The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCall to likely target ethnic Koreans residing in China.
Moreover, while prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack has now enabled threat actors to also target Android devices, effectively turning it into a multi-platform threat.
Targeting Yanbian’s Strategic Gaming Platform
According to ESET, the campaign has singled out sqgame[.]net, a gaming platform used by ethnic Koreans living in the Yanbian region in China bordering North Korea and Russia. Additionally, the region acts as a primary, high-risk transit point for North Korean defectors crossing the Tumen River.
Therefore, the targeting of this platform reflects a deliberate strategy, given ScarCruft’s established history of targeting North Korean defectors, human rights activists, and university professors.
“In the attack, probably ongoing since late 2024, ScarCruft compromised Windows and Android components of a video game platform dedicated to Yanbian-themed games, trojanizing them with a backdoor,” the Slovakian cybersecurity company said in a report.
Notably, Windows versions of BirdCall, described as an advanced evolution of RokRAT, have appeared in the wild since 2021. Over time, threat actors have adapted RokRAT to target macOS (CloudMensis) and Android (RambleOn), which shows continuous and active malware development.
Furthermore, BirdCall includes typical backdoor features, enabling:
- Screenshot capture
- Keystroke logging
- Clipboard data theft
- Shell command execution
- Sensitive data collection
In addition, like RokRAT, the malware relies on legitimate cloud services such as Dropbox and pCloud for command-and-control (C2) communications.
“BirdCall is usually deployed in a multistage loading chain, starting with a Ruby or Python script, and containing components encrypted using a computer-specific key,” ESET said.
Android Variant Expands Surveillance Scope
Meanwhile, the Android variant of BirdCall, distributed through the sqgame[.]net supply chain attack, incorporates a subset of Windows capabilities while collecting:
- Contact lists
- SMS messages
- Call logs
- Media files
- Documents
- Screenshots
- Ambient audio
An analysis of its lineage has revealed seven versions, with the earliest dating back to October 2024.
Interestingly, attackers have only poisoned the Android APKs available for download, while leaving the Windows desktop client and iOS games intact. Specifically, attackers altered download pages for two Android games hosted on sqgame[.]net to deliver malicious APKs:
- sqgame.com[.]cn/ybht.apk
- sqgame.com[.]cn/sqybhs.apk
At present, researchers have not identified the exact breach date; however, evidence suggests the incident likely occurred in late 2024. Furthermore, an update package for the Windows desktop client delivered a trojanized DLL starting at least in November 2024, although the package no longer remains malicious.
Infection Chain and Execution Mechanism
Specifically, the modified DLL includes a downloader that:
- Checks running processes for analysis tools and virtual machine environments
- Downloads and executes shellcode containing RokRAT
- Installs BirdCall on compromised systems
Similarly, the Android version of BirdCall relies on legitimate cloud storage services for C2 communications, including:
- pCloud
- Yandex Disk
- Zoho WorkDrive
Notably, Zoho WorkDrive has increasingly appeared across multiple campaigns.
“The Android backdoor has seen active development, and provides surveillance capabilities, such as collection of personal data and documents, taking screenshots, and making voice recordings,” ESET said.
Ultimately, the continued evolution of BirdCall highlights an increasingly sophisticated and persistent cyber espionage operation targeting high-risk populations.
Source: TheHackerNews
Read more at Impreza News
