ESET researchers uncovered a multiplatform supply-chain assault by North Korea-aligned APT group ScarCruft, focusing on the Yanbian area in China \u2013 residence to ethnic Koreans and a crossing level for North Korean refugees and defectors. Within the assault, in all probability ongoing since late 2024, ScarCruft compromised Home windows and Android elements of a online game platform devoted to Yanbian-themed video games, trojanizing them with a backdoor.<\/p>\n
The backdoor, named BirdCall by ESET, was initially recognized to focus on Home windows solely; the Android model was found as a part of this supply-chain assault. On this blogpost, we offer an outline of the assault, and the primary public evaluation of the Android backdoor.<\/p>\n
\nKey factors of this blogpost:<\/strong><\/p>\n
\n
- North Korea-aligned APT group ScarCruft compromised a online game platform utilized by ethnic Koreans dwelling within the Yanbian area in China.<\/li>\n
- The gaming platform\u2019s Home windows shopper was compromised by a malicious replace resulting in the RokRAT backdoor, which deployed the extra subtle BirdCall backdoor.<\/li>\n
- Android video games out there on the gaming platform had been trojanized to comprise the Android model of the BirdCall backdoor \u2013 a brand new device in ScarCruft\u2019s arsenal.<\/li>\n
- The objective of the marketing campaign is espionage, with the backdoor able to amassing private knowledge and paperwork, taking screenshots, and making voice recordings.<\/li>\n<\/ul>\n<\/blockquote>\n
Scarcruft profile<\/h2>\n
ScarCruft, often known as APT37 or Reaper, has been working since not less than 2012 and is suspected to be a North Korean espionage group<\/a>. It primarily focuses on South Korea, however different Asian nations have additionally been focused. ScarCruft appears to be primarily in authorities and navy organizations, and corporations in varied industries linked to the pursuits of North Korea. The group additionally targets North Korean defectors, with the newest such exercise introduced on this blogpost.<\/p>\n
BirdCall backdoor<\/h2>\n
Home windows model<\/h3>\n
BirdCall is a Home windows backdoor written in C++ that we found in 2021 and attributed to ScarCruft as a part of the ESET Menace Intelligence<\/a> reporting.<\/p>\n
The backdoor has a variety of spying capabilities, together with taking screenshots, logging keystrokes and clipboard content material, stealing credentials and recordsdata, and executing shell instructions. For C&C functions, the backdoor makes use of official cloud storage companies, comparable to Dropbox or pCloud, or compromised web sites. BirdCall is normally deployed in a multistage loading chain, beginning with a Ruby or Python script, and containing elements encrypted utilizing a computer-specific key. The preliminary model of BirdCall was publicly described by South Korean distributors in 2021 as a complicated model of RokRAT (S2W<\/a>, AhnLab<\/a>).<\/p>\n
Android model<\/h3>\n
The Android model of BirdCall, found within the assault that we describe on this blogpost, implements a subset of the instructions and capabilities of the Home windows backdoor \u2013 it collects contacts, SMS messages, name logs, paperwork, media recordsdata, and personal keys. It could additionally take screenshots and report surrounding audio.<\/p>\n
Primarily based on our analysis, Android BirdCall was actively developed over a span of a number of months. We recognized seven variations, starting from model 1.0 (created roughly in October 2024) to model 2.0 (created roughly in June 2025).<\/p>\n
Discovery<\/h2>\n
Our investigation began with a suspicious APK file discovered on VirusTotal. Upon preliminary evaluation, we decided that the APK is malicious and incorporates a backdoor.<\/p>\n
Curiously, the APK turned out to be a trojanized card recreation known as \u5ef6\u8fb9\u7ea2\u5341 (machine translation: Yanbian Crimson Ten), which we traced to its official web site, https:\/\/www.sqgame[.]web<\/span>. sqgame is a gaming platform tailor-made for the individuals of Yanbian and hosts conventional Yanbian video games for Home windows, Android, and iOS. The gamers can compete in card and board video games (see Determine\u00a01) with buddies or be part of organized tournaments.<\/p>\n
