EU-24-V2-Islamoglu-Unmasking-State-Sponsored-Mobile-Surveillance.pdf (6 MB)

This Black Hat Europe presentation surveys mobile surveillance malware attributed to state-sponsored activity from Russia, China, and North Korea, including North Korea-linked families such as Hermit alongside references to Kimsuky and ScarCruft. The evidence describes Android-focused tradecraft including dynamic code loading, system-utility style icons and names, encrypted payload structures, and early-stage functionality intended to hide capabilities until later execution. For CTI teams, the report is most useful as a comparative reference for mobile APT behaviors, victimology, and detection considerations rather than a single incident write-up.