The APT ScarCruft group compromised a video game platform used by ethnic Koreans in China's Yanbian region. The RokRAT backdoor was released via a malicious update of the Windows client, which installed the more advanced BirdCall. Android games have also been infected by Trojans with a variant of BirdCall. The goal is espionage: collection of personal data and documents, screenshots and voice recordings, probably on refugees or displaced persons
ESET researchers have uncovered a cross-platform supply chain attack by North Korea-linked APT ScarCruft that targeted China's Yanbian region – home to ethnic Koreans and a transit point for North Korean refugees and displaced persons. In the attack, likely ongoing since late 2024, ScarCruft compromised the Windows and Android components of a Yanbian-themed video game platform, compromising and trojanizing them with a backdoor. The backdoor, named BirdCall by ESET, was known to only attack Windows systems; the Android version was later detected as part of this supply chain attack.
The Android version of BirdCall, identified in the latest attack, implements a subset of the commands and features of the Microsoft Windows backdoor: it collects contacts, SMS messages, call logs, documents, multimedia files and private keys. It can also take screenshots and record surrounding audio. ESET has discovered, based on this investigation, that the Android version of BirdCall has been developed over the course of several months and that at least seven versions have been released.
Since the website compromised in this attack is dedicated to the Yanbian community and traditional pastimes, ESET believes that the primary targets are ethnic Koreans residing in Yanbian. It is likely that the attack aimed to collect information on people residing (or originating) from the Yanbian region and believed to be of interest to the North Korean regime - most likely refugees or displaced persons.
The gaming platform's Windows client was compromised via a malicious update that led to the RokRAT backdoor, which, in turn, deployed the more sophisticated BirdCall backdoor. "The victims downloaded the Trojan-infected games via a web browser from a single page on their devices and likely installed them intentionally. No other APK locations nor any malicious APKs were identified on the official Google Play Store. We were unable to determine when the website was first compromised and when the supply chain attack began. However, based on our analysis of the distributed malware, we estimate that it occurred in late 2024," says Filip Jurčacko, researcher at ESET, who discovered the latest ScarCruft attack.
The Windows backdoor was initially discovered in 2021 and attributed to ScarCruft as part of the report ESET Threat Intelligence. The original Windows backdoor has a wide range of spying capabilities, including taking screenshots, recording keystrokes and clipboard contents, stealing credentials and files, and executing shell commands. For control and command (C&C) purposes, the backdoor uses legitimate cloud storage services, such as Dropbox or pCloud, or compromised websites.
ScarCruft, also known as APT37 or Reaper, has been active since at least 2012 and is suspected of being a North Korean spy group. It focuses primarily on South Korea, but other Asian countries have also been targeted. ScarCruft appears to be primarily interested in government and military organizations, as well as companies from various sectors linked to North Korea's interests. The group also targets North Korean defectors.
For more details on BirdCall, see ESET Research's latest blog post."A rigged game: ScarCruft compromises a gaming platform in a supply-chain attack,” on WeLiveSecurity.com. Be sure to follow ESET Research on Twitter (now known as X), BlueSky, e Mastodon For the latest news from ESET Research.
