Xinbi Guarantee Takedown: $52.8M in Crypto Frozen — How to Detect Pig-Butchering Infrastructure Reaching Your Users

On Wednesday, the U.S. Department of Justice announced a coordinated, multi-pronged disruption of Xinbi Guarantee — an illicit online marketplace operating on Telegram that sold services purpose-built for running investment and romance scams at industrial scale. The action included:

• Seizure of the Telegram channels used to operate the marketplace
• Confiscation of two cryptocurrency wallets containing $52.8 million
• Deployment of the Scam Center Strike Force to Madagascar to assist in disrupting 13 scam compounds operated by Chinese organized crime groups

Xinbi Guarantee is not a garden-variety phishing crew. Blockchain analytics firms (notably Elliptic, which first profiled Xinbi in 2025) have documented it as one of the largest illicit marketplaces operating in the open, facilitating billions of dollars in transactions tied to the Southeast Asian "pig-butchering" (sha zhu pan) scam economy. The marketplace offered money laundering, stolen personal data, fake identity documents, satellite communications equipment (including Starlink terminals for scam compounds), and intimidation services — the full supply chain of organized fraud.

Why should a SOC or CISO care about a consumer fraud marketplace takedown? Because this ecosystem does not stay in the consumer lane. The same operators recruit, coerce, and socially engineer employees — through Telegram, WhatsApp, SMS, and compromised social accounts — into fake investment platforms, crypto wallet draining, and occasionally into facilitating payments or credential access from inside organizations. These marketplaces also sell bulk stolen PII, some of which originates from corporate breaches. The disruption is significant, but history (Huione Guarantee's repeated migrations after enforcement actions) tells us these ecosystems reconstitute quickly under new channel names and new infrastructure. The defenders' window of maximum intelligence value is right now, while operators are scrambling.

This post is defense-focused: how this economy works, what it looks like on your network and endpoints, and what to hunt for today.

Technical Analysis

The Xinbi Guarantee Operating Model

Xinbi Guarantee functioned as a guarantor (escrow) marketplace on Telegram. The model works like this:

1. Vendors post services inside Telegram channels: money laundering (converting victim crypto to clean funds through OTC desks and mule networks), stolen databases, fake KYC documents, scam infrastructure (cloned investment sites, SMS blasting, SIM farms), and physical logistics for scam compounds.
2. The marketplace acts as escrow. Buyers and sellers deposit funds — overwhelmingly in USDT (Tether) on TRON and Ethereum chains — with Xinbi, which releases payment on delivery and takes a commission.
3. Scam compounds (now disrupted in Madagascar; historically concentrated in Myanmar, Cambodia, and Laos) run the victim-facing operations: trafficked or recruited workers operate scripted romance/investment lures against targets sourced from data purchased on the marketplace.

The attack chain from a defender's vantage point, when it touches an enterprise:

1. Targeting — Employee PII (name, phone, email, sometimes breached credentials) is purchased from data vendors on these marketplaces.
2. Initial contact — Lure arrives via SMS, Telegram, WhatsApp, LinkedIn, or a dating platform. Increasingly, lures impersonate recruiters, vendors, or executives.
3. Migration to encrypted channels — Conversation is moved to Telegram specifically because of its lax moderation relative to other platforms.
4. Monetization — The victim is directed to a fraudulent investment platform (professionally built, often using kits purchased on the same marketplace), persuaded to install remote access software or a malicious wallet app, or manipulated into approving token allowances on a real wallet.
5. Laundering — Stolen funds flow through the marketplace's laundering vendors into mule accounts and OTC brokers.

Affected Platforms and Exploitation Status

• Platforms abused: Telegram (primary marketplace and lure channel), SMS/iMessage, WhatsApp, LinkedIn, dating apps, and fraudulent web investment platforms.
• No CVE applies here — this is infrastructure and social engineering, not a software vulnerability. The "exploit" is trust.
• Exploitation status: Confirmed, massive-scale, active criminal operation. Xinbi-linked wallets processed billions in USDT before disruption. The DOJ seizure of two wallets totaling $52.8M and the channel takedowns degrade the operation but do not eliminate the vendor base — Elliptic documented Xinbi growing after Telegram's previous enforcement waves, and sibling marketplaces (Huione/Haowang Guarantee ecosystem) remain active.

