Loading threat actor…
Huione Group is a Cambodia-based illicit financial and cybercrime-enabling enterprise that has operated as a major laundering and service hub for transnational criminal activity. It has been described as combining an online marketplace, money-laundering services, and cryptocurrency trading infrastructure, including support for its own stablecoin ecosystem, and has processed very large volumes of cryptocurrency transactions since 2021. The group has been publicly linked to laundering proceeds from cybercrime, cryptocurrency theft, online investment fraud, and pig-butchering scam operations, and has been sanctioned and cut off from access to the U.S. dollar financial system. Huione Group has been associated with laundering at least billions of dollars in illicit proceeds between 2021 and 2025, including funds tied to scams and investment fraud. It has served as a one-stop-shop for criminal operators by facilitating movement and obfuscation of illicit proceeds and by supporting scam ecosystems with marketplace and payment services. Reporting also links the group to Chinese-language criminal service networks and to Southeast Asian scam infrastructure. The group has additionally been identified as a financial intermediary for North Korean cyber-enabled theft activity. High-confidence reporting links Huione Group to handling cryptocurrency stolen by Lazarus Group and to working with North Korea's Reconnaissance General Bureau to move or convert stolen virtual assets into fiat currency. In this role, Huione Group functioned as a post-theft laundering and cash-out facilitator rather than as the intrusion operator itself. Known names include Huione and Huione Group. A subsidiary, Huione Pay, has been associated with cross-chain cryptocurrency trading and fiat conversion services. Huione Group's observed role is primarily financial facilitation for cybercrime and fraud ecosystems, especially laundering, crypto movement, and support to scam operations, rather than direct network intrusion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Cambodia-based platform used to launder and move billions in funds from crypto thefts, cybercrime, and pig butchering scams. Sanctioned by U.S. officials and reportedly stopped processing withdrawals, but may rebrand or continue operations under a different name.
Huione is a service provider facilitating scam operations by offering AI-powered tools for creating fake personas and providing money laundering services to obfuscate illicit cryptocurrency proceeds.
Huione Group is a Cambodian multinational conglomerate involved in large-scale money laundering, cryptocurrency fraud, and acting as a middleman for North Korea's cybercrime operations, including laundering stolen cryptocurrency and facilitating investment fraud and romance scams ('pig butchering').
Huione Group is a Cambodian multinational conglomerate involved in large-scale money laundering, cryptocurrency fraud, and acting as a middleman for North Korea's cybercrime operations, including laundering stolen cryptocurrency and facilitating investment fraud and romance scams ('pig butchering').
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.