Reaper Group’s Updated Mobile Arsenal
Summary: Unit 42 examined EST Security's findings on Android spyware used in spear phishing attachments by the North Korean Reaper group (also tracked as APT37, Scarcruft, Group 123 or Red Eyes) and found a more advanced variant, which Talos named KevDroid. The research also uncovered trojanized versions of a Bitcoin Ticker Widget and a PyeongChang Winter Games application that act as downloaders, pulling payloads from hxxp://cgalim.com/admin/hr/1[.]apk, a domain Palo Alto Networks had already seen the Reaper group use in non-mobile attacks.
What's compelling: The downloaders were signed with the same certificate, and the spyware AES-encrypts stolen call and device data with the key "08D03B0B6BE7FBCD" before sending it to hxxp://hakproperty.com/new/plat/pu[.]php?do=upload - a supply chain of look-alike apps that never touched Google Play.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026