ahmyth.jpeg (160 KB)

IssueMakersLab reported that North Korea's RGB-D5, including Kimsuky, distributed Android APK malware to many South Korean users. The post says the malware was created with the open source AhMyth Android RAT, indicating reuse of commodity mobile RAT code rather than a wholly custom implant. The supported CTI value is the DPRK-linked mobile targeting claim, the Kimsuky/RGB-D5 association, and the AhMyth-based APK delivery detail.