ScarCruft compromises gaming platform in a supply-chain assault

ESET researchers uncovered a multiplatform supply-chain assault by North Korea-aligned APT group ScarCruft, focusing on the Yanbian area in China – residence to ethnic Koreans and a crossing level for North Korean refugees and defectors. Within the assault, in all probability ongoing since late 2024, ScarCruft compromised Home windows and Android elements of a online game platform devoted to Yanbian-themed video games, trojanizing them with a backdoor.

The backdoor, named BirdCall by ESET, was initially identified to focus on Home windows solely; the Android model was found as a part of this supply-chain assault. On this blogpost, we offer an outline of the assault, and the primary public evaluation of the Android backdoor.

Key factors of this blogpost:

• North Korea-aligned APT group ScarCruft compromised a online game platform utilized by ethnic Koreans dwelling within the Yanbian area in China.
• The gaming platform’s Home windows shopper was compromised by means of a malicious replace resulting in the RokRAT backdoor, which deployed the extra subtle BirdCall backdoor.
• Android video games obtainable on the gaming platform have been trojanized to include the Android model of the BirdCall backdoor – a brand new device in ScarCruft’s arsenal.
• The aim of the marketing campaign is espionage, with the backdoor able to accumulating private knowledge and paperwork, taking screenshots, and making voice recordings.

Scarcruft profile

ScarCruft, also referred to as APT37 or Reaper, has been working since at the very least 2012 and is suspected to be a North Korean espionage group. It primarily focuses on South Korea, however different Asian international locations have additionally been focused. ScarCruft appears to be primarily in authorities and army organizations, and corporations in varied industries linked to the pursuits of North Korea. The group additionally targets North Korean defectors, with the most recent such exercise introduced on this blogpost.

BirdCall backdoor

Home windows model

BirdCall is a Home windows backdoor written in C++ that we found in 2021 and attributed to ScarCruft as a part of the ESET Menace Intelligence reporting.

The backdoor has a variety of spying capabilities, together with taking screenshots, logging keystrokes and clipboard content material, stealing credentials and recordsdata, and executing shell instructions. For C&C functions, the backdoor makes use of official cloud storage companies, comparable to Dropbox or pCloud, or compromised web sites. BirdCall is normally deployed in a multistage loading chain, beginning with a Ruby or Python script, and containing elements encrypted utilizing a computer-specific key. The preliminary model of BirdCall was publicly described by South Korean distributors in 2021 as a sophisticated model of RokRAT (S2W, AhnLab).

Android model

The Android model of BirdCall, found within the assault that we describe on this blogpost, implements a subset of the instructions and capabilities of the Home windows backdoor – it collects contacts, SMS messages, name logs, paperwork, media recordsdata, and personal keys. It might probably additionally take screenshots and file surrounding audio.

Based mostly on our analysis, Android BirdCall was actively developed over a span of a number of months. We recognized seven variations, starting from model 1.0 (created roughly in October 2024) to model 2.0 (created roughly in June 2025).

Discovery

Our investigation began with a suspicious APK file discovered on VirusTotal. Upon preliminary evaluation, we decided that the APK is malicious and accommodates a backdoor.

Curiously, the APK turned out to be a trojanized card recreation referred to as 延边红十 (machine translation: Yanbian Purple Ten), which we traced to its official web site, https://www.sqgame[.]web. sqgame is a gaming platform tailor-made for the folks of Yanbian and hosts conventional Yanbian video games for Home windows, Android, and iOS. The gamers can compete in card and board video games (see Determine 1) with mates or be part of organized tournaments.

Surprisingly, the APK obtainable for obtain on the official web site is identical because the APK we initially discovered on VirusTotal. Furthermore, a second Android recreation (新画图, machine translation: New Drawing) obtainable for obtain from sqgame was additionally trojanized with the identical backdoor. Additional evaluation revealed that the backdoor is an Android port of the ScarCruft group’s BirdCall backdoor.

The Home windows desktop shopper hyperlink on the sqgame web site results in a few-years-old installer that seems to be clear. It does obtain updates as soon as put in, however we didn’t establish any malicious code there throughout our evaluation.

Investigating additional in ESET telemetry, we recognized a trojanized mono.dll library, originating from an replace package deal for the desktop shopper. ESET telemetry reveals that this replace package deal had been malicious since at the very least November 2024, for an unknown interval. On the time of writing, this replace package deal was now not malicious.

We additionally checked the iOS recreation obtainable on the sqgame web site and didn’t discover any malicious code. We predict that ScarCruft skipped this platform, for the reason that trojanization and supply of the app could be way more troublesome in comparison with different platforms, presumably operating into Apple’s evaluate course of.

Victimology

For the reason that web site compromised on this assault is devoted to the folks of Yanbian and their conventional video games, we infer that the first targets are ethnic Koreans dwelling in Yanbian. Yanbian Korean Autonomous Prefecture is a area in China that borders North Korea and is residence to the most important ethnic Korean neighborhood outdoors Korea.