Post-Disruption Behavior to Expect

Seasoned responders know takedowns create predictable telemetry signatures:

• Channel migration: Operators spin up replacement Telegram channels and blast invites through remaining accounts and bot networks. New channel names frequently reference the old brand.
• Infrastructure churn: Fraudulent investment domains registered in bulk (often through the same registrars and name server patterns) as old front ends are abandoned.
• Panic transactions: Seized-marketplace vendors rush to move funds through mixers, chain-hopping bridges, and OTC desks — blockchain analytics vendors will flag these flows within days.
• Increased lure volume: Disrupted compounds under financial pressure historically increase outreach volume in the short term.

Detection & Response

This is a fraud-infrastructure and social-engineering threat, so detection centers on three surfaces: endpoint use of Telegram combined with suspicious adjacent behavior, network/web traffic to scam-infrastructure patterns, and email/messaging lures with crypto-investment indicators. Rules below are tuned to be high-fidelity; none should fire broadly on a normal environment.

Sigma Rules

---
title: Telegram Desktop Execution from Non-Standard Path
description: Detects Telegram Desktop client executing from a user-controlled or temporary path, a pattern seen when scam operators or victims sideload portable Telegram builds, or when lure kits direct victims to install bundled/cloned Telegram clients used for wallet-draining fraud as observed in the Xinbi Guarantee scam ecosystem.
references:
  - https://thehackernews.com/2026/09/us-disrupts-xinbi-guarantee-scam.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
id: 8f2c4a61-3d9e-4b7a-a1c5-6e8f0d2b4a91
status: experimental
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\Telegram.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\Telegram Desktop\'
      - '\Downloads\'
      - '\Public\'
      - '\ProgramData\'
  condition: selection_image and selection_path
falsepositives:
  - Telegram Desktop legitimately installs under AppData\Roaming; tune by excluding the known-good install hash/signer in your environment and alert on the remaining paths.
level: medium
---
title: Remote Access Tool Installation Following Messaging App Activity
description: Detects installation or execution of common remote access tools (AnyDesk, TeamViewer, RustDesk, UltraViewer) shortly associated with social-engineering scenarios. Pig-butchering and crypto scam operators tied to marketplaces like Xinbi Guarantee routinely direct victims to install RATs to 'assist' with wallet setup or investment platform access.
references:
  - https://thehackernews.com/2026/09/us-disrupts-xinbi-guarantee-scam.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
id: 4b7e1d92-6c3a-4f58-9e21-0a8c3d5f7b62
status: experimental
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\AnyDesk.exe'
      - '\TeamViewer.exe'
      - '\TeamViewer_Service.exe'
      - '\rustdesk.exe'
      - '\UltraViewer.exe'
      - '\ToDesk.exe'
  filter_known_it:
    CommandLine|contains:
      - 'deploy'
      - 'msiexec'
  condition: selection and not filter_known_it
falsepositives:
  - Legitimate IT support usage; baseline approved remote tools per host and suppress managed deployments.
level: high
---
title: Browser Access to Cryptocurrency Wallet or Exchange Domain from Non-Browser Process Referrer
description: Detects command-line launched browser sessions directed at crypto wallet or exchange domains, a pattern seen when scam lure kits or malicious scripts open investment platform or wallet-drain pages programmatically.
references:
  - https://thehackernews.com/2026/09/us-disrupts-xinbi-guarantee-scam.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
id: 2d6a9f04-8e1b-4c73-b5d9-7f0e2a6c1843
status: experimental
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  selection_url:
    CommandLine|contains:
      - 'wallet'
      - 'usdt'
      - 'tether'
      - 'crypto'
      - 'invest'
  condition: selection_browser and selection_parent and selection_url
falsepositives:
  - Rare; some enterprise SSO launchers may open browsers from scripts, but combined with crypto keywords this is highly unusual in most environments.
level: high

