Topic

Chinese-Speaking Cybercrime Clusters

Gambling-sector criminal operations attributed to Chinese-speaking actors, and their overlap with espionage-style tooling.

Current clusters

security1 publisher

Tajin Group runs its Telegram fraud accounts on bought usernames and anonymous virtual numbers

Recorded Future's profile of a phishing and money-laundering vendor on the Dabai and Xinbi guarantee marketplaces documents at least 100 Telegram usernames and multiple virtual numbers bought via Fragment Market.

Publishers:recordedfuture.com

Reality

Evidence58
Adoption34
Hype gap+18
Incentives60
Confidence55

security3 publishers

Gambling Goblin turns .gov.br servers into invisible reverse proxies for app-store phishing

Check Point says a Chinese-speaking crew has been running custom Apache modules on compromised Brazilian federal, state and municipal web servers since mid-2025, so the address bar and the TLD tell a visitor nothing useful.

Publishers:blog.checkpoint.cominfosecurity-magazine.comthehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 23%
Operator: Operator 58%
Investor: Investor 19%

Reality

Evidence67
Adoption58
Hype gap+26
Incentives66
Confidence65