China continues Pig-Butchering Crack-down

One of my techniques for keeping current on Cybercrime trends is having an "interesting" collection of international news ticklers. This story came to me via X:CyberScamMonitor via a QQ account called "onCambodia." @CyberScamMonitor is a Twitter/X account and Substack account dedicated to tracking online scam and gambling operations in Southeast Asia and documenting human trafficking and human rights abuses. Great work and a strong recommendation to follow if you wish to learn more about the links between #CryptoScams and #PigButchering.

I apologize to the original journalist as I have been unable so far to find the original to give them full credit. For reference, the Chinese article I refer to provides the source as 来源：鲁中晨报 (Source: Luzhong Morning News). The headline is: "Chinese woman was arrested after returning to China! Uncovering the financial backers of a fraud syndicate in Sihanoukville." If anyone has a link to the Luzhong Morning News version, please comment and I will update! This post is mostly just a retelling of their story in English!

The story told, in my opinion, should have the headline "Diligent Police Task Force won't stop tracking Fraudsters!" This story features the Yiyuan County Police who started with a telecom fraud case in their jurisdiction and followed it until they had wrapped up the entire organization and seized 200 million yuan from the criminals, 1/4th of it in cash, but also in real estate, luxury cars, watches, and liquour. That's over $28 Million USD! The case started with a local business who found that one of their employees had sent out 38 million yuan in just a few days. The employee was being extorted after installing a porn-dating app on his phone -- when the criminals learned where he worked they demanded that he send money from his company as well. 

 The case was taken up by the "3.01" Task Force. Yiyuan County is administered as part of Zibo City in Shandong Province of China. Police officers from county, city, and provincial level work together on the 3.01 Task Force.  (Shandong is in the east of China, across the Yellow Sea from South Korea.) The deputy magistrate of Yiyuan, Zhang Xiuguang (张秀光), takes an approach to cybercrime that reminds me of the work of the Garda National Economic Crimes Bureau in Ireland!  Zhang says "Since we established the task force, we have firmly believed that we must recover the losses and hit the core.  From catching the first culprit, we will not withdraw our troops until the case is solved!"

(map of Zibo City from medical article by Lili Liu and Ling Wang)

The case dragged on at a very slow pace, Yiyuan deputy director of public safety Ma Wencheng (马文成) described it as involving the tracing of funds from thousands of accounts and peeling back each account like peeling layers from bamboo shoots. Even with a 100 person task force, very little progress was being made, but that changed with a key arrest on 31AUG2022. The key piece of evidence as a suspicious mobile phone number. Among all of the hundreds of thousands of scraps of evidence, there was a telephone number belonging to a woman in Cambodia. Recognizing that Cambodia is the home of many telecom fraud rings, the head analyst for the task force, Lu Lu, focused on the owner of that number. The decision was made to wait for her to return to China. The police have assigned this key figure the alias Xie Xiaofang. When they learned that Xie was returning to China, the task force rushed to Zhengzhou in Henan Province and arrested her as she was leaving quarantine.

As she was questioned, Xie Xiaofang revealed that her #PigButchering group was based in the Chinatown setion of Sihanoukville, Cambodia. Her job within the organization was laundering the money, but she claimed despite her key role, she only knew middle managers in the gang, and then only by alias. The 3.01 Task Force team began tracking each person traveling to China from Sihanoukville and asking Xie Xiaofang to identify them. Within a few weeks, they had mapped out the leadership of the organization. On 17SEP2022, the team traveled to Jiangxi, Yunnan, Fujian, and other places, arresting two more key members and seven others, followed in quick succession by dozens more, eventually totaling 135 arrests. At this point, the Shandong Provincial Public Security Department thought it was time to reward their team.  The photo below shows the public ceremony where all of the local dignitaries publicly praised the work of the 3.01 Task Force, who had at this point seized 8.5 million yuan (about $1.1 million) and had key leaders of the gang in custody. 

