Operation Blackbird was a targeted mobile-espionage campaign attributed by ESRC to Geumseong121, a group that had previously focused on servers and personal computers in South Korea. Observed from at least August 2017, it targeted North Korean defectors and people connected to them by delivering Android spyware through direct links sent over social networks and messengers, sometimes masquerading as useful applications. The implants collected private data and exfiltrated it through public cloud services or compromised web servers, with code, signing-certificate, and command-and-control characteristics used to track successive variants.