Ringleader Indicted and Detained for Creating Gambling Sites with North Korean Hackers via Telegram

Contacted North Korean Hackers 1,181 Times via Telegram
Violation of the National Security Act

Seoul Central District Prosecutors' Office, Seocho-gu, Seoul. Photo by Kang Jinhyung

The leader of an organization, identified as Kim, who conspired with North Korean hackers to create illegal gambling websites and distribute them domestically, has been indicted and detained for trial.

On May 26, the Public Investigation Division 1 of the Seoul Central District Prosecutors' Office (headed by Chief Prosecutor Lee Chankyu) indicted Kim while in custody on charges including violation of the National Security Act, establishing gambling venues, and violation of the Act on Regulation of Concealment of Criminal Proceeds. Kim is accused of commissioning two North Korean hackers affiliated with Bureau 313 (formerly the Korea Computer Center) under the North Korean Ministry of Munitions Industry to develop gambling websites between October and November 2023. He is also charged with communicating 1,181 times via Telegram and other means to check for errors, which constitutes meeting and communication under the National Security Act.

During the same period, Kim is also accused of receiving a gambling solution promotion program from another North Korean hacker affiliated with the 5th Bureau (Foreign Intelligence Bureau) of the North Korean Reconnaissance General Bureau, which constitutes voluntary support and receipt of goods under the National Security Act. He then distributed 71 related domains to 16 domestic gambling website operators in an attempt to profit (establishing gambling venues).

Bureau 313 is the department that oversees North Korea's information technology strategy. It acquires foreign currency by securing illegal program contracts through its branch in China. According to the prosecution, this organization is also known to serve as a base for cyber operations against South Korea in times of emergency. Kim is further charged with obtaining 1,283,550,000 KRW in criminal proceeds from distributing gambling websites between November 2022 and August 2024 using accounts under borrowed names (in violation of the Act on Regulation of Concealment of Criminal Proceeds).

The prosecution estimates that the illegal proceeds transferred by the gambling website distribution organization to fraudulent accounts over three years and five months amounted to approximately 23.5 billion KRW, and that about 30% of this was delivered to North Korean hackers and ultimately handed over to the regime.

Investigation results indicate that the gambling website distribution organization operates out of China, where evading crackdowns is easier and costs are lower, enabling smooth money laundering and currency exchange compared to South Korea. The prosecution is continuing its investigation into three accomplices who remain at large in China and Vietnam to avoid arrest and searches.

A prosecution official stated, "We will respond strictly to crimes that threaten national security and increase the risk of North Korean cyberterrorism against South Korea." The investigation began in January 2023 following intelligence received by the National Intelligence Service, and was fully launched in November of the same year when police searched Kim's residence after he entered South Korea.

This content was produced with the assistance of AI translation services.