially when you can say to people on the inside, you look after me and there's a million bucks for you afterwards.

[Adam Boileau]

Yeah.

[Tom Uren]

So the report also talks about how the compounds generate so much money that it's a sort of money laundering network or ecosystem has developed around it. And there's also like a criminal services marketplace that has developed around these compounds. And so the money laundering, they're now working with Mexican cartels. So it feels like the whole China manufacturing hollowing out the rest of the world, where the Chinese money laundering networks will do it for cheaper and better than the cartels, probably Western based financial money laundering networks. So they charge less and they use all these different techniques that are a variety of techniques that are harder to track and harder to disrupt.

[Adam Boileau]

I mean, I guess it makes a lot of sense, right, that they had to build those capabilities to support their own use case. And then now once you've built your, you know, the capability to launder on the scale of tens of billions of dollars. Why wouldn't you then go and sell that as a service elsewhere? Because I mean the more money that's going through the better for the laundering as a whole. Plus you've got that kind of expertise and scale that yeah, as you say, like small time Western money launderers just can't match, know the power of, you know, Asian mechanization.

[Tom Uren]

Yeah, yeah, yeah. So the report says that the, these money laundering organizations or these crime syndicates are the market leaders in cyber enabled fraud, money laundering and underground banking globally. And from an Australian point of view, part of the report that was very interesting to me is that these syndicates are pushing out into the Pacific Islands. And so you can imagine that if you turn up in the Pacific Islands they apparently purport to be just legitimate investors and they set up things like casinos and tourism investment ventures and you turn up with a whole bucket of cash like that's going to buy you some access for sure. And so I find this very, very concerning because they're not spending huge amounts of money for good purposes. Like I think it's, it's the sort of money that is very corrupting.

[Adam Boileau]

It's kind of like the Belt and road but, but for crime I guess is what I'm, what I'm getting.

[Tom Uren]

Yeah, yeah, that's right.

[Adam Boileau]

Yeah, go build ports and build, you know, infrastructure for developing countries to gain access. The same kind of thing is it, go build crime infrastructure in you know, Vanuatu or wherever else and you know, then you can establish yourself relatively cheaply in the scale of your, you know, of your industry and, and then use that as a base of operations and you know, corrupt local institutions and all of those sorts of things which, you know. Yeah, certainly for us in the Pacific, you know, it's kind of concerning because, you know, I mean, you know, I know New Zealand sees itself as, you know, a good partner for lots of small Pacific nations. You know, we have dependencies in like the Cook Islands for example, where Chinese interests have showed up and been, you know, kind of buying their way in. And you know, we're not really equipped as a country to compete with multibillion dollar Chinese cybercrime or Southeast Asian cybercrime syndicate.

[Tom Uren]

So yeah, yeah, it's not just the Pacific Islands. The report also mentions Africa, South America and also Georgia, the state, the ex Russian, ex Soviet state, not the US state. But it's really a challenge that requires concerted action. So that's what the report's calling for some of those countries that are mentioned. I think something like capacity building help, like how do you identify and deal with that kind of corrupt money? I think that's like a serious problem. And that kind of cohesive response really needs to be something that happens. And the threat is evolving so rapidly that I think the policymakers aren't really aware that it's shifting as well. So I mean, I hadn't really heard about this until just two years ago. Like the whole, I mean, I knew of the pig butchering scams, but I didn't realize how, just how huge it was. And so there's very much a sense that governments are kind of playing catch up. So it'd be nice if they recognize this is a problem and started to do something.

[Adam Boileau]

Now the other thing you wrote about this week, which maybe is also depressing is we've talked a bit about the state of things at cisa, losing a number of staff and sort of the changing role of CISA in the US Government. But you've got a story this week about the fate of the Secure by Design initiative.

