Loading story…
Vietnamese police arrested 19 Chinese nationals in Lao Cai province after raiding the Song Hong View Hotel, where investigators said the group had set up an online fraud operation shortly after entering the country in early June. Authorities alleged the suspects, led by Wang Xiangsheng, used laptops, smartphones, and 5G broadcasting devices to impersonate lending-app employees and defraud Chinese citizens seeking loans. Data recovered from seized devices indicated the syndicate had previously harvested personal information from about 25,000 Chinese citizens while operating in Cambodia.
The Lao Cai case was part of a broader Vietnamese crackdown on suspected scam networks believed to be shifting out of Cambodia as Phnom Penh intensifies enforcement against cyberfraud compounds. Police also uncovered another suspected high-tech scam network in Phu Tho province, arresting four people including Chinese national Zhao Weizhong, while authorities in Ho Chi Minh City identified 83 Chinese nationals allegedly preparing to establish another scam center. The arrests point to a regional redistribution of scam operations long associated with Chinese criminal syndicates and trafficked labor in Cambodia, Laos, and Myanmar.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Police in Ho Chi Minh City identified 83 Chinese nationals who were allegedly preparing to establish another scam center. The discovery suggested additional scam operations may be relocating into Vietnam.
Vietnamese authorities also uncovered another suspected high-tech scam operation in Phu Tho province. Four people were arrested in that case, including Chinese national Zhao Weizhong.
On Friday, police in Lao Cai province detained 19 Chinese nationals at the Song Hong View Hotel for allegedly operating an online fraud ring. Authorities said the group used laptops, smartphones, and 5G broadcasting devices to impersonate lending-app employees and scam Chinese loan seekers.
Investigators said the fraud group had moved from Cambodia into Vietnam, with the suspects entering Vietnam in early June before beginning operations there. The group was allegedly linked to loan-app fraud targeting Chinese citizens.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and policy groups are intensifying efforts against **transnational online scam operations** centered in Southeast Asia, particularly Cambodia, where criminal networks have been linked to fraud compounds, human trafficking, and abuse of workers. Reporting highlights recent enforcement actions including Cambodia's extradition of **Chen Zhi** to China, a new U.S. executive order targeting cyber-enabled fraud, and a Thai-led operation with international partners and **Meta** that removed **150,000** fake profiles and arrested **21** suspects tied to scam activity. The broader picture is that scam syndicates are adapting quickly, shifting locations, fragmenting into smaller cells, and exploiting gaps between law enforcement, regulators, and private-sector platforms. On-the-ground reporting from Cambodia describes the human cost inside alleged scam compounds, including forced labor, torture, and coercion of workers recruited under false pretenses. One former guard said he was ordered to use electric shocks and beat Chinese workers inside a heavily secured compound on Bokor Mountain, even as publicized crackdowns were underway elsewhere. That account reinforces concerns that abrupt enforcement alone can displace operations while leaving trafficked workers vulnerable and limiting intelligence collection on how the scam ecosystem functions. A separate report on fake shipment-tracking phishing in the Middle East and Africa is **not** part of the same event, as it covers a different scam trend and geography rather than the Cambodia-centered scam-compound crackdown.
Jun 29, 2026
Cambodian authorities shut down **190 online scam centers** as part of an intensified national crackdown on transnational fraud operations, according to government statements cited by Reuters. The enforcement action reportedly included the arrest of **173 senior figures** and the deportation of roughly **11,000 foreign nationals**, reflecting the scale and international composition of the scam-compound ecosystem operating in the country. The reporting was published as part of an ISMG “breach roundup” that also briefly noted other, separate security developments (including the European Parliament disabling AI tools on lawmakers’ devices, a *Notepad++* updater supply-chain exposure being patched, an Apple iOS zero-day fix, and emergency remediation for an actively exploited **BeyondTrust** RCE, among others). Those items were presented as additional headlines rather than as part of the Cambodia enforcement action.
Jun 29, 2026
A new **UNODC assessment** says transnational scam networks rooted in Southeast Asia have grown into a global organized-crime force, defrauding victims across East Asia, Southeast Asia, Australia, and New Zealand of an estimated **$88 billion to $114.1 billion in 2025**. The report describes a sophisticated ecosystem dominated by Chinese-origin criminal groups that extends beyond cyber-enabled fraud into cryptocurrency-based settlement networks, criminal infrastructure, trafficking of workers from more than 80 countries, and other illicit goods and services. It identifies **cryptocurrency**, encrypted messaging platforms such as **Telegram**, **generative AI** including deepfakes, and satellite internet services such as **Starlink** as major enablers helping syndicates evade disruption and scale operations. Regional enforcement has intensified, but authorities and researchers say it has largely **displaced rather than dismantled** the scam industry. China has expanded charges against alleged Cambodian scam kingpin **Chen Zhi**, who was deported to China and could face the death penalty, while also executing members of another criminal group tied to scam operations. Myanmar’s junta-backed legislation has introduced severe penalties for online scam activity involving torture or coercion, yet operations are reportedly fragmenting from large compounds into smaller sites in Myanmar and other resilient hubs in **Cambodia, Laos, and Myanmar**, where corruption, special economic zones, and cross-border protection networks continue to sustain the trade.
Jul 31, 2026