Red Gambler was a financially motivated campaign tracked in South Korea from October 2016 through August 2017. A group previously associated with attacks on institutions and major companies shifted to ordinary users of Go-Stop and poker-style web-board games, deploying viewer malware that captured game screens and system information for operators who could monitor victims’ hands and rooms. The campaign abused legitimate utility-software websites for distribution and supported an illicit gambling ecosystem in which stolen visibility could be converted into direct financial advantage.