North Korean advanced persistent threat actors have infiltrated a gaming platform in Yanbian, compromising both Windows and Android software to conduct surveillance on users1. This supply-chain attack involves trojanized gaming applications, allowing the threat actors to gather sensitive information from unsuspecting gamers. The compromised platform is believed to be a targeted attack, specifically designed to spy on users in the region. The use of trojanized software is a common tactic employed by state-aligned actors, including North Korean groups, to gain access to sensitive information. The shift from criminal to state-aligned activity changes the threat model, requiring a different approach to mitigation and defense. This attack highlights the importance of vigilance and robust security measures in the gaming industry, particularly in regions targeted by state-sponsored threat actors, so what matters most to practitioners is recognizing the geopolitical implications of such attacks and adapting their security strategies accordingly.