Criminals Use Sha Zhu Pan Kits for Global Cryptocurrency Fraud

Sophos has uncovered a concerning trend where scammers involved in elaborate romance-based cryptocurrency fraud, known as sha zhu pan, are adopting a business model akin to cybercrime “as-a-service.” These scammers are now peddling sha zhu pan kits on the dark web, effectively broadening their reach to new territories. Sophos delves into the intricacies of these sophisticated sha zhu pan operations, shedding light on a specific scheme dubbed “DeFi savings,” originating from organized crime syndicates in China.

The DeFi savings scams masquerade as passive investment opportunities, resembling traditional money market accounts, and often target individuals with limited knowledge of cryptocurrency. Victims are enticed to connect their crypto wallets to what appears to be a legitimate “brokerage account,” with the promise of earning substantial interest. However, unbeknownst to them, they are actually adding their wallets to a fraudulent cryptocurrency trading pool, ultimately falling prey to fraudsters who drain their assets.

Sean Gallagher, principal threat researcher at Sophos, draws parallels between the evolution of pig butchering scams and other forms of commercialized cybercrime. Initially, these scams required significant effort and expertise to execute successfully. However, with the advent of ready-made DeFi app kits available for purchase on the dark web, the barrier to entry has significantly lowered, enabling the proliferation of new pig butchering rings globally, independent of their Chinese origins.

Sophos X-Ops has been monitoring the evolution of pig butchering schemes for two years, witnessing the transition from early CryptoRom scams to more sophisticated tactics involving fake cryptocurrency trading pools. Recent investigations have unveiled the integration of artificial intelligence by pig butchering operators, further complicating efforts to combat these fraudulent activities.

In the latest iterations of pig butchering operations, scammers have streamlined their techniques, minimizing technological hurdles and reducing the need for extensive social engineering. Victims are now unwittingly engaging in fraudulent crypto trading through established cryptocurrency apps, granting fraudsters direct access to their wallets. Moreover, scammers are adept at concealing the intricate network of wallets used to launder stolen crypto, posing challenges for law enforcement agencies.

Gallagher emphasizes the urgency of raising awareness about these scams and advises vigilance to avoid falling victim. To safeguard against pig butchering scams, Sophos recommends exercising skepticism towards unsolicited communication, particularly on social networking sites and dating apps, and being cautious of unrealistic investment opportunities promising high returns. Victims of such scams are urged to withdraw funds from affected wallets immediately and report the incident to law enforcement authorities.