New ScarCruft Supply Chain Attack Hits Gaming Platform With Windows and Android Backdoors

Cybersecuritynews •Tushar Subhra Dutta • May 5, 2026

A North Korea-aligned threat group known as ScarCruft has been caught running a supply chain attack against a video gaming platform serving ethnic Koreans in China’s Yanbian region. The attackers planted backdoors in both Windows and Android versions of the platform’s games, turning a trusted service into a covert espionage tool. The campaign has likely […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware ESET researchers reported a supply-chain attack by the North Korean APT group ScarCruft, targeting a gaming platform in the Yanbian region of China. The attack, ongoing since late 2024, involved trojanizing both Windows and Android components of the platform, sqgame[.]net, which hosts traditional Yanbian-themed games. The Android variant of the backdoor, named BirdCall, was developed over several months, with at least seven versions identified from October 2024 to June 2025. The malware is designed to gather intelligence on users, particularly targeting ethnic Koreans and North Korean defectors. The Windows version of BirdCall has been known since 2021 and includes capabilities such as keystroke logging and file exfiltration. The attack's command-and-control traffic was routed through cloud storage services, with ESET notifying the platform of the compromise in December 2025, but no response was received. The malicious APKs remain available for download on the site. 9 sources 76

Extracted Entities

New ScarCruft Supply Chain Attack Hits Gaming Platform With Windows and Android Backdoors

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Platforms (2)