Loading threat actor…
Prince Holding Group is a Cambodia-based conglomerate that U.S. authorities have designated as a transnational criminal organization and accused of operating industrial-scale online fraud centered on cryptocurrency investment scams commonly described as pig-butchering. The organization is alleged to have been led by founder and chairman Chen Zhi, also known as Vincent, a Chinese-born businessman who later became a Cambodian citizen. Prosecutors allege the group directly oversaw at least 10 scam compounds in Cambodia from at least 2015 onward, where trafficked laborers were forced through coercion and violence to conduct scripted social-engineering operations over messaging and social-media platforms. The group’s fraud operations allegedly relied on initial unsolicited contact, relationship-building and impersonation, followed by inducement into fraudulent cryptocurrency investments or related payment schemes. Authorities further allege that Prince Holding Group generated extremely large proceeds from these operations and laundered funds through a broad network of affiliated companies, shell entities, offshore structures, casinos, hotels, online gambling businesses, real-estate interests, and other commercial ventures. Reported laundering methods included techniques described by prosecutors as spraying and funneling to obscure the provenance of cryptocurrency proceeds. The organization has been linked to forced-labor scam compounds in Cambodia, especially in Sihanoukville, and to violent abuse of workers who attempted escape or failed to meet expectations. U.S. and UK sanctions have targeted Prince Holding Group, Chen Zhi, and a large network of related entities and executives. The actor is best characterized as a transnational criminal enterprise focused on financially motivated cyber-enabled fraud, cryptocurrency theft by deception, money laundering, and coercive operation of scam infrastructure rather than as a state-sponsored espionage actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Alleged transnational organized-crime operation running industrial-scale "pig butchering"/romance-investment fraud from scam compounds in Cambodia using trafficked/forced labor, laundering proceeds via offshore shell companies and cryptocurrency obfuscation, and collaborating with a U.S.-based fraud network to target U.S. victims.
Alleged transnational organized-crime operation running industrial-scale "pig butchering"/romance-investment fraud from scam compounds in Cambodia using trafficked/forced labor, laundering proceeds via offshore shell companies and cryptocurrency obfuscation, and collaborating with a U.S.-based fraud network to target U.S. victims.
Prince Holding Group is known for orchestrating large-scale cryptocurrency investment scams ('pig butchering'), using forced labor in compounds in Cambodia to target victims globally, laundering illicit profits through real estate, gambling, and crypto mining businesses, and employing violence and coercion against workers.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.