Loading story…
Cambodian authorities shut down 190 online scam centers as part of an intensified national crackdown on transnational fraud operations, according to government statements cited by Reuters. The enforcement action reportedly included the arrest of 173 senior figures and the deportation of roughly 11,000 foreign nationals, reflecting the scale and international composition of the scam-compound ecosystem operating in the country.
The reporting was published as part of an ISMG “breach roundup” that also briefly noted other, separate security developments (including the European Parliament disabling AI tools on lawmakers’ devices, a Notepad++ updater supply-chain exposure being patched, an Apple iOS zero-day fix, and emergency remediation for an actively exploited BeyondTrust RCE, among others). Those items were presented as additional headlines rather than as part of the Cambodia enforcement action.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Dell issued a patch for CVE-2026-22769 in RecoverPoint for VMs after reports that the zero-day had been exploited since mid-2024. The vulnerability was linked to suspected China-aligned intrusion activity.
BeyondTrust released emergency fixes for critical remote code execution vulnerability CVE-2026-1731. The flaw was reported as actively exploited at the time of disclosure.
Apple released a fix for CVE-2026-20700, a dyld flaw in iOS that was being actively exploited. The company said the bug was used as part of a sophisticated exploit chain.
SOCRadar published details on Operation DoppelBrand, a phishing and initial-access campaign attributed to actor GS7. The operation used cloned portals and remote management tools to compromise victims and monetize access.
Notepad++ released version 8.9.2 to strengthen the security of its software updater following supply-chain concerns. The release also fixed vulnerability CVE-2026-25926.
Threat actor ShinyHunters allegedly offered or extorted customer data said to belong to Canada Goose. Canada Goose disputed that the exposed data originated from its own systems.
The European Parliament decided to disable built-in AI features on devices used by lawmakers. Officials cited cybersecurity, privacy, and data-sovereignty concerns, particularly around cloud-based processing.
Cambodian authorities carried out a large-scale crackdown on transnational online scam centers, shutting down 190 sites, arresting senior figures, and deporting about 11,000 foreign nationals. The action was also linked to concerns about trafficked and forced labor in scam compounds.
A suspected China-linked group, identified as UNC6201, reportedly began exploiting Dell RecoverPoint for VMs zero-day CVE-2026-22769 in the wild. The activity involved web shells and multiple malware families to maintain persistence on victim systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and policy groups are intensifying efforts against **transnational online scam operations** centered in Southeast Asia, particularly Cambodia, where criminal networks have been linked to fraud compounds, human trafficking, and abuse of workers. Reporting highlights recent enforcement actions including Cambodia's extradition of **Chen Zhi** to China, a new U.S. executive order targeting cyber-enabled fraud, and a Thai-led operation with international partners and **Meta** that removed **150,000** fake profiles and arrested **21** suspects tied to scam activity. The broader picture is that scam syndicates are adapting quickly, shifting locations, fragmenting into smaller cells, and exploiting gaps between law enforcement, regulators, and private-sector platforms. On-the-ground reporting from Cambodia describes the human cost inside alleged scam compounds, including forced labor, torture, and coercion of workers recruited under false pretenses. One former guard said he was ordered to use electric shocks and beat Chinese workers inside a heavily secured compound on Bokor Mountain, even as publicized crackdowns were underway elsewhere. That account reinforces concerns that abrupt enforcement alone can displace operations while leaving trafficked workers vulnerable and limiting intelligence collection on how the scam ecosystem functions. A separate report on fake shipment-tracking phishing in the Middle East and Africa is **not** part of the same event, as it covers a different scam trend and geography rather than the Cambodia-centered scam-compound crackdown.
Jun 29, 2026
A new **UNODC assessment** says transnational scam networks rooted in Southeast Asia have grown into a global organized-crime force, defrauding victims across East Asia, Southeast Asia, Australia, and New Zealand of an estimated **$88 billion to $114.1 billion in 2025**. The report describes a sophisticated ecosystem dominated by Chinese-origin criminal groups that extends beyond cyber-enabled fraud into cryptocurrency-based settlement networks, criminal infrastructure, trafficking of workers from more than 80 countries, and other illicit goods and services. It identifies **cryptocurrency**, encrypted messaging platforms such as **Telegram**, **generative AI** including deepfakes, and satellite internet services such as **Starlink** as major enablers helping syndicates evade disruption and scale operations. Regional enforcement has intensified, but authorities and researchers say it has largely **displaced rather than dismantled** the scam industry. China has expanded charges against alleged Cambodian scam kingpin **Chen Zhi**, who was deported to China and could face the death penalty, while also executing members of another criminal group tied to scam operations. Myanmar’s junta-backed legislation has introduced severe penalties for online scam activity involving torture or coercion, yet operations are reportedly fragmenting from large compounds into smaller sites in Myanmar and other resilient hubs in **Cambodia, Laos, and Myanmar**, where corruption, special economic zones, and cross-border protection networks continue to sustain the trade.
Jul 31, 2026
Vietnamese police arrested 19 Chinese nationals in Lao Cai province after raiding the Song Hong View Hotel, where investigators said the group had set up an online fraud operation shortly after entering the country in early June. Authorities alleged the suspects, led by **Wang Xiangsheng**, used laptops, smartphones, and 5G broadcasting devices to impersonate lending-app employees and defraud Chinese citizens seeking loans. Data recovered from seized devices indicated the syndicate had previously harvested personal information from about **25,000** Chinese citizens while operating in Cambodia. The Lao Cai case was part of a broader Vietnamese crackdown on suspected scam networks believed to be shifting out of Cambodia as Phnom Penh intensifies enforcement against cyberfraud compounds. Police also uncovered another suspected high-tech scam network in **Phu Tho** province, arresting four people including Chinese national **Zhao Weizhong**, while authorities in **Ho Chi Minh City** identified **83 Chinese nationals** allegedly preparing to establish another scam center. The arrests point to a regional redistribution of scam operations long associated with Chinese criminal syndicates and trafficked labor in Cambodia, Laos, and Myanmar.
Jun 29, 2026