Spyware Disguised As Korean App Targets Asia

This Cyble report analyzes a mobile spyware variant masquerading as a Korean video app that targets users in China, Korea, and Japan to collect sensitive data (contacts, SMS, location, images) and exfiltrate it to attacker-controlled C2 servers for sextortion/blackmail. The analysis includes APK metadata (package org.nnnmbook.sytyd, SHA256 0bda73046fd733164877071d11318ec6dd56a6ea4e773c70ed5a3c8f7a244478), observed permissions and behaviors, screenshots of data collection/upload flows, MITRE ATT&CK mappings, and IoCs including multiple C2 URLs and an IP address, plus recommended defensive actions.