ScarCruft hackers push BirdCall Android malware via game platform

The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform.

BleepingComputer
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games.

🐦 Sbarco in grande stile per BirdCall su Android! Il mondo del gaming non sarà più lo stesso. #BirdCall #AndroidGaming 🎮

🔗 https://www.tomshw.it/smartphone/birdcall-android-giochi-apt37

BirdCall sbarca su Android: il gaming apre la strada

APT37 ha diffuso lo spyware BirdCall Android tramite APK trojanizzati su una piattaforma di giochi usata da utenti coreani in Cina.

Tom's Hardware

#ESETresearch uncovered a multiplatform supply-chain attack by the 🇰🇵 #ScarCruft APT group targeting the Yanbian region via backdoor-laced Windows and Android games. https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/
In the attack, likely ongoing since late 2024, ScarCruft compromised sqgame, a video game platform used by ethnic Koreans living in the #Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors.
The sqgame Windows client was compromised through a malicious update serving the #RokRAT backdoor, which deployed ScarCruft’s more advanced #BirdCall backdoor. Android games were trojanized with the Android version of BirdCall – a new tool in ScarCruft’s arsenal.
The Android version of BirdCall implements a subset of the capabilities of its Windows counterpart – it collects contacts, SMS messages, call logs, and various documents, media files, and private keys. It can also take screenshots and record surrounding audio.
We believe that this campaign is probably aimed at collecting information on individuals in the Yanbian region and deemed of interest to the 🇰🇵 regime.
IoCs available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/scarcruft

Read the full analysis on WeLiveSecurity: https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/#article-2

I was watering the yard after scattering a bunch of wildflower seeds, then I heard a familiar sound. These two hawks were circling overhead.

(Please excuse the bladder triggering sounds, I was still holding the garden hose while filming 😁)

#hawks #hawk #buzzard #buteobuteo #buizerd #birdsofmastodon #birds #fedibirds #birdsofprey #roofvogel #blueskies #springtime #pretty #birdcall #niceday

Grackles, Redwing Blackbirds, Highway traffic, 2 bikers & I.
https://voca.ro/16CXHq5I0zpO

#audio #birds #birdcall

Vocaroo | Online voice recorder

Vocaroo is a quick and easy way to share voice messages over the interwebs.

Spectogram of the call...
#spectogram #birdcall #paintedBunting
BirdNET Observation - Painted Bunting - Passerina ciris - 2025-07-04 15:50:44
#birdCall #bird #PaintedBunting #BirdNet #PasserinaCiris
Cardinal on a wire mouth open in mid call

#birds #cardinal #red #birdcall #birdwatching #photography #morningcall