It’s so weird, any time an unknown number texts me like they know me, the conversation stops as soon as I ask for crypto investment advice 🤔

#pigbutchering #shazhupan

@NataliaZuo RT by @JessiePang0125: NEW INVESTIGATION FROM #BBCEYE Each year, people around the world lose millions of dollars to “the pig butchering romance scam”. #pigscam #shazhupan #杀猪盘 https://nitter.hongkongers.net/NataliaZuo/status/1633522027473653761#m

@NataliaZuo RT by @badiucao: NEW INVESTIGATION FROM #BBCEYE Each year, people around the world lose millions of dollars to “the pig butchering romance scam”. #pigscam #shazhupan #杀猪盘 https://nitter.hongkongers.net/NataliaZuo/status/1633522027473653761#m

SophosLabs IoCs

There are some interesting domains, plus the coin addresses, the SHA256 hashes, subdomain urls too.

#SophosLabs #IoCs #indicators #indicatorsofcompromise #cybersecurity #security #shazhupan #fakeapps #csv #packetrat #thepacketrat #infosec #OSINT #tech #threat #research

https://github.com/sophoslabs/IoCs/blob/master/ShaZhuPanfakeapps.csv

https://news.sophos.com/en-us/2023/02/28/sour-grapes-stomping-on-a-cambodia-based-pig-butchering-scam/

Headed home from Team Cymru’s RISE-USA event a touch early because of travel weirdness. A full report on my talk (slightly redacted from TLP:Amber stuff I presented) posts on Monday, just before Valentines Day. Appropriately, given the content. #shazhupan #PigButchering

The #shazhupan scammer mentioned earlier.

#shazhupan #cryptoscams #scambaiting #emptiness

Today, I got a video call on Telegram from my scammer. She is the person, or at least is visually very close to, the person in all the photos I've been getting. It was clear from the white background and other factors that she was in an office , probably in a booth designed for such calls. She mostly wanted to talk about whether I had downloaded the wallet and if I was ready for her to "teach" me how to invest.

I sent fake screenshots showing I had bought 2200 USDT (I bought 2 to get the proper layout for the balance screen). After it was done, I had the wallet addresses associated with this particular scam, and finally had the last of my IoCs. But I felt emotionally void. What a life these scammers must lead,.

I cannot tell from demeanor whether the scammer is one of those who have had their passports taken away by the gangs that run these scams in Cambodia or if she was an entrepeneur. Her English was good and not accented, and did not match the English usage of some of the chat messages, so I have some indication that this is a farm operation.

I will say that it appears at least one of the wallets involved in this scam, which is only a month or so old, has had$1.8 m worth of crypto flow through it. So there are still a lot of people falling for these scams, More to come as I get my report ready for publication.