(source: https://zibo.sdchina.com/show/4733923.html ) 

But the team was not done yet. As they interrogated those who had been arrested so far, they realized that there was still a bigger boss. The police assigned him the alias Tang Xiaowei, but they were cautioned by their current detainees that this guy has a "very strong sense of anti-reconnaissance." He only uses cash. He doesn't use mobile phones. He doesn't use credit cards.  He doesn't have a fixed address. But he was known to have a favorite place in Xiamen.  The head analyst, Lu Lu, however, believed that Tang would know about the arrests and would be looking for a way to get out of the country safely, and in the mountains of evidence, Lu Lu believed there was a clue to his exit point. Someone under their surveillance had arranged for a large party in "an Internet celebrity hotel" in Guilin, Guangxi. Lu Lu was confident this would be for Tang. 

Speeding down the highway for nearly 1200 miles with members of the 3.01 task force, Lu Lu's vehicle fell into a pit related to some road construction, but they acquired another vehicle and continued on through the night. They arrived just in time to arrest Tang and his closest associates!  It turned out that Tang and his gang were leaving for the coast that morning where a boat was waiting to smuggle them out of the country and back to Cambodia!  They had the actual top kingpin in their hands and now they could finally pull apart the entire organization.  

Based on the information they acquired, additional arrest teams were sent to Beijing, Shanghai, Tianjin, Guangxi, Hebei, Henan, Guizhou and other cities where 18 teams assigned to different roles for the organization were arrested.  Three technical teams, 1 "payment on behalf" gang, and 14 "point running" gangs totaling 197 additional criminal suspects.  Boxes and suitcases loaded with cash were seized.

While the case that started with the Yiyuan County Police investigating one employee who seemed to be embezzling funds, it led to 38 million yuan ($5.3 million USD) being returned to citizens in Yiyuan and Zibo City and has spawned countless additional investigations as the national and international connections are still being traced. 

This is what COULD happen if we follow the model of the brave Yiyuan Police (the same model which the Garda National Economic Crime Bureaus follows!)  DON'T STOP.  DON'T take your local arrests and be happy with them.  FOLLOW EVERY LEAD.  

We'll close with this quote from Zhang Xiuguan ... 

"No matter how far you run, the Yiyuan police are not afraid of hardships and dangers.  They will catch you no matter how far you go!" 

Resources:

• https://mp.weixin.qq.com/s/IZJMXYTkKF8H0lksAHNOjQ
• https://twitter.com/johnwSEAP/status/1729426989310980377
• https://zibo.sdchina.com/show/4733923.html

Please stop calling all Crypto Scams "Pig Butchering!"

 Lately there has been a media-driven craze in the fraud community to call every crypto-investment scam "Pig Butchering."  I hope you will join me in canceling that term after you read this article.

The term "Pig Butchering" comes from the Chinese term 杀猪盘 (Shā zhū pán or "butchering plate.") While the term has been used in Chinese media since at least 2018, it really became famous after the courageous actions of a human trafficking victim who was caught up in the game.

Hao Zhendong (郝振东) was recently divorced and had lost custody of his daughter as he was facing personal financial challenges and could not care for her.  During his time of desperation, he received a message from his uncle.  The uncle told him that he should come to Myanmar and join him at his work.  He claimed that Zhendong would be able to easily earn 60,000 to 70,000 yuan per month. 

Image from "Talking to Strangers" interview 

Late in 2020, Zhendong traveled to the Yunnan province of China where he paid smugglers to help him cross in to Myanmar.  After traveling with them for several days, he was forced to march through the jungle and up a steep hill for six hours.  When he arrived, he found he was in a work camp.  In his words, he says he realized he had "fallen into a wolf pit." The work camp was an industrial park where various call center employees worked scams. 

The northern region of Myanmar has four special zones, including "Wa State." So many Chinese people have moved to Wa State that Chinese is actually one of the official languages.  The corrupt local government, having no natural resources, opened their arms wide and welcomed criminal enterprises, which they call "foreign investors" to set up call centers. Under local law in Wa State, Myanmar, telecommunications fraud is not a crime. So many scammers have moved to the region that the government has even "rented" entire schools to be used as scam call centers.  The Myanmar government estimates that there are 140,000 Chinese living in the region, and that most of them are engaged in telecommunications fraud.  Similar to other forms of human trafficking, the men are only allowed to leave if they pay back the "investment" that their controllers have made in them.  The fee to leave ranges from 50,000 to 120,000 depending on how long you have worked. If you can't pay the fee after three months, you have six months added to your stay, with armed guards preventing you from leaving the work camp.  Many do go back to China, and enough go back with money for houses, cars, and a wife, that others are tempted into following in their footsteps.

