Thai officers intercept Starlink transmitters allegedly headed for Myanmar scam centers

Avatar

Thai law enforcement on Saturday reportedly confiscated 38 Starlink satellite internet transmitters allegedly intended to be used in scam compounds in Myanmar. 

The bust carried out by the Thai Army’s Ratchamanu Task Force and a drug suppression unit is at least the second seizure of Starlink devices in recent weeks. On March 11, police reportedly seized 10 transmitters before they were moved across the border. 

According to the local news outlet Khaosod, officers at a checkpoint in Mae Sot district near the border with Myanmar stopped and inspected a white Isuzu pickup that contained more than three-dozen boxes concealing Starlink receivers, whose use has been documented within scam compounds in Myanmar. 

Organized criminal groups have set up huge compounds near the Thai border where trafficked workers are forced to carry out a variety of scams, like fraudulent cryptocurrency investment schemes. Doing so requires fast internet service as they correspond with a wide net of potential victims. 

In February, the Thai government cut off electricity supply and telecommunications access to a handful of areas in Myanmar in an attempt to curb the booming scamming industry. 

In response to the electricity and telecom cut-offs, the cybercriminal gangs appear to be relying more heavily on satellite internet connections. In February, the head of Thailand’s Digital Economy and Society Ministry said addressing the use of low-Earth orbit satellites for scamming would be elevated to a priority for the ministry. 

That same month, Thai lawmaker Rangsiman Rome called out Elon Musk, the founder of Starlink parent company SpaceX, saying there was “solid proof that cybercriminals in this region are exploiting Starlink for massive fraud.” 

A subsequent Wired investigation reviewed mobile phone data that showed at least eight scam compounds using Starlink devices in the border areas. The data showed hundreds of phones connected to satellite receivers from November 2024 through February. 

A spokesperson for SpaceX did not respond to a request for comment. 

On its website, Starlink says that “transmitting uninvited communications, data or information” as well as “engaging in conduct that is defamatory, fraudulent, obscene, or deceptive” is a violation of its policies and could lead to suspension or termination. 

The company’s satellites are also not supposed to be accessible in countries where it does not have a license to operate, which includes Myanmar. In April 2024, the company sent emails to customers saying that anyone operating in restricted areas would be “unable to connect to the internet” as of the end of the month. 

However, the technology can be sold on the black market and fall into the hands of criminals or other bad actors. 

On Friday, analysts with the U.S.-based international security think-tank Stimson Center called on Starlink to take actions to enforce its policies around acceptable use. Starlink could implement stricter “Know Your Customer” policies for customers and to monitor for suspicious activity “such as multiple logins from known scam regions or unauthorized resales of Starlink hardware.” 

They also called on policymakers to hold technology providers to account for the global scamming phenomenon. 

“Policymakers must coordinate implementation of stronger tech industry regulations to prevent the misuse of satellite and internet services and work with other private sector providers to go after the tools of the trade: malicious ads, spoofed phone calls or text messages, and fraudulent websites,” they wrote.

GovernmentCybercrimeNewsTechnology
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

James Reddick

has worked as a journalist around the world, including in Lebanon and in Cambodia, where he was Deputy Managing Editor of The Phnom Penh Post. He is also a radio and podcast producer for outlets like Snap Judgment.

 

Total
0
Shares
Previous Post

Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication

Next Post

Hackers steal sensitive data from Pennsylvania county during ransomware attack

Related Posts

CISA Warns of Active Exploitation in GitHub Action Supply Chain Compromise

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a vulnerability linked to the supply chain compromise of the GitHub Action, tj-actions/changed-files, to its Known Exploited Vulnerabilities (KEV) catalog. The high-severity flaw, tracked as CVE-2025-30066 (CVSS score: 8.6), involves the breach of the GitHub Action to inject malicious code that enables a remote
Avatar
Read More