US announces ‘strike force’ to counter Southeast Asian cyber scams, sanctions Myanmar armed group

The U.S. is establishing a strike force to target cyber scam compounds across Southeast Asia that have stolen billions from Americans over the last five years. 

The Treasury Department said the Scam Center Strike Force will consist of agents and lawyers from the Justice Department, Secret Service, State Department and FBI.  

The force will “investigate, disrupt, and prosecute the most egregious Southeast Asian scam centers and their leaders, with a focus on Burma, Cambodia, and Laos.” 

The agencies plan to use sanctions, seizures and criminal prosecutions to disrupt the scam centers while also providing some form of restitution to victims and education about how to avoid the scams. 

The government estimates U.S. residents lost at least $10 billion in 2024 to Southeast Asia-based romance schemes, fictitious investment scams and fraudulent cryptocurrency platforms. Only a fraction of victims contact the FBI and few are ever able to get their money back — with many people losing their entire life savings. 

U.S and Chinese law enforcement agencies have targeted some of the bad actors across Cambodia, Thailand, Myanmar and other countries for their role in the scam center economy, which relies heavily on victims of human trafficking.  

“Criminal networks operating out of Burma are stealing billions of dollars from hardworking Americans through online scams,” said senior Treasury Department official John Hurley. “These same networks traffic human beings and help fuel Burma’s brutal civil war. The Administration will keep using every tool we have to go after these cybercriminals — wherever they operate — and to protect American families from their exploitation.”

The Treasury also announced sanctions Wednesday on an armed group that supports cyber scam compounds in Myanmar, as well as several companies in Thailand used by Chinese gangs to build the compounds. 

The Democratic Karen Benevolent Army (DKBA) and three of its leaders were targeted by the Office of Foreign Assets Control. DKBA is one of several groups supporting Myanmar’s ruling military regime and is led by commander-in-chief Saw Steel, adjutant general Saw Sein Win, and chief of staff Saw San Aung.

The sanctions also include Thai national Chamu Sawang, Trans Asia International Holding Group Thailand Company and Troth Star Company. The three are accused of serving as a link between the armed groups in Myanmar and Chinese organized crime groups and helping DKBA and other local armed groups develop the scam centers. 

U.S. officials said the revenue generated by the scam center workers goes towards organized crime and to finance the efforts of the armed groups in the still-raging civil war that has engulfed Myanmar. 

The Treasury said investigators traced some stolen money back to Tai Chang — a cyber scam compound near Myawaddy in Myanmar’s Karen State. The compound is in DKBA territory and is controlled by Sai Kyaw Hla, a brigadier general in the DKBA. 

The scam center is also supported by Trans Asia, which according to the Treasury serves as a Thailand-based front company for Chinese criminal organizations. Trans Asia has signed other land lease contracts with sanctioned groups to develop scam compounds, including the Huanya compound and the notorious KK Park compound.

The DKBA allegedly secures the Tai Chang compound and abuses human trafficking victims forced to work at the compound. 

“DKBA soldiers have been filmed beating handcuffed scam workers. Rescued victims have claimed that they were subjected to electric shocks, being hung by their arms inside dark rooms, and other brutal treatment,” the Treasury Department said.  

“For its participation in these scam operations, the DKBA receives funding that it uses to support its ongoing illicit activities. The DKBA partners with Chinese organized crime on drug, human, arms, and wildlife trafficking, as well as money laundering.”

Jason Tower, former Myanmar head at the United States Institute of Peace, told Recorded Future News last year that law enforcement efforts in 2023 and 2024 pushed much of the scam center activity in Myanmar from Kokang to the southern Shan and Karen states. 

He warned that Chinese gangs were moving to partner with groups like the DKBA and said at the time that compound construction in Tai Chang was “booming.” 

In September, the Treasury Department sanctioned another local group called the Karen National Army for its work on cyber scam centers located in Shwe Kokko — a notorious town on the border with Thailand that has become a scam center hub since the onset of the country’s civil war. 

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Google files lawsuit to disrupt massive ‘Lighthouse’ smishing scheme

Next Post

Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

Related Posts

⚡ Weekly Recap: Chrome 0-Day, AI Hacking Tools, DDR5 Bit-Flips, npm Worm & More

The security landscape now moves at a pace no patch cycle can match. Attackers aren’t waiting for quarterly updates or monthly fixes—they adapt within hours, blending fresh techniques with old, forgotten flaws to create new openings. A vulnerability closed yesterday can become the blueprint for tomorrow’s breach. This week’s recap explores the trends driving that constant churn: how threat
Read More

HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet FortiGuard Labs researcher Pei Han Liao said. "By using convincing language and small character
Read More

Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control

Cybersecurity researchers have disclosed a stealthy new backdoor called MystRodX that comes with a variety of features to capture sensitive data from compromised systems. "MystRodX is a typical backdoor implemented in C++, supporting features like file management, port forwarding, reverse shell, and socket management," QiAnXin XLab said in a report published last week. "Compared to typical
Read More