Kimsuky APT Deploys Fake App As KISA Security Program

**Executive summary:** Cyble reports that the North Korean-linked APT Kimsuky distributed a trojanized Android app impersonating the Korean Internet and Security Agency (KISA); when installed the app (SHA256 fe1a7340...) requests extensive permissions and performs SMS capture, location tracking, overlays, file access/deletion, and exfiltration to a C2 (http://app.at-me.ml/), with observed IoCs and MITRE ATT&CK mappings and recommended mitigation steps.