DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 05:09:16ZSOURCES: 14CRITICAL: 39
⚠ ACTIVE ALERTS
@MsftSecIntel CRITICAL — Microsoft Defender Experts tracked increased ACR Stealer activity from late April through… /// @TalosSecurity CRITICAL — Qilin RaaS remains the most active ransomware operation globally in 2026 with 500+… /// @CrowdStrike CRITICAL — VECT ransomware + TeamPCP supply chain credential theft + BreachForums mass affiliate… /// @MandiantThreats CRITICAL — Tracking Qilin affiliate recruitment activity on Russian-language cybercrime forums… /// @FalconFeedsio CRITICAL — Dark web monitoring alert: FIFA World Cup 2026 credential ecosystem fully operational on…
39Critical Threats
18Active CVEs
8IOCs Tracked
11New Advisories
TLP:WHITETHREAT ACTOR DOSSIER // OPERATION-FIRST-LIGHT-2026-SYNDICATESFIRST SEEN: JAN 2026

GLOBAL SOCIAL ENGINEERING SYNDICATES (Operation First Light 2026)

ALSO KNOWN AS: Shunda Compound (Myanmar/Cambodia); Ko Thet Company; Sanduo Group; Giant Company; Eswatini BEC/Impersonation Network
FROM:DMZ INTELLIGENCE DESK
ORIGIN:Southeast Asia, East Asia (Myanmar, Cambodia, Thailand, Indonesia, China); transnational
ATTRIBUTION:ORGANIZED CRIME
STATUS:ACTIVE
FIRST OBSERVED:JAN 2026
TECHNICALRESOURCESPERSISTENCESTEALTHIMPACT
TECHNICAL42/100
RESOURCES42/100
PERSISTENCE45/100
STEALTH37/100
IMPACT51/100

INTERPOL announced on July 9, 2026 the results of Operation First Light 2026, a four-month enforcement campaign (Jan 15–Apr 30) across 97 countries and territories that resulted in 5,811 arrests, $293 million in intercepted illicit assets, and identification of over 142,000 victims across 152,808 analyzed fraud cases. The operation targeted industrialized social engineering syndicate networks running BEC, romance scams, pig-butchering crypto investment fraud, sextortion, and authority impersonation schemes — many operating out of Southeast Asian scam compounds with trafficked workers. A 20-year-old Thai suspect's crypto wallet was found to have processed over $122.5 million in romance-scam proceeds in 10 months using cross-chain token swaps to obscure the financial trail. DOJ had previously indicted operators of the Shunda compound in Myanmar for targeting American victims via fake crypto investment platforms.

Financial — large-scale social engineering fraud including BEC, romance scams/pig butchering, investment fraud, impersonation, and money laundering; some operations involve trafficked forced labor

T1598 Phishing for Information, T1566.004 Spear-phishing via Service (romance/investment platforms), T1657 Financial Theft, Business Email Compromise (BEC), Pig Butchering/Romance Baiting, Authority Impersonation (fake law enforcement), Cross-chain cryptocurrency laundering (token swaps), Money mule networks, Fake investment platform apps

INDIVIDUALS
FINANCIAL SERVICES
CORPORATE TREASURY
GOVERNMENT OFFICIALS
CRYPTOCURRENCY HOLDERS

Hotel-based scam centers (Palau), casino/office-park retrofitted scam compounds (Cambodia/Myanmar), replica police station props (Eswatini). Cryptocurrency laundering via cross-chain token swaps. Crypto wallets, illegal gambling platforms, and app-based fake investment portals. I-GRIP-blocked bank accounts: 31,014 frozen. Shunda compound infrastructure in Min Let Pan, Myanmar (seized Nov 2025); second center planned for Cambodia.

FILE DATE: JAN 2026
Operation First Light 2026 (INTERPOL LE Action)
Four-month Interpol-led enforcement sweep across 97 countries resulting in 5,811 arrests, $293M seized, 31,014 bank accounts blocked, and 142,000+ victims identified globally across BEC, romance, impersonation, and investment fraud schemes — results announced July 9, 2026.
FILE DATE: MAY 2026
Shunda Compound DOJ Indictment
DOJ charged Chinese nationals Jiang Wen Jie and Huang Xingshan for ████████████████████ scam compound in Myanmar targeting American victims through fake crypto investment platforms, with Huang personally directing physical punishment of trafficked workers.
SHARE BRIEF:✕ Post on Xin Share on LinkedIn