U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams

The U.S. Treasury Department has sanctioned Funnull Technology Inc., a Philippines-based company, and its administrator Liu Lizhi for providing infrastructure that facilitated virtual currency investment scams, known as "pig butchering," resulting in over $200 million in reported losses to U.S. victims. Funnull's operations are linked to the majority of virtual currency investment scam websites reported to the FBI, with the company acting as a criminal content delivery network routing traffic through U.S.-based cloud providers like Amazon and Microsoft, although the effectiveness of Amazon's efforts to remove Funnull servers has been questioned. This action highlights the ongoing challenge of preventing cybercriminals from exploiting U.S. cloud infrastructure for illicit activities.

Analysis

The U.S. Treasury Department has imposed economic sanctions on Funnull Technology Inc. and its administrator, Liu Lizhi, for providing essential computer infrastructure that enabled "pig butchering" virtual currency investment scams, leading to over $200 million in U.S. victim-reported losses. Funnull operated as a criminal content delivery network, routing illicit traffic through U.S.-based cloud providers, including Amazon Web Services (AWS) and Microsoft Azure. While Microsoft reportedly succeeded in removing Funnull's malicious infrastructure from its networks following a January 2025 KrebsOnSecurity report based on Silent Push research, Amazon continues to face challenges in effectively eliminating Funnull servers, some of which have persisted since 2023, drawing criticism for its perceived inadequate response despite claims of actively countering abuse. This situation underscores the persistent exploitation of U.S. cloud infrastructure by cybercriminals due to the reluctance of organizations to block traffic from these major networks and the advantages of using geographically proximate U.S. IP addresses. The sanctions on Funnull, and similar EU sanctions on entities like Stark Industries Solutions for facilitating Russian cyber activities, highlight a growing regulatory focus on disrupting the infrastructure supporting cybercrime and state-sponsored malicious online operations, which presents ongoing operational and reputational considerations for major cloud service providers.

Key Decisions for Investors

• Investors in Amazon (AMZN) should monitor the company's efforts and disclosures regarding the mitigation of illicit activities on AWS, as persistent issues could pose reputational risks and attract further regulatory scrutiny, reflected in the negative sentiment score.
• Microsoft's (MSFT) reported success in addressing the Funnull infrastructure may positively differentiate its platform governance, potentially enhancing its attractiveness to clients concerned with security and compliance.
• Consider the broader implications for the cloud computing sector, including potential increases in compliance costs and operational burdens as providers face heightened pressure to police their platforms against misuse.
• Monitor regulatory developments related to cybersecurity and platform accountability, as these could significantly impact the operational landscape and cost structures for U.S.-based cloud providers.