Microsoft Word - Dragon Messenger_eng.docx

## Executive Summary: ESRC describes "Dragon Messenger," a Geumseong121 mobile APT campaign that spread malicious Android apps (one briefly on Google Play) disguised as a charity for North Korean defectors and as secure messengers, using social engineering via KakaoTalk/Facebook/YouTube; the apps harvest credentials (stored in plaintext), exfiltrate SMS/contacts, can eavesdrop on calls and capture KakaoTalk content, reuse code/path artifacts from prior Geumseong121 samples, and include cryptographic/file manager components and provided file-hash IoCs.