How to Avoid Being a Social Engineering Victim of Pig Butchering Cryptocurrency Fraud

As Crypto market grows it encourages threat actors to commit cyber crime. This leads security firms to be more vigilant about the emerging threats to protect their clients and their own infrastructure. Proofpoint, a well know security company has been tracking multiple threats known as Sha Zhu Pan, or “Pig Butchering” for past few months. According to the Proofpoint, these threats are typically managed by a large industry of professional fraud actors to lure a victim into depositing cryptocurrency into a fake cryptocurrency exchange to steal the money. Threat actors usually carry out these attacks using attractive platforms like dating apps, social media platforms, or some times through text messages. We created this post to help you learn about Pig Butchering Cryptocurrency Fraud, a cryptocurrency-based social engineering scheme and how to avoid being a social engineering victim and finally, how to prevent social engineering attacks in general. Let’s begin the post.

What Is Social Engineering

Social engineering is the art of psychological manipulation to exploit human errors to accomplish malicious activities. Social engineering tactics makes people to trust blindly and break security policies and procedures, this is mainly done by gaining the trust of an individual and unknowingly stealing sensitive information from them.

In this post we will discuss on a major social engineering attack which is exploited widely and how to avoid being a social engineering victim.

Cryptocurrency Frauds High in Markets: Pig Butchering

Crypto currency is the virtual currency which are encrypted by cryptography. Crypto currencies are not issued by any central authority and doesn’t exist in any physical form, they are maintained in a decentralized platform. One of the wildly exploited social engineering attack is the Pig Butchering Cryptocurrency Fraud.

This cryptocurrency-based social engineering scheme have stolen millions of dollars from multiple users.

What is Pig Butchering:

A conversation which is started from a text from a wrong number will lead to months of friendly conversation which eventually moves on to much serious topics on emotional scenarios, financial advices etc., over a period of time you started trusting your new friend and one day they inform you about a highly successful investment they did in a newly emerging crypto currency platform which is the future of crypto investments and recommend you to invest in it

Initially you are bit hesitant, and you invest less, but the investments doubled. Wow! This currency is for real. Let me invest more. After investing a huge amount in crypto while waiting for it to get doubled you are realising slowly no one responding and when you realised you have been scammed the threat actor deletes the website and move on to their next victim. 

You Have Been Scammed!!!! 

Proofpoint have shared a detailed article on this cryptocurrency-based social engineering scheme, Pig Butchering AKA Sha Zhu Pan.

Now Let’s dig into details of how the attacker lure their victims and gaining the trust.

The name ‘Pig Butchering’ refers on how the scammers feed the victim(pig) with so many hopes and false promises and eventually making them ready for getting looted (Butchering).

Pig Butchering Cryptocurrency Fraud initially targeted the Chinese audience and then slowly moved to English speaking countries.

Phase 1:Introducing the Treat Actor

The conversation mostly starts from an attractive polite stranger on the internet, they start with pleasantries and mind capturing conversations while they complement, empathise with the victim. 

Slowly they start chatting for weeks and establish a strong emotional connection with the victim sharing their experiences and finer things in life. If the Victim is in social media apps like LinkedIn, twitter, Instagram etc the treat actor will request the victim to connect over WhatsApp which is more private and trustable platform. Most of the times they establish a romantic relationship with the victim and share racy “selfies” to make the victim reciprocate the same (which will be used in later stages for blackmailing).

As these conversation progresses and the attacker feels the trust with victim is established, they will invite the victims to chat with their so called ‘investment mentors’ on how to make more money and how the threat actor have created a lot of profit out of it.

Phase 2: The Kind Uncle who helps you invest!

One the rapport is established the ‘investment mentor’ or the ‘kind uncle’ will send the victim cryptocurrency investing documents on how to set up coin base or crypto account. One of the integral parts of the scheme is to create a cryptocurrency wallet if the victim doesn’t have one. The scammers will work with the victim individually or ask them to join group chats mostly on WhatsApp, telegram and Discord where the victim meets so many people investing and making money as per the advice of the “Plan Analyst” the one who leads the group.

Ultimately after all the convincing, the victim will be led to fake crypto currency website or mobile applications and will be requested to purchase a small amount of crypto by the treat actors, this will be mainly on Tether (USDT) in crypto.com or coinbase.com. The threat actor will make sure that the victim purchased by requesting a screenshot, the actors will specifically request to invest less than $1000. If the victim complies to all the requirements set by the treat actor, they will be provided with 10% to 20% reward which will be reflected immediately in their wallet.

Once the reward is received the ‘plan analyst’ will congratulate you and also inform you on the urgency on investing in crypto as it is a volatile market. Hence slowly step by step after investing in small amounts and getting rewards the attacker will urge you to invest in a huge amount, here the treat actors are putting victims into a behavioural pattern known as  “classic conditioning” where the victims mind is trained on receiving the rewards. In this case the victim believes in attacker as he was receiving rewards from previous investments.

Phase 3: Fattening Up the Pig

Once the victim is convinced by the attacker and see profits in their wallet, the trust also increases and they are ready to invest high, a.k.a Fattened up, the attackers will encourage in putting large investments by taking loan, sell stocks etc and invest in the fake crypto.

Once the victim starts to worry, they will be asked to take out only small amounts and convince that the rest of the amount should not be taken out.

In the end when the victim realises that they have been scammed the attacker deletes the website and starts hunt for other victims.

On the Killing Floor

Pig butchering type of scams are most of the times highly successful due to the intimate conversations with the victim which makes it more trustable. The empathetic and emotional manipulations, friendly conversation exploits the genuine feelings of the victim. The attacker often shares fake sad and emotional stories in order to gain trust and empathy from the victim.

The threat actors are highly trained on not to click any links. When Proofpoint researchers shared URL to trace the treat actor they were blocked immediately.

As per the statistics shared by FBI In 2021 more that 4300 cases were received on crypto-romance scams which lead to more than $429 million in losses.

How to Prevent Social Engineering Attacks

The U.S. Federal Bureau of Investigation (FBI) have shared few steps on How to avoid being a social engineering victim

• Your financial details should never be shared to any stranger you have met online
• Do not take advice from strangers and invest accordingly   
• Never provide your personally identifiable information such as social security number bank details or other identification proofs under any circumstances to people over internet.
• Never fall for unbelievable profits on any trading sites.
• Be cautious on people, mails, text where they urge you to invest anywhere.

Indicators of Compromise

Conclusion

Every day we hear about multiple cyber-attacks happening all around the world, but as an individual we will be least bothered as you may think how it will affect you.

The above post would have given a detailed idea on how threat actors can impact a common man, we also learned how to avoid being a social engineering victim. Everyone should be always alerted on their surroundings and very careful while sharing personal information on internet.

Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• security issues with recycled phone numbers
• Social Engineering Techniques Hackers
• 10 Cybersecurity Professions Which Are in High Demand
• 9 New Fake Apps On The Play Store Which Can Hijack SMS Notification To Carry Out Billing Fraud
• 10 Cybersecurity Professions