ESRC-1808-TLP-White-IR002_RocketMan_English.pdf

**Executive Summary:** ESTsecurity's ESRC describes 'Operation Rocket Man,' a sustained, state‑sponsored APT campaign (Geumseong121) using spear‑phishing, watering‑hole and fake security apps to deliver Windows/.NET malware and Android trojans, exploiting multiple vulnerabilities (including CVE‑2018‑4878), using evolving C2 channels (AIM, WordPress sites, cloud services, PubNub) and leaving extensive IoCs (domains, MD5s, mutexes, IPs, PDB paths) for detection and mitigation.