US announces ‘strike force’ to counter Southeast Asian cyber scams, sanctions Myanmar armed group

The U.S. is establishing a strike force to target cyber scam compounds across Southeast Asia that have stolen billions from Americans over the last five years. 

The Treasury Department said the Scam Center Strike Force will consist of agents and lawyers from the Justice Department, Secret Service, State Department and FBI.  

The force will “investigate, disrupt, and prosecute the most egregious Southeast Asian scam centers and their leaders, with a focus on Burma, Cambodia, and Laos.” 

The agencies plan to use sanctions, seizures and criminal prosecutions to disrupt the scam centers while also providing some form of restitution to victims and education about how to avoid the scams. 

The government estimates U.S. residents lost at least $10 billion in 2024 to Southeast Asia-based romance schemes, fictitious investment scams and fraudulent cryptocurrency platforms. Only a fraction of victims contact the FBI and few are ever able to get their money back — with many people losing their entire life savings. 

U.S and Chinese law enforcement agencies have targeted some of the bad actors across Cambodia, Thailand, Myanmar and other countries for their role in the scam center economy, which relies heavily on victims of human trafficking.  

“Criminal networks operating out of Burma are stealing billions of dollars from hardworking Americans through online scams,” said senior Treasury Department official John Hurley. “These same networks traffic human beings and help fuel Burma’s brutal civil war. The Administration will keep using every tool we have to go after these cybercriminals — wherever they operate — and to protect American families from their exploitation.”

The Treasury also announced sanctions Wednesday on an armed group that supports cyber scam compounds in Myanmar, as well as several companies in Thailand used by Chinese gangs to build the compounds. 

The Democratic Karen Benevolent Army (DKBA) and three of its leaders were targeted by the Office of Foreign Assets Control. DKBA is one of several groups supporting Myanmar’s ruling military regime and is led by commander-in-chief Saw Steel, adjutant general Saw Sein Win, and chief of staff Saw San Aung.

The sanctions also include Thai national Chamu Sawang, Trans Asia International Holding Group Thailand Company and Troth Star Company. The three are accused of serving as a link between the armed groups in Myanmar and Chinese organized crime groups and helping DKBA and other local armed groups develop the scam centers. 

U.S. officials said the revenue generated by the scam center workers goes towards organized crime and to finance the efforts of the armed groups in the still-raging civil war that has engulfed Myanmar. 

The Treasury said investigators traced some stolen money back to Tai Chang — a cyber scam compound near Myawaddy in Myanmar’s Karen State. The compound is in DKBA territory and is controlled by Sai Kyaw Hla, a brigadier general in the DKBA. 

The scam center is also supported by Trans Asia, which according to the Treasury serves as a Thailand-based front company for Chinese criminal organizations. Trans Asia has signed other land lease contracts with sanctioned groups to develop scam compounds, including the Huanya compound and the notorious KK Park compound.

The DKBA allegedly secures the Tai Chang compound and abuses human trafficking victims forced to work at the compound. 

“DKBA soldiers have been filmed beating handcuffed scam workers. Rescued victims have claimed that they were subjected to electric shocks, being hung by their arms inside dark rooms, and other brutal treatment,” the Treasury Department said.  

“For its participation in these scam operations, the DKBA receives funding that it uses to support its ongoing illicit activities. The DKBA partners with Chinese organized crime on drug, human, arms, and wildlife trafficking, as well as money laundering.”

Jason Tower, former Myanmar head at the United States Institute of Peace, told Recorded Future News last year that law enforcement efforts in 2023 and 2024 pushed much of the scam center activity in Myanmar from Kokang to the southern Shan and Karen states. 

He warned that Chinese gangs were moving to partner with groups like the DKBA and said at the time that compound construction in Tai Chang was “booming.” 

In September, the Treasury Department sanctioned another local group called the Karen National Army for its work on cyber scam centers located in Shwe Kokko — a notorious town on the border with Thailand that has become a scam center hub since the onset of the country’s civil war. 

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Google files lawsuit to disrupt massive ‘Lighthouse’ smishing scheme

Next Post

Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

Related Posts

ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics

Cybersecurity researchers have discovered a new phishing campaign undertaken by the North Korea-linked hacking group called ScarCruft (aka APT37) to deliver a malware known as RokRAT. The activity has been codenamed Operation HanKook Phantom by Seqrite Labs, stating the attacks appear to target individuals associated with the National Intelligence Research Association, including academic figures
Read More

RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware

The threat actors behind a malware family known as RomCom targeted a U.S.-based civil engineering company via a JavaScript loader dubbed SocGholish to deliver the Mythic Agent. "This is the first time that a RomCom payload has been observed being distributed by SocGholish," Arctic Wolf Labs researcher Jacob Faires said in a Tuesday report. The activity has been attributed with medium-to-high
Read More

⚡ Weekly Recap: Bootkit Malware, AI-Powered Attacks, Supply Chain Breaches, Zero-Days & More

In a world where threats are persistent, the modern CISO’s real job isn't just to secure technology—it's to preserve institutional trust and ensure business continuity. This week, we saw a clear pattern: adversaries are targeting the complex relationships that hold businesses together, from supply chains to strategic partnerships. With new regulations and the rise of AI-driven attacks, the
Read More