KQL — Microsoft Sentinel / Defender

This query hunts across endpoint process telemetry for the intersection most relevant to this threat: messaging-app execution alongside remote access tooling or crypto-related browser launches on the same device within a 24-hour window — the signature of a user being actively worked by a scam operator.

let Lookback = 14d;
let RatProcesses = dynamic(["AnyDesk.exe","TeamViewer.exe","rustdesk.exe","UltraViewer.exe","ToDesk.exe"]); let MessagingApps = dynamic(["Telegram.exe","WhatsApp.exe","Line.exe","WeChat.exe"]);
let MsgDevices = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (MessagingApps)
| summarize FirstMsg=min(TimeGenerated) by DeviceId, DeviceName;
let RatDevices = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ (RatProcesses)
| where InitiatingProcessFileName !in~ ("msiexec.exe","sccmclictr.exe")
| summarize FirstRat=min(TimeGenerated), RatTool=make_set(FileName) by DeviceId;
let CryptoBrowser = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("chrome.exe","msedge.exe","firefox.exe")
| where ProcessCommandLine has_any ("usdt","tether","wallet-connect","invest")
| summarize FirstCrypto=min(TimeGenerated), CryptoCmd=make_set(ProcessCommandLine, 3) by DeviceId;
MsgDevices
| join kind=inner RatDevices on DeviceId
| join kind=inner CryptoBrowser on DeviceId
| where FirstRat between (FirstMsg .. FirstMsg + 1d) or FirstCrypto between (FirstMsg .. FirstMsg + 1d)
| project DeviceName, FirstMsg, FirstRat, RatTool, FirstCrypto, CryptoCmd
| order by FirstMsg desc;

Complementary query for network-level visibility (requires proxy/firewall ingestion into CommonSecurityLog) to surface bulk connections to Telegram infrastructure from hosts that do not normally use it — useful for identifying unauthorized Telegram usage potentially tied to scam contact:

let Lookback = 7d;
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(Lookback))
| where DestinationHostName has "telegram" or DestinationIP in ("149.154.160.0/20", "91.108.4.0/22")
| summarize by SourceIP;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DestinationHostName has "telegram" or DestinationPort == 443 and DestinationIP startswith "149.154."
| where SourceIP !in (Baseline)
| summarize FirstSeen=min(TimeGenerated), Connections=count(), Destinations=make_set(DestinationHostName) by SourceIP, DeviceVendor
| order by FirstSeen desc;

Velociraptor VQL

This hunt artifact enumerates endpoints for the combination of portable messaging clients in non-standard locations and recently installed remote access tools — the practical footprint of an employee being guided by a scam operator.

-- Hunt for portable Telegram builds and unsanctioned remote access tools
-- relevant to pig-butchering scam social engineering (Xinbi Guarantee ecosystem)

LET telegram_paths <= SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/Downloads/**/Telegram.exe',
  'C:/Users/*/AppData/Local/Temp/**/Telegram.exe',
  'C:/ProgramData/**/Telegram.exe',
  'C:/Users/Public/**/Telegram.exe'
])

LET rat_procs <= SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)anydesk|teamviewer|rustdesk|ultraviewer|todesk'

SELECT 'PortableTelegram' AS ArtifactType,
       FullPath AS Detail, Mtime AS Timestamp FROM telegram_paths
UNION ALL
SELECT 'ActiveRAT' AS ArtifactType,
       Exe + ' | ' + CommandLine AS Detail, CreateTime AS Timestamp FROM rat_procs
ORDER BY Timestamp DESC

Remediation Script

This PowerShell script performs three defensive actions on Windows endpoints: (1) audits for unsanctioned remote access tools commonly abused in scam scenarios, (2) checks for portable Telegram installations in high-risk paths, and (3) verifies SmartScreen/PUA protection is enabled. Run via your RMM or as a scheduled audit.

