Pig Butchering, Phone Farms, and a $15 Billion Forfeiture—Key Takeaways from the Prince Group Cybercrime Indictment

Share

On October 14, 2025, the United States Attorney’s Office in the Eastern District of New York announced the indictment of a corporate executive of a Cambodian-based company for wire fraud and money laundering arising out of a near decade-long “pig butchering” cybercrime scheme, alongside a corresponding civil forfeiture action seeking approximately 12,271 bitcoin—worth approximately $15 billion—that are alleged to be proceeds and instrumentalities of the scheme.  This is the largest forfeiture action in the Department of Justice’s history, and, together with the charges against the corporate executive, signals that the Department will continue to pursue corporate criminal enforcement, particularly where it involves cybercrime and cryptocurrency.

According to the government’s , since approximately 2015, the Cambodian-based company, known as the Prince Holding Group (“Prince Group”), under the direction of its Chairman, Chen Zhi (“Zhi”), was operating as one of the largest transnational criminal organizations in Asia.  Although Prince Group claimed to be involved in real estate development and other legitimate businesses, the government alleges that, in reality,  Prince Group used a sophisticated forced-labor scheme employing thousands of people to commit large-scale cryptocurrency fraud that enabled Zhi and his associates to steal and launder billions in fraudulent proceeds.

Continue reading “Pig Butchering, Phone Farms, and a $15 Billion Forfeiture—Key Takeaways from the Prince Group Cybercrime Indictment”

The Lumma Seizure: International Efforts to Take Down a Global Malware Network and How to Reduce Your Risk of Infection

Share

On May 21, 2025, the United States Department of Justice (“DOJ”) announced it had obtained warrants authorizing the seizure of five internet domains used to operate a family of malware known as LummaC2, also referred to as LummaStealer (“Lumma”) that targets customers of the Windows operating system developed by Microsoft Corporation (“Microsoft”).  The warrants were part of a global effort to take down Lumma, led by Microsoft.  According to a recent blog post by Microsoft, between March 16, and May 16, 2025, Microsoft identified over 394,000 Windows computers throughout the world infected by Lumma.  Europol’s European Cybercrime Center and Japan’s Cybercrime Control Center used this information to prevent Lumma from communicating with infected computers through their infrastructures.  In addition, Microsoft filed a civil action in Georgia against Lumma’s operators—as well as marketers and end users—in which Microsoft obtained a temporary restraining order (“TRO”) requiring third parties owning or operating domains believed to be controlled by Lumma to give Microsoft control of the domains and take other actions to prevent Lumma from operating and misusing victims’ data.

Continue reading “The Lumma Seizure: International Efforts to Take Down a Global Malware Network and How to Reduce Your Risk of Infection”

©2025 Faegre Drinker Biddle & Reath LLP. All Rights Reserved. Attorney Advertising.
Privacy Policy