South Korea's National Intelligence Service said it identified Kyonghung Information Technology Exchange, a North Korean foreign currency earning unit operating in Dandong, China, that built and sold thousands of illegal gambling sites to South Korean criminal organizations. The unit allegedly worked under Office 39 and Reconnaissance General Bureau-linked leadership, used forged or borrowed Chinese identities to pose as developers, and charged about $5,000 per site plus monthly maintenance and user-growth fees. Investigators said the group embedded malware in auto-betting software, collected gambling members' personal data, and attempted to sell about 1,100 Korean records. South Korean authorities also found that servers supplied by the criminal customers were used to hack Korean companies, while payments moved through Chinese accounts, borrowed-name Korean accounts, PayPal, and similar services.