Criminal Networks Get a Boost from New Pig-Butchering-as-a-Service Toolkits
The scam industry has experienced significant changes over the past decade. The traditional image of a Nigerian prince conducting scams is now outdated.
The scam industry has experienced significant changes over the past decade. The traditional image of a Nigerian prince conducting scams is now outdated.
The rise of service providers supplying criminal networks with tools, infrastructure, and expertise has fueled the ongoing "pig butchering" epidemic, enabling these networks to scale significantly.
While Western Africa remains a center for digital fraud, large-scale scam operations have emerged in Southeast Asia, surpassing others in both scale and efficiency.
Over the past decade, major Chinese-speaking criminal groups have infiltrated Southeast Asian countries, establishing special economic zones dedicated to criminal operations.
These networks have developed sophisticated global money laundering and human trafficking operations, staffing these complexes with thousands of coerced workers conducting scams from bases in Cambodia, Laos, Myanmar, the Philippines, and beyond.
These providers have noted a burgeoning pig butchering-as-a-service (PBaaS) economy, similar to malware and phishing-as-a-service models that support global cybercrime.
Research has identified two specific actors within the PBaaS ecosystem. The first, known as the "Penguin Account Store" or "Heavenly Alliance," provides materials necessary for social engineering operations central to these crimes.
The second, "UWORK," supplies the technical platforms required to manage scams and their agents on a large scale.
The traditional image of a Nigerian prince conducting scams is now outdated.
The Penguin operation began with a database of personally identifiable information of Chinese citizens, typically acquired through corruption or hacking. This extensive data, including bank records, travel history, and political information, allows scammers to target wealthy victims with precision.
The group offers a comprehensive toolkit: pre-registered social media accounts starting at $0.10, bulk SIM cards, stolen credentials, 4G/5G routers, and "character sets" containing stolen social media profile pictures used to deceive victims.
Penguin also offers an SCRM AI platform to automate the scamming process, along with BCD Pay, an anonymous peer-to-peer payment solution with roots in illegal online gambling.
UWORK operates within a different niche, providing centralized control over multiple agents through comprehensive customer relationship management tools.
Chinese criminal actors arrested in February 2025 for defrauding victims of over $13 million used UWORK's products.
The admin panel offers tools for large-scale operations: multiple email templates, user and agent management, profitability metrics by individual agent, and tools designed to evade detection.
Victims are required to upload identity proof through a Know Your Customer panel, information that is then used for future fraud schemes.
Complete PBaaS packages, including websites, VPS hosting, mobile apps, trading platform integration, company incorporation in tax havens, and financial regulator registration, cost as little as $2,500.
Such low entry barriers, combined with potential returns exceeding 70,000%, make pig butchering schemes economically attractive to criminal enterprises.
The decentralized service-based model allows rapid scaling while complicating attribution, as numerous criminal networks utilize identical templates.
As PBaaS continues to evolve, these scams are expected to become increasingly automated, global, and adaptive.
Countering this ecosystem requires a strategic shift toward targeting the service providers, facilitators, and infrastructure that enable large-scale fraud.
Based on reporting by GBHackers.
