Fake sites impersonating Korean brands push USDT payments amid ValleyRAT probe

AhnLab Security Intelligence Center (ASEC) says it found a cluster of websites impersonating domestic Korean corporations and brands while tracking infrastructure tied to the ValleyRAT remote-access malware. For payments people, the interesting bit is not the branding stunt itself, but the payment flow: the sites were steering users toward USDT on TRON and asking for screenshots, which is the sort of thing that tends to show up where compliance teams start paying attention.

1. ASEC said it identified numerous websites posing as Doosan Robotics, the liquor brand Chum-Churum, and other domestic corporations and brands. The sites used real logos, promotional videos, and company introductions to look like official pages rather than obvious lookalikes.
2. The fake sites offered invitation code-based sign-ups, logins, fee history lookups, VIP member functions, and cryptocurrency deposit and withdrawal functions. In online consultation chats, they also gave instructions for payments in Tether (USDT), the dollar-pegged stablecoin, and provided wallet addresses on TRON, the cryptocurrency remittance network.
3. ASEC said it observed five USDT deposits and three withdrawals connected to a site impersonating Chum-Churum, all involving a specific TRON wallet. All five deposits came from the same external wallet, which has reportedly received about 13 million USDT in cumulative inflows since the past, equal to about $13 million at the dollar peg, or about 17.3 billion won.
4. The security team said it traced the infrastructure by following the IP addresses of servers used by the existing ValleyRAT malware and reviewing past website records. That process led to 11 related domains, and after additional similar sites were found, the total number of suspected related domains rose to 12.
5. ASEC also said there is no confirmed direct operational connection between the ValleyRAT malware operation and the impersonation websites and cryptocurrency wallets. It added that it has not been proven the funds came from actual financial fraud.

For PSPs, acquirers, and crypto-facing compliance teams, the takeaway is straightforward: branded impersonation sites can be used to funnel users into stablecoin payments, and the presence of USDT on TRON plus repeated wallet reuse is exactly the kind of pattern that deserves wallet-level scrutiny, even before anyone proves the money trail end to end.