Telecom
Sophos Uncovers How Criminals are Leveraging “As-a-Service” Business Model with Sha Zhu Pan Kits to Expand Cryptocurrency Fraud
Sophos, a global leader in innovating and delivering cybersecurity as a service, today revealed how sha zhu pan scammers—those conducting elaborate, romance-based cryptocurrency fraud—are leveraging a business model similar to cybercrime “as-a-service” by selling sha zhu pan kits on the dark web, globally expanding to new markets.
Sophos details these advanced sha zhu pan operations (also known as pig butchering) in the article, “Cryptocurrency Scams Metastasize into New Forms.”
Originating from organized crime gangs in China, the new kits provide the technical components needed to implement a specific pig butchering scheme called “DeFi savings.”
Criminals position DeFi savings scams as passive investment opportunities that are similar to money market accounts, often times to people who have no understanding of crypto. Victims only need to connect their crypto wallet to a “brokerage account,” with the expectation that they will earn significant interest from their investment.
Victims are adding their crypto wallets to a fraudulent cryptocurrency trading pool, which the fraudsters then empty.
“When pig butchering first appeared during the time of the COVID pandemic, the technical aspects of the scams were still relatively primitive and required a lot of effort and guidance to successfully scam victims. Now, as the scams have become more successful and the fraudsters have refined their techniques, we’re seeing a similar evolution to what we’ve seen with ransomware and other types of cybercrime in the past: the creation of an as-a-service model. Pig butchering rings are creating ready-made DeFi app kits, which other cybercriminals can purchase on the dark web. As a result, new pig butchering rings that are unaffiliated with Chinese organized crime groups are appearing in areas like Thailand, West Africa and even the U.S.
As with other types of commercialized cybercrime, these kits lower the entry barriers for cybercriminals interested in pig butchering and vastly expand the victim pool. Last year, pig butchering was already a multi-billion-dollar fraud phenomenon; sadly, the problem is likely only to grow exponentially this year,” said Sean Gallagher, principal threat researcher, Sophos.
Sophos X-Ops has been tracking the evolution of pig butchering schemes for two years. The earliest iterations—dubbed by Sophos as “CryptoRom” scams—involved connecting with potential victims on dating apps and then convincing them to download fraudulent crypto trading applications from third-party sources. For iOS users, these scams required victims to download an elaborate workaround that allowed scammers to bypass security on victims’ devices and gain access to their wallets.
In 2022, the scammers continued to refine their operations, this time finding ways to bypass app store review processes to sneak their fraudulent apps into the legitimate App Store and Google Play Store. This was also the year that a new scam pattern emerged: fake cryptocurrency trading pools (liquidity mining).
In 2023, Sophos X-Ops uncovered two vast pig butchering rings—one based out of Hong Kong and one based out of Cambodia. These rings leveraged legitimate crypto trading apps and created elaborate fake personas to lure victims and steal millions from them. Further investigation revealed that pig butchering operators were adding AI to their arsenal.
At the end of 2023, Sophos X-Ops uncovered a vast liquidity mining operation involving three separate Chinese organized crime rings targeting nearly 100 victims. During the investigation into this operation, Sophos X-Ops first noticed the availability of pig butchering scam kits.
In the most recent pig butchering operations that Sophos X-Ops has investigated, the fraudsters have removed any previous technological impediments, as well as significantly lowered the amount of social engineering required to steal from victims. In the DeFi savings schemes, victims now engage in fraudulent crypto trading through legitimate, well-known cryptocurrency apps and give (albeit unknowingly) the scammers direct access to their wallets. In addition, the scammers can conceal the wallet network that launders stolen crypto, making the scams harder for law enforcement to track.
“The DeFi savings scams are the culmination of two years of pig butcherers refining their operations. Gone are the days when the scammers had to convince victims to download some strange app or transfer the crypto themselves into a soon-to-be-stolen digital wallet.
“The fraudsters have also learned how to better ‘market’ their schemes. They’re taking advantage of how liquidity mining pools operate to steal the funds by telling victims it’s a simple investment account. This is often an easier sell, especially since most people don’t understand the ins and outs of cryptocurrency trading and everything is done under the guise of trusted brands.
