🎯Basically, criminals use Telegram to buy and sell illegal services easily.
What Happened
Chinese-language guarantee marketplaces, particularly on Telegram, are gaining traction among criminal groups. Despite the shutdown of Huione Guarantee in 2025, platforms like Dabai Guarantee have emerged, enabling cybercriminals to coordinate fraud campaigns across borders.
The Threat
Dabai Guarantee operates through numerous public and private Telegram channels, making it a hub for various cybercrime activities. It allows multiple Chinese-speaking criminal groups to collaborate on scams, targeting regions like South Korea and Japan. The marketplace facilitates operations such as ATM withdrawals and the purchase of goods for resale.
Who's Behind It
The marketplace is populated by independent criminal syndicates that often work in silos, limiting information sharing. This fragmentation complicates tracking efforts by law enforcement. The operators of Dabai Guarantee have learned from the mistakes of predecessors like Huione, avoiding a clearnet presence to enhance operational security.
Tactics & Techniques
Dabai Guarantee employs a bot search function, allowing users to easily find specific campaigns. The marketplace supports various fraudulent activities, including:
- ATM fraud: Utilizing techniques like ghost-tapping to withdraw cash.
- Retail fraud: Purchasing easily transportable goods, such as cosmetics, to evade detection.
- Phishing campaigns: Targeting individuals outside of China.
Defensive Measures
Organizations and individuals should be aware of the risks posed by these marketplaces. Here are some recommended actions:
Do Now
- 1.Monitor transactions: Keep an eye on unusual financial activities, especially involving cryptocurrencies.
- 2.Educate employees: Ensure that staff are aware of phishing tactics and fraud schemes.
Do Next
Conclusion
The rise of Chinese-language guarantee marketplaces on Telegram represents a significant threat in the cybercrime landscape. As these platforms evolve, they pose risks not only to financial institutions but also to individuals vulnerable to scams. Understanding their operations is crucial for developing effective countermeasures against these emerging threats.
🔒 Pro insight: The operational shift to Telegram highlights a growing trend in cybercriminals leveraging popular communication platforms for illicit activities.
.webp)
