AhnLab Finds 12 Fake Sites Impersonating Korean Brands to Collect USDT

ASEC Flags 12 Cloned Corporate Sites

Security researchers at the AhnLab Security Intelligence Center (ASEC) identified 12 suspicious websites impersonating well-known South Korean companies to solicit digital asset transfers, with robotics firm Doosan Robotics and the Chum-Churum soju brand among the abused names. The discovery emerged while ASEC analysts were tracing the server infrastructure behind ValleyRAT, a remote-access Trojan that gives attackers control of an infected computer. The security firm reported the findings on October 28. The cloned pages are built to pass for official corporate homepages. ASEC's review found they lift the targeted companies' logos, promotional footage and introductory material wholesale, and the operation goes beyond a static promo page. Each site runs member registration and login, and several operate an invitation-code scheme paired with a VIP tier system that assigns enrolled users a status level. The tiering manufactures credibility, giving a visitor the impression of joining a structured program rather than landing on an anonymous payment page. Registration is not decorative either: an account with a tier attached makes the later payment request look like a routine step inside a program the user already believes in. Brand recognition does the rest of the work, lowering the guard an unknown website would raise immediately. That trust-building funnels into a single payment request. During online chat consultations embedded in the sites, operators guided visitors toward sending Tether (USDT), the dollar-pegged stablecoin, to wallet addresses on the TRON network. The captured consultation flow shows participants being handed TRON addresses and instructed to submit a screenshot of the completed transfer as proof of payment. The choice of rail is deliberate. The Tether (USDT) price is pegged to the dollar, so the amount demanded never drifts, and a transfer on the TRON mainnet settles in seconds and cannot be recalled. For a fraudster, that combination removes price risk and reversal risk in one stroke.

Five Deposits, Three Withdrawals on TRON

Blockchain records show the scheme has already moved some funds. When ASEC analyzed the TRON wallet linked to the site impersonating the Chum-Churum soju brand, the on-chain history recorded five incoming USDT transfers and three outgoing ones. All five deposits originated from a single external wallet, a concentration that points to one funding source rather than a broad base of victims, although the firm drew no conclusion about who controls that address. The three outgoing transfers show the address is actively managed rather than dormant. The cumulative history of that external wallet is far larger than anything visible in the five transfers. ASEC's examination put its lifetime intake at roughly 13 million USDT. The security center is precise about what the figure is and is not: it represents the wallet's entire cumulative receiving volume, not the transaction volume of the impersonation site and not a confirmed tally of fraud losses. Actual victim losses tied to the cloned domains have not been established, and the number of users who completed a transfer remains unknown. The malware thread adds a second layer of uncertainty. ASEC stated that no direct operational connection between the ValleyRAT malware operation, the impersonation websites and the identified wallets has been confirmed so far. The domains surfaced during the same investigation, and the shared infrastructure trail is what brought them onto the research team's radar, but overlapping timing does not prove common ownership. Either the group running the Trojan also built the fake sites, or an unrelated crew set up payment pages that happened to intersect with the malware's server footprint. The analysis leaves that question open. TRON's role here is structural, because transfers settle quickly and cheaply on a chain that guides such as Where to Buy Tron (TRX) walk through for newcomers; for the victims in this case, the decisive property is finality. The incident also lands in an active lane of Tether-based fraud, including a 15.99M USDT breach at CoinDCX and a $4.85M USDT drain from the Ethereum project X100.

What the Wallet Record Does Not Show

The mechanics are the point of this case. Unlike a bank transfer, or a hypothetical retail central bank digital currency with built-in recovery, a USDT payment on TRON is final the moment the victim signs it, so the only friction operators must overcome is trust. The borrowed logos, chat support and VIP tiers supply exactly that. The confirmed sums are modest beside the token's overall market cap: even the wallet with roughly 13 million USDT in lifetime receipts is small next to the $1 billion, five-day contraction the USDT market cap recorded. What remains open is narrower: five deposits and three withdrawals are the confirmed flows, the 13 million USDT is lifetime volume with no proven link to the fake sites, and no operational tie to ValleyRAT has been established. The file sits with ASEC, which has not yet named an operator or a confirmed victim total.