Loading threat actor…
UWORK is a criminal service provider in the pig-butchering-as-a-service ecosystem that supplies content and agent-management tooling for online investment fraud operations. It is associated with turnkey scam enablement rather than a standalone intrusion set or nation-state campaign. Its offerings include prebuilt templates for fraudulent investment websites designed to help operators rapidly deploy convincing scam portals at low cost and manage victim-facing agents at scale. The tooling associated with UWORK supports core fraud operations through website content management and agent administration. Reported functionality in this ecosystem includes investment-site templates, know-your-customer collection workflows used to solicit identity documents from victims, and administrative panels that provide centralized operational oversight. Such panels can support user and agent management, hierarchical affiliate-style agent structures, communications tracking, and profitability monitoring, enabling organized scam centers to coordinate large numbers of operators. UWORK fits into a broader specialization trend in which service providers lower barriers to entry for romance-baiting and investment scams by selling modular infrastructure, management platforms, and related operational support. Its role is best characterized as enabling initial victim engagement, social-engineering operations, and downstream collection of victim data for financial fraud. High-confidence reporting supports UWORK as a seller of scam-site content and agent-management tools; additional attribution, geography, and victimology are not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.