ESTsecurity ESRC reports Operation Dragon Messenger, attributed to the Geumseong121 APT cluster, using a website disguised as a North Korean defector fundraising project. The operation promoted Android apps through email, social media, and comments on North Korea-focused media sites, targeting defectors and organizations working on North Korea issues. ESRC identified threat clues in the distributed apps and related infrastructure, showing a mobile-focused social-engineering campaign.