Unit 42 identified a mobile-focused malware cluster tied by code, mutex, and infrastructure overlaps to Operation Blockbuster activity, with targeting evidence pointing to Korean language speakers using Samsung devices. A Windows PE server named JAVAC.EXE serves JavaScript, ELF ARM files, and nested APK payloads, including a chain that installs a final Android backdoor. The Android implant can persist across boot, manipulate files, record microphone and camera data, collect GPS, contacts, SMS/MMS, browsing history, bookmarks, and Wi-Fi information. The ELF ARM samples use fake TLS-style command-and-control by placing legitimate-looking domains in SNI while connecting to embedded C2 IPs, and the report notes reused infrastructure such as 175.100.189.174 and 119.29.11.203 across related malware. The findings matter because they extend Operation Blockbuster-linked tradecraft into mobile targeting and show both technical reuse and social disguise elements aimed at South Korean victims.