New “Penguin” Platform Sells Pig-Butchering Kits, PII, and Stolen Accounts

This report examines the rise of Pig Butchering-as-a-Service (PBaaS) across Southeast Asia, highlighting platforms like Penguin and UWORK that sell stolen PII, pre-registered SIMs, hijacked social accounts, fraudulent mobile apps delivered via Android sideloading and iOS provisioning, payment rails, and shell-company services to power large-scale romance/investment scams. It details how UWORK underpins fake investment sites with CRM/KYC dashboards, pricing for turnkey kits, VPS/MetaTrader integrations, and the operational scaling these services enable. The activity is mapped to MITRE ATT&CK techniques (e.g., T1588, T1589, T1078, T1566, T1204), and the report urges defenders and law enforcement to target the supporting supply chain—service providers, financial enablers, DNS, and payment infrastructure—to disrupt PBaaS.