RedDawn is the name McAfee assigned to a Sun Team Android espionage campaign, rather than one unambiguous malware family. Operators uploaded malicious applications to Google Play as unreleased versions and also used Facebook links for distribution, targeting Korean victims including North Korean defectors and journalists. After installation, the spyware copied personal photographs, contacts, and SMS messages and transmitted them to the attackers. McAfee detected related samples as Android/RedDawn.A and Android/RedDawn.B.