Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.