“In other words, it’s never been easier for people to fall victim to pig butchering, which means it’s never been more important to be aware that these scams exist—and know what to look out for,” said Gallagher.
Tips to Avoid Falling Prey to Pig Butchering
To avoid falling victim to a pig butchering scam, Sophos recommends the following:
· Be skeptical of strangers that reach out via social networking sites like Facebook or texts, especially if they want to quickly move the conversation to a private messenger like WhatsApp
o This also applies for new matches on dating applications—especially if the stranger begins talking about trading in crypto
· Always be weary of any “get rich quick” scheme or cryptocurrency investment opportunity that promises large returns in a short amount of time
· Be familiar with the lures and tactics of romance scams and investment scams. Non-profits like the Cybercrime Support Network have resources that can help
· Anyone who believes they have fallen victim to a pig butchering scam should immediately withdraw any funds from any affected wallet and contact law enforcement
Timeline of Sophos’ Two-Year Investigation into Pig Butchering
2021
· Sophos X-Ops spots the first “CryptoRom” fake trading apps targeting users in Asia
· Sophos X-Ops then discovers these scammers expanding their operations, targeting victims in the U.S. and Europe
2022
· Sophos X-Ops discovers more fake apps from CryptoRom scams, as well as a new workaround scammers are using so that victims can successfully download the fake apps on their iOS devices
· A new type of pig butchering scam emerges: liquidity mining
2023
· Sophos X-Ops uncovers the first fake apps for CryptoRom schemes found in the Apple App Store as scammers find ways to bypass the app store review process
· Sophos X-Ops uncovers two vast pig butchering rings operating out of Hong Kong and Cambodia. Rather than using fake apps, these scammers are now exploiting legitimate crypto trading applications, as well as building elaborate personas to hook their victims
· Sophos X-Ops finds more fake apps—and learns that pig butcherers are now adding generative AI to their toolkit
· The story of a man who lost $22,000 in a week to a pig butchering scheme leads Sophos X-Ops to a vast liquidity mining scam operation being run by three different Chinese organized crime rings
2024
· Sophos X-Ops uncovers the most technically sophisticated pig butchering scheme yet—“DeFi savings” scams. These schemes and other crypto-based scam operations are for sale as kits, leading to pig butchering rings popping up in new areas of the world
For more about the current DeFi savings schemes and the evolution of pig butchering in “Cryptocurrency Scams Metastasize into New Forms” go to Sophos.com.
Pan African Towers (PAT), a Nigerian infrastructure provider serving 9mobile and Spectranet, has appointed Echezona Osi as chief executive officer.
Echezona Osi
Adefolarin Ogunsanya, company’s, board chairman, explained in a statement that Osi would succeed Oladipo Badru, whose tenure lasted nine months in acting CEO position. Osi has more than 28 years of experience in the telecommunications sector across various regions of Africa.
Prior to his appointment as CEO, he had served as the head of network deployment at Airtel Nigeria, operations director and chief technical information officer at MIC Tanzania, chief technology officer roles at IPT PowerTech Nigeria, Rhino Niger Networks and Biswal Nigeria.
He obtained a degree in electrical/ electronic engineering from the University of Benin and a postgraduate diploma in data science and business analytics from the University of Texas.
Companies sending bulk international text messages, also known as Application-to-Person (A2P) messages, will now have apply for a licence that costs N10 million.
This is part of new rules introduced by the Nigerian Communications Commission (NCC) aimed at cleaning up the system, fighting fraud, blocking spam messages and stopping money from leaving the country unchecked.
These A2P messages are the kind customers get from banks, online stores, hospitals and political campaigns, automated texts sent from apps to their phones.
According to the commission, the bulk international text message system has been poorly regulated, allowing misuse and invasion of privacy.
“The International SMS Service Ecosystem in Nigeria has not been fully brought under regulatory control. It has been observed that the excessive use of the Short Message Service has led to fraud, spam and illegal activities,” the NCC said.
