PIG BUTCHERING SCAMS : CYBERCRIME THREAT INTELLIGENCE

MITRE Techniques

• [T1593 ] Search Websites – Used during reconnaissance to gather victim information and identify online footprints (“Initial contact typically occurs on dating platforms, social networks, or messaging services”).
• [T1592 ] Gather Victim Info – Scammers analyse victims’ digital footprints and backgrounds to craft tailored psychological hooks (“Reconnaissance occurs as scammers analyse the victim’s digital footprint, identifying emotional vulnerabilities, financial background, and interests”).
• [T1585 ] Establish Accounts – Fraudulent accounts and personas are created on social platforms to engage victims (“Scammers initiate conversations using compelling personas supported by AI-generated photos or curated images”).
• [T1583.001 ] Acquire Domains – Rapidly registered domains host fake trading platforms with WHOIS privacy to hinder attribution (“Domains are often newly registered, with WHOIS privacy features making attribution difficult”).
• [T1204 ] User Execution – Victims execute actions such as installing sideloaded apps or interacting with fake platforms which enable the fraud (“Mobile applications are frequently distributed outside official app stores… victims deposit funds through bank transfers or cryptocurrency payments”).
• [T1566.002 ] Spearphishing via Messaging – Targeted messages on dating and messaging platforms initiate grooming and deliver fraudulent narratives (“Initial contact typically occurs on dating platforms, social networks, or messaging services”).
• [T1646 ] Social Engineering – Core technique used for prolonged grooming and emotional manipulation to induce financial transfers (“Grooming is a methodical and structured process… building trust and emotional dependency”).
• [T1078 ] Valid Accounts – Scammers leverage legitimate or stolen accounts and persistent personas to maintain long-term engagement (“Workers often operate multiple personas simultaneously across multiple platforms”).
• [T1562 ] Impair Defenses – Scammers use obfuscation (WHOIS privacy, domain backups) and rapid replacements to evade platform takedown (“Multiple domains serve as backups in case primary domains are blocked or reported”).
• [T1114 ] Message Collection – Operators collect chat logs and message histories for victim profiling and script optimization (“Digital investigations collect chat logs, browser histories, screenshots, metadata, and mobile applications”).
• [T1041 ] C2 Exfiltration – Criminal infrastructure moves funds and associated metadata across channels to obfuscate provenance (“Blockchain forensics follows victim funds. Analysts map wallet clusters, identify mixer interactions, and track cross-chain transactions”).
• [T1657 ] Financial Theft – The end impact is financial theft accomplished via coerced transfers, blocked withdrawals, and fraudulent platforms (“Eventually, the victim attempts to withdraw funds… each barrier is designed to extract additional funds”).