On this context, we imagine that it’s possible that the assault was geared toward accumulating info on people based mostly in (or originating from) the Yanbian area and deemed of curiosity to the North Korean regime – most certainly refugees or defectors.

Assault overview

Android

Two of the Android video games obtainable on the sqgame web site have been discovered to be trojanized to include the BirdCall backdoor. The obtain web page obtainable at https://www.sqgame[.]web/video games/gamedownload.aspx is proven in Determine 2, with obtain buttons for the 2 trojanized video games highlighted in crimson. The third obtainable Android recreation was clear on the time of our evaluation.

We discovered proof that the victims downloaded the trojanized video games by way of an internet browser on their gadgets and doubtless put in them deliberately. We’ve got not discovered another APK areas. We additionally haven’t discovered the malicious APKs on the official Google Play retailer.

We have been unable to find out when the web site was first compromised and the supply-chain assault began. Nonetheless, based mostly on our evaluation of the deployed malware, we estimate that it occurred in late 2024.

Desk 1 reveals the internet hosting URLs of the 2 trojanized APK recordsdata, together with the hashes of recordsdata served on the time of discovery. On the time of writing of this blogpost, the malicious recordsdata have been nonetheless up on the sqgame web site. We notified sqgame of the compromise in December 2025, however haven’t acquired a response.

Desk 1. Malicious samples

Home windows

Whereas the Home windows desktop shopper obtainable on the sqgame web site didn’t include malicious code once we analyzed it, we later recognized a trojanized mono.dll library, originating from an replace package deal of the desktop shopper hosted on the URL http://xiazai.sqgame.com[.]cn/courting/20240429.zip. ESET telemetry reveals that this replace package deal had been malicious since at the very least November 2024, for an unknown interval – however on the time of writing, this replace package deal was now not malicious.

ScarCruft took a clear mono library and patched it with additional code and knowledge, containing a downloader. The downloader first checks operating processes for evaluation instruments and digital machine environments and doesn’t proceed if any are discovered. In any other case, it appears for the method of the sqgame shopper and constructs a path to the mono library in its set up folder.

Subsequent, it downloads and executes shellcode, which contained the RokRAT backdoor on the time of discovery. Lastly, the downloader terminates the shopper course of and downloads the unique clear model of the mono library, changing the trojanized one within the put in shopper folder. Each the payload and clear mono library are downloaded from official South Korean web sites that have been compromised for this objective – a typical TTP of ScarCruft.

In keeping with our telemetry, the RokRAT backdoor was subsequently used to obtain and set up the BirdCall backdoor on the victimized machines.

Android BirdCall evaluation

On this part, we offer a technical evaluation of the Android BirdCall backdoor – an Android port of the eponymous Home windows backdoor written in C++. Internally, the backdoor is called zhuagou, which may be translated (from Chinese language) as “catching canines”.

Trojanized Android video games

Android BirdCall is distributed by way of trojanized Android video games. Within the assault described on this blogpost, we imagine that ScarCruft didn’t achieve entry to the sport’s supply code, solely to the sqgame web site or net server, and as a substitute took the unique recreation APKs and recompiled or repackaged them with malicious code added.

Within the trojanized APKs, the AndroidManifest.xml entry level exercise is modified and factors to the added malicious code – which, after beginning the backdoor, executes the unique entry exercise of the sport.

Within the analyzed samples, the modified entry level exercise was both com.instance.zhuagou.SplashScreen or com.mob.util.MobSs (within the newest pattern). The modifications to AndroidManifest.xml additionally embrace new exercise and repair definitions for the backdoor, in addition to further permissions required for its operation. A comparability of packages within the authentic recreation and its trojanized model is proven in Determine 3.

For the reason that Android BirdCall backdoor is part of a trojanized Android app put in on the system, it doesn’t robotically begin after set up or a tool reboot; as a substitute, it depends on consumer execution.

Configuration

Android BirdCall accommodates a default configuration, which is initialized on the primary run. The configuration makes use of JSON format and is continued in a file. Subsequent runs load the present configuration file, and the configuration may be modified by way of backdoor instructions. An instance of a formatted configuration is proven in Determine 4.

{
    "bi": "E823D451D636D0A0",
    "skey": "A8FE823D451D636D0A0366C0629EF5C3##@(()(#@",
    "si": "20251105141404",
    "rft": 20000,
    "fst": true,
    "kill": false,
    "log": true,
    "ctm": 10000,
    "scr": false,
    "rec": false,
    "cmd": 0,
    "knowledge": 1,
    "bd_version": 37,
    "extentions": ".jpg;.doc;.docx;.xls;.xlsx;.ppt;.pptx;.txt;.hwp;.pdf;.m4a;.p12;",
    "cloud": [
        {
            "ct": 9,
            "idx": 28,
            "cid": "1000.2IGB56IS1FHQ1V332R[redacted]",
            "cst": "fa7ec5c8b050[redacted]",
            "rt": "1000.a7fc479e[redacted]",
            "at": "empty",
            "fid": "8mwe5bbc0a2759839401f813968808a2f36a6",
            "dm": "",
            "use": 0
        },
        [redacted]
    ]
}