They still used AWS servers in the USA to avoid some blocking. Baader Meinhof but just heard this episode https://www.npr.org/2025/05/23/1253043749/pig-butchering-sca... where they tracked down organization in Cambodia that specialized in targeting USA and China citizens for pig butchering and explained the mechanism of the scam using Tether cryptocurrency.