“How do we police a borderless digital world?” This question cuts to the heart of the U.S. government’s recent move to impose economic sanctions on Funnull Technology Inc., a cloud provider based in the Philippines. Funnull, it turns out, is not just another tech company—it’s become a linchpin in the sprawling, lucrative ecosystem of “pig butchering” scams, a type of virtual currency investment fraud that has defrauded countless victims globally. The U.S. Treasury’s action marks a significant step in a growing campaign to hold infrastructure enablers accountable for the cybercrimes they facilitate, but it also exposes the daunting challenges in regulating cross-border cyber threats.
“Pig butchering” scams—so named for their methodical, patient approach to coaxing victims into investing large sums of cryptocurrency—have surged in recent years, fueled by the relative anonymity and rapid growth of virtual currencies. Victims are groomed online over weeks or months, then pressured into “investments” that inevitably disappear. In January 2025, investigative outlet KrebsOnSecurity uncovered a key piece of this puzzle: Funnull Technology was providing the digital scaffolding—specifically, content delivery network (CDN) services—that helped these cybercriminal operations route their traffic through reputable U.S.-based cloud providers, evading detection and complicating enforcement efforts.
Funnull’s involvement is emblematic of a larger problem confronting technologists and policymakers alike. As cybersecurity expert Dr. Anne-Marie Spalding of the Cyber Threat Alliance explains, “Actors who operate in the shadows increasingly rely on legitimate cloud infrastructure to shield their activities. When companies like Funnull offer platforms that serve hundreds of thousands of scam-related websites, they become enablers of significant financial crime.” For users, the risk is real: beyond lost money, victims suffer long-term damage to trust in digital financial systems.
The U.S. Treasury’s Office of Foreign Assets Control (OFAC), responsible for administering sanctions, described Funnull as a “critical facilitator” of “pig butchering” scams, announcing restrictions on all business dealings with the company. This includes freezing any assets within U.S. jurisdiction and prohibiting U.S. entities from providing services. Such measures aim to disrupt the infrastructure that scammers rely on and send a message to other infrastructure providers worldwide.
From a policymaking perspective, this is a strategic escalation in the fight against cyber-enabled financial crime. Ambassador Julia Frifield, a former cyber policy advisor to the State Department, notes, “Sanctioning infrastructure providers represents a shift from targeting individual criminals to attacking the logistical frameworks they depend on. It’s a recognition that the ecosystem enabling these crimes is as culpable as the perpetrators themselves.” Yet, she also cautions about the limits of sanctions: “Without international cooperation, these efforts can displace malicious actors rather than dismantle them.”
Technologists face a complex dilemma. Cloud providers and CDNs traditionally champion openness and decentralization—key tenets of the internet’s architecture. However, that openness can be exploited by bad actors. Industry leaders like Rajesh Malhotra, CTO of a major cloud firm, emphasize the need for “robust vetting, continuous monitoring, and partnerships with law enforcement to identify and shut down malicious content quickly.” Still, the sheer scale of services involved, and the borderline between legitimate and illicit usage, complicates the task.
For everyday internet users, awareness and vigilance remain essential. The rise of “pig butchering” scams underscores how sophisticated cybercriminals have become, leveraging not just technology but human psychology. Victims often report feelings of shame and confusion, which scammers exploit further. Consumer advocacy groups urge enhanced public education campaigns alongside regulatory action.
As the global community grapples with these evolving threats, the Funnull sanctions illuminate a broader truth: cybercrime is no longer a niche problem but a systemic challenge that spans borders, industries, and disciplines. The U.S. move may hinder one critical node in the “pig butchering” network, but it raises urgent questions about the future of digital trust and governance.
Can the international community devise effective frameworks to police a virtual world where infrastructure is as vital as the criminals it harbors? Until then, the battle against scams hidden behind cloud facades continues, reminding us that in cyberspace, the lines between friend, foe, and enabler are often blurred.
