US Disrupts Myanmar-Based 'Pig Butchering' Ring: Detection and Defense Against Investment Fraud

---
title: Potential Access to Fraudulent High-Risk Investment Domains
id: 89a2b123-c4d5-4e6f-a1b2-c3d4e5f67890
status: experimental
description: Detects network connections to domains containing investment-related keywords on high-risk TLDs commonly used in pig butchering scams and fraud. High-risk TLDs like .xyz, .top, .club are often used to host these sites at low cost.
references:
  - https://www.darkreading.com/cyber-risk/us-busts-myanmar-ring-targeting-us-citizens-financial-fraud
author: Security Arsenal
date: 2025/05/23
tags:
  - attack.initial_access
  - attack.social_engineering
  - attack.t1566
logsource:
  category: network_connection
  product: windows
detection:
  selection_keywords:
    DestinationHostname|contains:
      - 'invest'
      - 'crypto'
      - 'trade'
      - 'profit'
      - 'yield'
      - 'finance'
      - 'wallet'
      - 'coin'
      - 'token'
      - 'usdt'
  selection_risk_tld:
    DestinationHostname|endswith:
      - '.xyz'
      - '.top'
      - '.win'
      - '.bid'
      - '.loan'
      - '.trade'
      - '.club'
      - '.online'
      - '.site'
      - '.store'
  filter_legit:
    DestinationHostname|contains:
      - 'googleusercontent.com'
      - 'cloudfront.net'
      - 'azureedge.net'
  condition: selection_keywords and selection_risk_tld and not filter_legit
falsepositives:
  - Legitimate new crypto startups on alternative TLDs (rare in enterprise)
level: high
---
title: Suspicious Process Invoking Browser with Investment URL Pattern
id: 7f8e9d01-2c3a-4b5c-9d8e-0f1a2b3c4d5e
status: experimental
description: Detects command-line execution of browsers with URLs containing investment or crypto-related keywords, potentially indicating automated access or testing of fraudulent sites.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2025/05/23
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_cli:
    CommandLine|contains:
      - 'invest'
      - 'crypto'
      - 'binance'
      - 'coinbase'
      - 'metamask'
      - 'trust://'
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_img and selection_cli and not filter_legit
falsepositives:
  - Users manually launching trading sites
level: medium

// Hunt for connections to domains matching investment fraud keywords on high-risk TLDs
// Look for high volume of requests or connections from unique endpoints
let HighRiskTLDs = dynamic(['.xyz', '.top', '.win', '.bid', '.loan', '.trade', '.club', '.online', '.site', '.store', '.shop']);
let FraudKeywords = dynamic(['invest', 'crypto', 'trade', 'profit', 'yield', 'finance', 'wallet', 'usdt', 'forex']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any(FraudKeywords)
| extend TLD = strcat('.', extract(@'^.*\.(.[^.]+)$', 1, RemoteUrl))
| where TLD in (HighRiskTLDs)
| summarize Count = count(), DeviceCount = dcount(DeviceId), make_list(RemoteUrl, 100) by RemoteUrl, ActionType
| where Count > 5 // Filter out single accidental hits
| project-reorder RemoteUrl, Count, DeviceCount, ActionType, list_RemoteUrl

-- Hunt for browser history or DNS cache entries matching high-risk investment domains
-- This targets the artifact of user interaction with the fake investment infrastructure
LET RiskTlds = regex('\\.(xyz|top|win|bid|loan|trade|club|online|site|store)$')
LET InvestKeywords = regex('(invest|crypto|trade|profit|yield|finance|wallet|usdt)', ignore_case=TRUE)

SELECT * FROM foreach(
    row={
        SELECT FullPath, Mtime FROM glob(globs="/Users/*/Library/Application Support/Google/Chrome/Default/History")
        UNION ALL
        SELECT FullPath, Mtime FROM glob(globs="C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\History")
    },
    query={
        SELECT URL, FullPath, Mtime
        FROM parse_sqlite(file=FullPath, query="SELECT url, last_visit_time FROM urls")
        WHERE URL =~ RiskTlds AND URL =~ InvestKeywords
    }
)

<#
.SYNOPSIS
    Block access to known fraudulent investment domains via Windows Firewall.
.DESCRIPTION
    Adds a block rule to Windows Firewall for a specified list of domains.
    Note: Domain blocking in Firewall is not supported directly; this script resolves 
    domains to IPs and blocks those IPs. It is intended for immediate emergency containment.
#>

param(
    [string[]]$FraudDomains = @(
        # Replace with the specific list of seized domains or active threat IOCs
        # Example placeholder values:
        "fake-invest-xyz.com",
        "secure-crypto-top.net" 
    ),
    [string]$RuleName = "Block-Investment-Fraud-Infrastructure"
)

$BlockedIPs = @()

Write-Host "[*] Resolving domains to IP addresses for blocking..." -ForegroundColor Cyan

foreach ($Domain in $FraudDomains) {
    try {
        $Addresses = [System.Net.Dns]::GetHostAddresses($Domain) | Select-Object -ExpandProperty IPAddressToString
        foreach ($IP in $Addresses) {
            if ($BlockedIPs -notcontains $IP) {
                $BlockedIPs += $IP
                Write-Host "[+] Resolved $Domain to $IP" -ForegroundColor Green
            }
        }
    }
    catch {
        Write-Host "[!] Could not resolve $Domain" -ForegroundColor Yellow
    }
}

if ($BlockedIPs.Count -gt 0) {
    Write-Host "[*] Updating Windows Firewall rule: $RuleName" -ForegroundColor Cyan
    
    # Remove existing rule if present to update it
    if (Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue) {
        Remove-NetFirewallRule -DisplayName $RuleName
    }

    New-NetFirewallRule -DisplayName $RuleName `
                        -Direction Outbound `
                        -Action Block `
                        -RemoteAddress $BlockedIPs `
                        -Profile Any `
                        -Description "Block for identified investment fraud infrastructure." 
                        
    Write-Host "[+] Blocked $($BlockedIPs.Count) IP addresses associated with fraud domains." -ForegroundColor Green
} else {
    Write-Host "[!] No IP addresses resolved to block." -ForegroundColor Red
}