Online casino in Central America

Theorganisation is an online casino that provides gambling services via internet platforms. Its primary market focus is the Central American region, where it offers its gaming products to customers. The company’s headquarters is located in Namibia, despite its regional concentration on Central America.

On 3 April 2018, the Lazarus APT group launched a targeted cyber operation against the online casino. The attackers deployed customized malware that incorporated the KillDisk disk‑wiper to destroy data on infected systems. Credential‑stealing capabilities were provided by the Mimikatz tool, which was used to harvest passwords from compromised hosts. Remote access utilities such as Radmin and LogMeIn were installed to maintain persistent control over the victim’s environment. Multiple backdoors, including variants of Win64/NukeSped, were employed for command execution and session hijacking. The intrusion mirrored earlier Lazarus campaigns that had targeted financial institutions in Poland, Mexico, and various Latin American countries. Having obtained administrative privileges, the attackers installed malicious services and injected code into legitimate processes. Browser passwords were exfiltrated from the compromised machines as part of the data‑collection effort. All tools used in the operation were recompiled specifically for this attack, reflecting Lazarus’s adaptive tradecraft. Despite the extensive toolset, the primary motivation behind the incident—whether sabotage, espionage, or extortion—remained unclear to investigators.