DPRK_EYES_ON_MOBILEOPCDE2018-FINAL.PDF (5 MB)

OPCDE 2018 researchers Jaewon Min and Inhee Han analyzed Lazarus-linked Android backdoors and a separate mobile-focused cluster they named Sun Team targeting North Korean defectors and related support groups. The Lazarus section described repackaged Korean Bible APKs with an added ELF backdoor, encoded C2 lists, disguised ClientHello-style communications, and commands for file transfer, shell execution, C2 switching, device-information theft, and self-termination. The Sun Team section documented social-engineering through Facebook and KakaoTalk, hacked web servers, Google Drive, and Google Play apps such as NKPrayer, Fortune Telling, Food Info, Marketing, and FastAppLock that exfiltrated calls, SMS, contacts, external-storage files, GPS/location data, and device information to Yandex or Dropbox. The presentation also exposed OPSEC mistakes including cloud test data, actor device logs, TextNow usage, and Android exploit use including CVE-2015-6764 and CVE-2016-5195.