Determine 1. Yanbian Crimson Ten recreation<\/em><\/figcaption><\/figure>\n Surprisingly, the APK out there for obtain on the official web site is similar because the APK we initially discovered on VirusTotal. Furthermore, a second Android recreation (\u65b0\u753b\u56fe, machine translation: New Drawing) out there for obtain from sqgame was additionally trojanized with the identical backdoor. Additional evaluation revealed that the backdoor is an Android port of the ScarCruft group\u2019s BirdCall backdoor.<\/p>\n
The Home windows desktop shopper hyperlink on the sqgame web site results in a few-years-old installer that seems to be clear. It does obtain updates as soon as put in, however we didn’t determine any malicious code there throughout our evaluation.<\/p>\n
Investigating additional in ESET telemetry, we recognized a trojanized mono.dll<\/span> library, originating from an replace package deal for the desktop shopper. ESET telemetry exhibits that this replace package deal had been malicious since not less than November 2024, for an unknown interval. On the time of writing, this replace package deal was not malicious.<\/p>\n
We additionally checked the iOS recreation out there on the sqgame web site and didn\u2019t discover any malicious code. We expect that ScarCruft skipped this platform, for the reason that trojanization and supply of the app can be far more tough in comparison with different platforms, presumably working into Apple\u2019s overview course of.<\/p>\n
Victimology<\/h2>\n
For the reason that web site compromised on this assault is devoted to the individuals of Yanbian and their conventional video games, we infer that the first targets are ethnic Koreans dwelling in Yanbian. Yanbian Korean Autonomous Prefecture is a area in China that borders North Korea and is residence to the biggest ethnic Korean neighborhood exterior Korea.<\/p>\n
On this context, we consider that it’s possible that the assault was aimed toward amassing info on people primarily based in (or originating from) the Yanbian area and deemed of curiosity to the North Korean regime \u2013 most certainly refugees or defectors.<\/p>\n
Assault overview<\/h2>\n
Android<\/h3>\n
Two of the Android video games out there on the sqgame web site had been discovered to be trojanized to comprise the BirdCall backdoor. The obtain web page out there at https:\/\/www.sqgame[.]web\/video games\/gamedownload.aspx<\/span> is proven in Determine\u00a02, with obtain buttons for the 2 trojanized video games highlighted in crimson. The third out there Android recreation was clear on the time of our evaluation.<\/p>\n
Determine 2. Obtain web page resulting in trojanized video games<\/em><\/figcaption><\/figure>\n We discovered proof that the victims downloaded the trojanized video games by way of an online browser on their gadgets and doubtless put in them deliberately. We’ve not discovered some other APK areas. We additionally haven’t discovered the malicious APKs on the official Google Play retailer.<\/p>\n
We had been unable to find out when the web site was first compromised and the supply-chain assault began. Nevertheless, primarily based on our evaluation of the deployed malware, we estimate that it occurred in late 2024.<\/p>\n
Desk\u00a01 exhibits the internet hosting URLs of the 2 trojanized APK recordsdata, together with the hashes of recordsdata served on the time of discovery. On the time of writing of this blogpost, the malicious recordsdata had been nonetheless up on the sqgame web site. We notified sqgame of the compromise in December 2025, however haven\u2019t acquired a response.<\/p>\n
Desk\u00a01. Malicious samples<\/em><\/p>\n
![\"Figure](\"https:\/\/web-assets.esetstatic.com\/wls\/2026\/04-26\/scarcruft\/figure-1.jpg\" "\\"Figure")
![\"Figure](\"https:\/\/web-assets.esetstatic.com\/wls\/2026\/04-26\/scarcruft\/figure-2.png\" "\\"Figure")
![\"Figure](\"https:\/\/web-assets.esetstatic.com\/wls\/2026\/04-26\/scarcruft\/figure-3.png\" "\\"Figure")