North Korea running malware-laden gambling websites as-a-service

A North Korea-linked IT unit known as Gyeongheung (affiliated with Office 39) builds and rents gambling websites that are pre-infected with malware to harvest gamblers' personal and financial information; the sites are rented to South Korean cybercrime groups, sold with tech support, and harvested data (approximately 1,100 South Korean records) has been marketed for profit. Operators used forged Chinese IDs and laundering via Chinese and South Korean accounts to evade sanctions, and the NIS reports substantial revenue generation from this illicit service.