Loading story…
North Korea-linked ScarCruft (APT37, also known as Reaper) compromised the sqgame[.]net gaming platform used by ethnic Koreans in China’s Yanbian region and used it to distribute the BirdCall backdoor in a supply-chain espionage campaign. ESET said the operation was likely active from late 2024, with the website compromised since at least November 2024, and assessed that the targets were likely North Korean defectors, refugees, and other people of interest to the regime in the Yanbian border area. The attackers appear to have tampered with the platform’s distribution infrastructure rather than stolen game source code, serving benign initial downloads and later malicious updates from the official site rather than Google Play.
The campaign affected both Android and Windows users. Trojanized Android game APKs delivered a newly documented mobile BirdCall variant capable of stealing contacts, SMS messages, call logs, documents, media files, and private keys, while also taking screenshots and recording ambient audio; researchers identified at least seven Android versions. On Windows, a malicious desktop client update used a trojanized mono.dll to fetch RokRAT, which then deployed the Windows BirdCall payload with broader surveillance features such as keystroke logging, clipboard theft, and shell execution. ESET said the malware blended command-and-control traffic into normal HTTPS activity and relied primarily on Zoho WorkDrive for exfiltration, while also using compromised South Korean websites to host payloads and configuration data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET said it notified sqgame about the compromise in December 2025. At the time of publication, the researchers said they had not received a response from the company.
ESET assessed that ScarCruft's espionage campaign against sqgame, a gaming platform serving ethnic Koreans in China's Yanbian region, was likely active since late 2024. The attackers trojanized Android game APKs with BirdCall and also compromised the Windows update chain, likely targeting defectors, refugees, and related communities.
On May 5, 2026, ESET published research attributing a multiplatform supply-chain attack on sqgame to North Korea-aligned ScarCruft/APT37. The disclosure detailed Android BirdCall implants, a malicious Windows update chain, and likely espionage targeting of ethnic Koreans in Yanbian, including defectors and refugees.
ESET reported that the compromised sqgame platform's Windows desktop client update package had been delivering malicious components since at least November 2024. The Windows infection chain used a trojanized update to install RokRAT and then the Windows BirdCall payload.
ESET found at least seven Android BirdCall variants developed over several months, with reporting indicating the Android version was developed around October 2024. This marked an expansion of ScarCruft's tooling into Android surveillance malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
s2w.medium.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcewelivesecurity.com
Open sourcebankinfosecurity.com
Open sourcebsky.app
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that **ScarCruft**—also tracked as **APT37** or **Reaper**—used a previously undocumented Windows backdoor called **Dolphin** in intrusions targeting South Korea, including a 2021 watering-hole attack against a South Korean online newspaper. The malware was delivered as a selective second-stage payload through a multistage loader chain that used a downloaded Python 2.7 interpreter, XOR-encrypted shellcode, process injection, and persistence via **Run** registry keys and a scheduled task. Dolphin used **Google Drive** for command-and-control and data exfiltration and supported file theft from fixed, removable, and portable drives, keylogging, screenshots, shell command and shellcode execution, and browser credential theft. ESET said earlier variants also altered victims’ signed-in Google and Gmail security settings to maintain inbox access through IMAP and less secure app access, while later versions added evasion features such as dynamic API resolution and string obfuscation and temporarily removed credential-stealing functions; the activity was observed from April 2021 through January 2022 and attributed to the North Korea-aligned espionage group’s long-running focus on South Korean and other regional targets.
Jun 29, 2026
Recent reporting highlights multiple **social-engineering-driven malware delivery** efforts that culminate in remote access and persistent compromise. In South Korea, attackers distributed **counterfeit adult games** via popular “webhard” file-sharing services; victims received a ZIP containing a decoy `Game.exe` launcher that stages additional components (`Data1.Pak`, `Data2.Pak`, `Data3.Pak`) and ultimately injects **QuasarRAT** (aka **xRAT**), enabling host profiling, keylogging, and unauthorized file transfer. The execution chain included masqueraded artifacts such as `GoogleUpdate.exe` and `WinUpdate.db`, with AES used to decrypt/extract shellcode prior to privilege escalation and RAT injection. Separately, a spear-phishing campaign weaponized news about a purported **Nicolás Maduro arrest** to deliver a **backdoor**: emails carried a ZIP with a lure executable (`Maduro to be taken to New York.exe`) alongside a malicious DLL (`kuguo.dll`) that abuses a legitimate KuGuo binary for execution. Post-run behavior included replication to `C:\ProgramData\Technology360NB`, persistence via an auto-start renamed binary (`DataTechnology.exe`), and C2 beaconing for tasking and configuration updates; researchers noted tradecraft consistent with **Mustang Panda** but said attribution was not yet confirmed. A separate research note described **GravityRAT** reemerging as a multi-platform RAT with expanded **Android** targeting (in addition to Windows/macOS), emphasizing mobile endpoints as increasingly high-value targets for data theft and persistent access, though it did not describe the same specific campaigns as the Windows-focused lures above.
Jun 29, 2026
The North Korean state-sponsored threat group Kimsuky has launched a sophisticated campaign distributing a new variant of the DocSwap Android malware. Attackers use phishing sites that impersonate legitimate delivery services, particularly Seoul-based CJ Logistics, to lure victims. The campaign leverages QR codes and notification pop-ups to trick users into installing a malicious APK, often named `SecDelivery.apk`, on their mobile devices. Victims are typically targeted through smishing messages or phishing emails containing links to these fake delivery tracking sites. When accessed from a desktop, the site displays a QR code, prompting users to scan it with their Android device, which then initiates the malware download. The malicious app decrypts an embedded encrypted APK and launches a service with remote access trojan (RAT) capabilities, requesting extensive permissions to access files, SMS, phone, and location data. Security researchers have observed that the campaign employs advanced evasion techniques, such as device-type detection and server-side logic to serve different content based on the user's platform. The malware variant features improvements over previous DocSwap versions, including a new native decryption function and enhanced decoy behaviors. The infrastructure supporting the campaign is linked to a command and control server at `27.102.137[.]181`, and the phishing lures are designed to bypass Android's default security warnings by impersonating official apps and security modules. This campaign highlights the evolving tactics of Kimsuky in targeting South Korean users and the growing threat of QR code-based phishing for mobile malware delivery.
Jun 29, 2026