# Xinbi-ecosystem scam surface audit — run as Administrator
$Report = @{ Host = $env:COMPUTERNAME; Findings = @() }

# 1. Detect unsanctioned remote access tools
$RatNames = @('AnyDesk','TeamViewer','rustdesk','UltraViewer','ToDesk')
$Approved = @('TeamViewer')  # EDIT: list your sanctioned tools
foreach ($r in $RatNames) {
  if ($Approved -notcontains $r) {
    $hits = Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\Users' -Filter "$r*.exe" -Recurse -ErrorAction SilentlyContinue -Depth 4
    foreach ($h in $hits) { $Report.Findings += "UNSANCTIONED-RAT: $($h.FullName)" }
  }
}

# 2. Detect portable/misplaced Telegram installs
$tg = Get-ChildItem -Path 'C:\Users\*\Downloads','C:\Users\Public','C:\ProgramData' -Filter 'Telegram.exe' -Recurse -ErrorAction SilentlyContinue -Depth 5
foreach ($t in $tg) { $Report.Findings += "PORTABLE-TELEGRAM: $($t.FullName)" }

# 3. Verify SmartScreen and PUA protection enabled
$smart = Get-MpPreference -ErrorAction SilentlyContinue
if ($smart) {
  if ($smart.PUAProtection -ne 1) { $Report.Findings += 'PUA-PROTECTION-DISABLED'; Set-MpPreference -PUAProtection Enabled }
}
$edge = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name SmartScreenEnabled -ErrorAction SilentlyContinue
if (-not $edge) {
  New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Force | Out-Null
  Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name SmartScreenEnabled -Value 1
  $Report.Findings += 'SMARTSCREEN-ENFORCED-EDGE'
}

# Output
if ($Report.Findings.Count -eq 0) { Write-Output "[$($Report.Host)] CLEAN: no findings" }
else { $Report.Findings | ForEach-Object { Write-Output "[$($Report.Host)] $_" } }

Remediation

There is no patch for this threat — remediation is architectural, procedural, and human. Prioritized actions:

1. Govern messaging app usage. If Telegram is not a business tool, block it at the proxy/DNS layer (*.telegram.org, t.me, Telegram AS62041/AS59930 IP ranges) and remove/unauthorize desktop clients via application control (WDAC/AppLocker). If business units legitimately use Telegram, restrict to managed accounts and log usage.
2. Enforce remote access tool allow-listing. Pig-butchering monetization frequently depends on convincing a victim to install AnyDesk/RustDesk-style tools. Block all non-approved RATs via application control; this single control breaks a large share of scam kill chains.
3. Block newly registered and scam-pattern domains. Feed your DNS/proxy with NRD (newly registered domain) filtering plus crypto-scam threat intel. Fraudulent investment platforms are almost always on domains under 90 days old, frequently with keywords like invest, usdt, mining, trading concatenated with brand names.
4. Crypto-aware security awareness training. Update your phishing curriculum with pig-butchering specifics: unsolicited investment contact, migration to Telegram/WhatsApp, 'guaranteed returns' platforms, and requests to install software. Emphasize that targets are selected using breached corporate PII — employees are targets, not just consumers.
5. Monitor for corporate PII resale. Engage threat intel (or your MDR provider) to watch marketplace ecosystems — including Xinbi successors and the Huione/Haowang network — for your domains' breach data, employee lists, and credential dumps.
6. Establish an employee reporting channel for personal scam contact. Staff who realize they are being worked by a scammer are often embarrassed into silence. A no-fault reporting path gives you early warning when employees (and their corporate devices) are targeted.
7. Financial controls. For organizations in finance or crypto-adjacent sectors: flag outbound payments to crypto on-ramps from corporate accounts, and brief finance teams that romance/investment scam victims are frequently coached to bypass exactly these controls.
8. Track the reconstitution. Subscribe to DOJ/OFAC announcements and blockchain analytics reporting (Elliptic, Chainalysis, TRM) on Xinbi successor channels and newly sanctioned wallets; update blocklists as infrastructure resurfaces. OFAC has previously sanctioned entities in this ecosystem, and additional designations typically follow DOJ actions of this scale.

Category Rationale

This is fundamentally a SOC/detection problem: the threat materializes as observable endpoint, network, and messaging telemetry when it intersects with enterprise users, and the takedown creates a time-boxed window of heightened intelligence value.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub