Fraudulent gambling network may be a nation-state spying operation

A sprawling infrastructure that has bilked unsuspecting people via fraudulent gambling websites for 14 years is likely a dual operation run by a nation-state‑sponsored group targeting government and private‑industry organisations in the US and Europe, researchers said on 3 December 2025.

The basis for the speculation is the sheer scale and long‑term commitment, including 328,000 separate domains, 236,000 addresses bought, and 90,000 compromised, plus nearly 1,500 hijacked subdomains from legitimate organisations, with infrastructure costs estimated at between $725,000 and $17 million per year.

According to Malanta, the operation also uses thousands of long‑lived malicious Android apps on AWS, 38 GitHub accounts to host malware, and reverse proxies that abuse hijacked government domain names to disguise traffic. The focus on compromising Western government domains and a wide range of industries is cited as evidence of a potential APT, though researchers stop short of direct attribution to a specific government entity.

Researchers also found more than 51,000 compromised credentials linked to gambling sites, suggesting credentials were harvested and sold on underground markets, with the network possibly serving both a revenue stream and covert communication channels for more sensitive operations.