Unit 42 links an expanded Android spyware set to the North Korean Reaper group, also known as APT37, Scarcruft, Group 123, or Red Eyes. The activity includes trojanized versions of a Bitcoin Ticker Widget and a PyeongChang Winter Games application that prompt users to update, then download spyware from cgalim[.]com. The newer KevDroid variant can record audio and video, list files, collect device and account data, root the device, and exfiltrate call recordings. Stolen data is staged under /sdcard/_pu, AES-encrypted with the key 08D03B0B6BE7FBCD, and uploaded to hakproperty.com infrastructure, showing Reaper’s mobile operations were actively evolving around topical lures.