US Readies Huione Group Ban Over Cybercrime Links

The U.S. Department of Treasury set in motion a process to ban a Cambodian company’s access to the dollar financial system for running a vast illicit marketplace for cybercrime tools and laundering billions of dollars on behalf of North Korean and other cybercrime groups.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Treasury announced Thursday the first step to prevent Huione Group from having an intermediary banking account with U.S. institutions, severing it from access to the dollar settlement system.

The government said Huione Group plays a principal role in helping North Korean and other Southeast Asian cybercrime groups to launder funds obtained through criminal activities such as investment scams and virtual currency-related scams.

Between August 2021 and January this year, the company laundered at least $4 billion worth of illicit proceeds, including about $37 million obtained through North Korean cyber scams and about $300 million worth of convertible virtual currency from other cyber scams, Treasury said.

“Huione Group has established itself as the marketplace of choice for malicious cyber actors like the DPRK and criminal syndicates, who have stolen billions of dollars from everyday Americans,” said Scott Bessent, secretary of the Treasury. He added that the sanctions will degrade the company’s ability to help cybercriminals generate revenue from illicit cyber activities.

The U.S. government action follows blockchain analysis firm Chainalysis reporting in August that Huione Guarantee, a Chinese-language illicit marketplace tied to the Huione Group, laundered in excess of $49 billion in cryptocurrency transactions since at least 2021. Marketing itself as a peer-to-peer marketplace that connects buyers and sellers, Huione Guarantee does not verify the legitimacy of listed goods and services, making itself an attractive platform for cybercriminal networks.

“Huione has received and sent funds to all types of counterparties, including scams, addresses reported as stolen funds, the OFAC-sanctioned Russian exchange Garantex, fraud shops, CSAM, Chinese language gambling sites and casinos and more,” Chainanalysis said.

Blockchain analysis company Elliptic in January classified Huione Guarantee as the world’s largest illicit online marketplace, with transactions exceeding $24 billion since 2021. Huione Guarantee “dwarfs Hydra, the largest ever darknet market, which received approximately $5 billion in cryptocurrency over its six-year lifespan,” Elliptic said. “This reflects the enormous scale of cyber scams compared to the online illicit drugs trade, which has been the focus of most darknet markets to date.”

Federal investigators said Huione Group runs a network of businesses that fuel its money laundering enterprise. These include virtual assets service provider Huione Crypto and payment service Huione Pay PLC. “This network offers services ranging from an online marketplace selling items useful for carrying out cyber scams, to payment services in fiat currency and CVC frequently used for money laundering, as well as a recently developed stablecoin,” it said.

The Treasury’s Office of Foreign Assets Control last September sanctioned Cambodian senator and businessman Ly Yong Phat, who used several personally-owned resorts and hotels, such as O Smach Resort, Garden City Hotel, Koh Kong Resort and Phnom Penh Hotel to detain trafficked workers from other countries and force them to conduct cyber scams.

According to the UN Office on Drugs and Crime, organized cybercrime in East and Southeast Asia, especially in Cambodia, Laos, Myanmar and the Philippines, have skyrocketed due to a lack of law enforcement action, high-level corruption and the presence of money laundering networks. The ability to quickly launder money through cryptocurrency and underground banking has helped regional scam centers to generate close to $40 billion in annual profits, it said.