ESRC described Konni activity linked to Kimsuky using spear-phishing email that impersonated a cryptocurrency exchange security notice and pushed an Android APK named BithumbProtect.apk. The attackers spoofed sender details and used exchange-themed cloud-download imagery to make the mobile lure appear legitimate. Analysis found overseas first-stage C2 infrastructure and folder names referencing Korean portals and cryptocurrency brands, indicating preparation for targeted Android compromise. The report is useful for defenders monitoring Konni/Kimsuky mobile tradecraft against cryptocurrency users.