The regulator warned that without action, the problem would worsen as more people use mobile phones and digital services.
To solve this, the NCC is creating a central platform, or gateway, through which all international bulk text messages must pass through.
The agency said this would help to monitor messages in real time, ensure proper fees are paid, and make sure the money stays in Nigeria where it can contribute to the economy.
As part of the incoming change, service providers must follow strict rules, including strong data protection, spam filters, and message encryption.
Also, they must also work with local mobile networks and make sure all messages come from a verified sender
The NCC warned that any message without a proper sender ID will be blocked and not delivered to users.
To protect users from unwanted texts, the new rules say companies must get clear permission before sending any promotional content.
The rule also says people must also be able to choose whether they want to receive such messages or not.
Companies are now required to keep records of all messages for at least six months and must clearly state all charges involved.
The NCC said fees for help requests, cancellations, or service info must be transparent and not include hidden charges.
The commission will issue licences to several providers to encourage healthy competition but may limit new licences if needed.
Only companies that show they can stop fraud and safely deliver messages will be allowed to operate. They must also regularly report their message traffic and finances to the NCC.
It warned that any company that breaks the rules risks getting fined, suspended, or having its licence revoked.
Offences like charging illegal tariffs, ignoring security rules, or avoiding taxes will be punished, the NCC said.
The commission added that the new rules follow the Nigerian Data Protection Act 2023 and support the federal government’s goal of strengthening cybersecurity and controlling Nigeria’s digital space.
The framework will also be reviewed from time to time to keep up with new technology and market trends.
MTN Nigeria has launched what it claims is the country’s largest prefabricated modular data centre, marking a bold push into the country’s fast-growing cloud market and taking aim at global giants such as Amazon Web Services, Microsoft Azure and Google Cloud.
Karl Toriola, CEO, MTN Nigeria.
The shift comes as demand for cloud services in Nigeria soars — driven by the uptake of mobile apps, fintech tools and e-learning platforms — while foreign providers have become costlier in the wake of the naira’s sharp devaluation.
“This is one of the biggest data centres in West Africa and probably one of the biggest in Africa,” said Karl Toriola, CEO, MTN Nigeria.
He described the new Tier III-certified facility, with locally hosted cloud services, as “transformative for the technology ecosystem in Nigeria and very supportive of the federal government’s agenda”.
MTN Nigeria, the country’s largest telecoms provider, has so far invested $120m in the first phase, delivering an IT load of 4.5MW. A second phase, set to double capacity to 9MW, is budgeted at $135m.
“We already have data centres that are running our existing capacities,” Toriola said.
“We will go to 9MW in short order, possibly 14MW, and we can expand even further.”
He said the facility would allow local hosting for tech developers, large enterprises including banks and oil companies, and government agencies — markets long dominated by foreign cloud providers.
“Multinational companies such as Netflix, Facebook and Instagram can also host a lot of their data here. That improves the quality of service and reduces the cost of storage,” he added.
PAT Taps Osi as CEO
Africa Launches PAPSSCARD, First Pan-African Card Scheme
Burna Boy Distances Himself from Meme Coin, Labels Crypto as Fraud
NCC Introduces N10m Licence Fee for Bulk SMS Service
MTN Nigeria Targets $1Bn Cloud Market with Largest Modular Data Centre
Broadcasting1 day agoNigeria Week Ahead: Inflation, Oil and Naira in focus
News1 day agoEFCC: Accusations Against Our Chairman Are Baseless and Misleading
General News4 hours agoWoodhall Capital and Partners Launch ₦1.5Bn Fund
Broadcasting6 hours agoA Billion-Dollar Obsession in 90-Second Bites
General News4 hours agoAM Best Reaffirms Stable Outlook for Cyber Insurance Market
News4 hours agoFirstBank, NLNG, Shell back QEDNG Creative Powerhouse Summit
News4 hours agoExperts Urge MSMEs to Build Strong Partnerships in Solving Problems,
E-Financial4 hours agoAfrica Launches PAPSSCARD, First Pan-African Card Scheme