[Tom Uren]

Yeah. So Eric Geller, who's a cyber security reporter, wrote for Cybersecurity Dive that two of the key individuals have left CISA behind that program. So one of them is Bob Lord and the other one's Lauren Zaburik. Apologies if I've got that wrong. So probably no surprise Bob Lord was the involved with the Democratic National Convention. He was their security officer. So probably no surprise that he's leaving, I guess. Now apparently both of them were instrumental in setting up and running the program. And Geller reports that Lord was one of the key individuals. So there's the fact that two key individuals in the program have left. There's also that the plan is reportedly to basically cut CISA's staff in half. Not, not literally, but the numbers of staff. So it's hard to see how that program will get a lot of love because it's, I think it's a very worthwhile program, but it's not going to change things overnight. It's a long term, it's a strategic program basically. And the idea is that you're trying to encourage vendors to embrace security practices that make their products better. Now that's, I think, a long term project. I would describe it as a carrot. And so you're trying to encourage vendors to do this. And the practical thing they've, things they've done is they've said here's, you know, a roadmap for how you make more secure software, do these things. And they've also got a complimentary guide which is, if you're buying software, here's how you would see if the vendor is doing the good stuff. So it's trying to shape the market now. If you're trying to create change, I think you need a mix of carrots and sticks. It seems like the Trump administration is explicitly against regulation, so there's probably not going to be many sticks, which I think makes the carrots more important. So given all that, it seems that there is a space, I think, for other international cyber security authorities to step up because they've been involved in this process. The purchasing guide was actually published on the acsc, the Australian Cybersecurity Authority's website, and it's got joint authors from all amongst the five eyes and I think South Korea as well. So there's a lot of agencies who've been willing to co author things and sign up to things. So I think it would make sense if some of those stood up if sys ability to support this program is reduced, which seems likely.

[Adam Boileau]

Yeah, like it is a real important program and so many, you know, so many bits of the industry have not. I'm thinking most, you know, security appliances in particular have been, you know, the thing that's been causing us a lot of grief lately. That's not a thing that the free market has guided vendors towards producing robust software. And so a little bit of intervention in that market, both in terms of education of buyers and some carrots and guidance and stuff to make it easier for vendors to do the right thing. It's just super important. And yeah, I think, I mean, I hope that you're right that there is enough interest in leadership elsewhere to kind of pick up the pieces of this work. But you know, when so many of the technology companies were also American, like, it really made sense that there was a thing that, you know, US Gov was leading, you know, comes with all that kind of respect and also buyer's influence, the way the federal government purchases these things. You know, we've seen influence, cloud services and all sorts of things. So yeah, I certainly hope you're right because there are many, many great bits of work done by CISA and other branches USGov that we hopefully will see other people pick up. I mean, Australia, I think has definitely done a lot of great work with the Essential eight and top four and so on and so forth.

[Tom Uren]

So Bob Lord told Cyber Security Dive that he would continue working on the initiative, like in a private or capacity or wherever he ends up perhaps. So there's some commitment from people involved to keep going. I hope that CISA can keep it up. I'm not sure just based on the size of the expected size of the organization and just that it is a strategic program. If you've got fires to put out, and they will have fires to put out, there's always fires to put out. So just looking at it sort of practically as a manager's point of view, if you've got a lot less people and you've got this important but strategic program, I think it's very easy for it to sit on the back burner. It kind of has to sit on the back burner in that situation.

[Adam Boileau]

Yeah. Certainly much respect to all the people at CISA who've worked so hard on these things. That's. I think that's about us for today, Tom. If people want to head on over to our rescue biz or our website and have a look at Tom's newsletter, there's a bunch of other good stuff. He always has three things that might bring you a little bit of, you know, a little smile, which in this industry you're really going to need. So, yeah, head on over. Subscribe to the newsletter. Check out that and all of our other fine content as we have quite a lot these days. So thanks very much, Tom. You'll be back with Pat next week. But, yeah, thank you. Thank you for your time and for your work.

[Tom Uren]

Thanks, Adam.