Hudson Rock links a Yemeni disinformation operator's RedLine Stealer infection to later Lazarus Group use of the same compromised news infrastructure. The infected Windows machine exposed WordPress and cPanel credentials for domains such as alnagm-press.com, azal-press.com, and gulfnaw.com, which had been used in a pro-Houthi fake media network. The report says Lazarus/APT38 acquired or used those stolen credentials to hijack aged news domains for command-and-control, malware delivery, or phishing activity targeting South Korean entities, citing Alyac/ESTsecurity analysis. The case matters because it shows how commodity infostealer logs can give a state actor trusted, pre-aged infrastructure without building new domains from scratch.