McAfee analyzed a repackaged Korean Bible-reading Android APK that contained and executed a backdoor ELF from its assets, turning infected devices into bots. The implant stored encoded control-server IPs in /data/system/dnscd.db, randomly selected a server, and sent callback beacons disguised as SSL ClientHello traffic with well-known domains in the SNI field. After connecting, it accepted command codes from the controller and returned execution results using a custom protocol. McAfee linked the mobile backdoor to Lazarus with high confidence based on reused campaign infrastructure, similar encryption-key generation routines, fake TLS callback logic, and protocol similarities to executables used by the group.