Zhendong says that he often considered attempting to flee, but northern Myanmar is an "extrajudicial land" and Chinese people are regularly kidnapped and killed there with no consequence to their attackers.  One man who attempted to flee was forcibly returned to the camp, with the fingers on one hand amputated. 

In the work camp where Zhendong was enslaved, there were three buildings.  Two were dormitories and the call center was housed in the "Science and Technology Building." Each team was assigned to different topics.  Some worked lottery scams, others foreign currency exchange scams, naked chat / extortion scams, pornography scams, etc.  But Zhengdong was assigned to a "pig-killing gang." 

He was provided a manual which described his role.  His job was to target victims on the Internet and use emotions to convince them to invest their entire net worth in illegal online gambling.  His job as a "recruiter" for these scams was referred to in the manual as a "dog pusher" (“狗推” Gǒu tuī.)

He was provided three mobile phones and three "love story" script books.  His job was to find wealthy single or divorced women on social networks, and add at least two to his chat each day and build a romantic relationship with them online.  Once they were suitably "hooked" into his romance, he was supposed to turn them over to his team leader, who had 30-40 "dog pushers" under him to "kill." If the victim provided more than a million dollars, there was a celebration and the dog pusher was rewarded extravagantly. 

While he was learning the role, "the company" became very excited about a successful scam that one of the other dog pushers had accomplished.  He had convinced a young woman in Shanghai to invest her entire life savings - 2.92 million yuan - and when she realized she had been scammed, she committed suicide by jumping off a roof.  Another woman was convinced to sell her car and her house in order to invest more.  While the company thought these were great examples to emulate, Zhendong's spirit died.  He realized that he had to try to do something about this. 

On one point, his uncle had been telling the truth.  The company used cash bonuses as incentives, and each month they would spread millions of yuan on the table and pay out bonuses.  Some made the equivalent of hundreds of thousands of dollars in bonuses.  But Zhendong couldn't do it. 

He began sneaking up on the roof, using a stolen phone, and messaging his victims - explaining to them that he was enslaved and being forced to scam them.  Because he was failing to earn, his controllers were becoming very angry with him and his life was actually in danger. 

A potential victim, Yang Yu, changed things for him.  When he called Yang Yu to warn him, Yang Yu asked him "How can I help you get home?" In order to protect Zhendong, Yang Yu passed him money that he could give to his controllers as proof that he was working. Then Zhendong stole a list of victims from the company and urged Yang Yu to take it to the police. 

In February 2021, she took a list of 18 victims to the Anti-Fraud Center of Nanchang Public Security Bureau. 

Tao Jiangjiang, the leader of an Electronic Fraud task force who helped Zhendong get home

Tao Jiangjiang began to communicate with Zhendong and a rescue mission was arranged through the Yunnan police, working with an informant in Myanmar.  Despite being advised not to take any risks by Tao Jiangjiang, Zhendong felt that he could not leave empty-handed.  He worked to observe the password his Pig Killer boss used to log in to the company server and late one night logged in and wrote down as many names as he could.  When he arrived back in China, he had a list of 105 additional victims with him who were contacted and assisted by the Chinese police. 

There was a dramatic event at the China-Myanmar Nansha Port when Zhendong recognized a man from the company chasing after him.  When armed Chinese police took custody of Zhendong, the company man backed off. After this, Zhendong did many media interviews, some alongside the Electronic Fraud police, which helped to popularize the term "Pig Butchering." 

While there are definitely "Dog Pushers" and "Pig Killers" who are targeting the Chinese ex-patriat community, unless your scammer is speaking Chinese from a call center in Myanmar, you may be a fraud victim, but you are not a victim of "Pig Butchering." 

---

The main sources for this story were the Chinese versions of Zhendong's misadventure, especially these two: 

荐见 | 反水、救赎、卧底：逃出缅北“杀猪盘”

(Rebellion, redemption, and undercover work: escape from the "pig killing" center in northern Myanmar - an article by “荐见美学” ) 

and

误入杀猪盘团伙后，他偷出了105名受害者名单丨和陌生人说话

("After accidentally entering the pig killing gang, he stole a list of 105 victims" in the TenCent column, "Talking to Strangers" - if you speak Chinese there is a great interview here!)