Back Nknews

North Korean hackers poison Chinese games in apparent bid to spy on refugees

Nknews • May 6, 2026

The espionage-focused group ScarCruft modified Android and Windows games to deploy signature data-stealing malware

Shreyas Reddy May 6, 2026

A North Korean cybercrime group compromised a Chinese gaming platform popular with ethnic Koreans living near the DPRK-China border and used it to plant spyware on the devices of unsuspecting players, according to security researchers.

The attackers, identified by researchers as the espionage-focused group ScarCruft, tampered with Android and Microsoft Windows games hosted on sqgame[.]net, a site that offers traditional card and board games, the Slovak cybersecurity company ESET said in a report released Tuesday.

ESET said the campaign likely began in late 2024 and targeted users in Yanbian, an autonomous Chinese region near the

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware ESET researchers reported a supply-chain attack by the North Korean APT group ScarCruft, targeting a gaming platform in the Yanbian region of China. The attack, ongoing since late 2024, involved trojanizing both Windows and Android components of the platform, sqgame[.]net, which hosts traditional Yanbian-themed games. The Android variant of the backdoor, named BirdCall, was developed over several months, with at least seven versions identified from October 2024 to June 2025. The malware is designed to gather intelligence on users, particularly targeting ethnic Koreans and North Korean defectors. The Windows version of BirdCall has been known since 2021 and includes capabilities such as keystroke logging and file exfiltration. The attack's command-and-control traffic was routed through cloud storage services, with ESET notifying the platform of the compromise in December 2025, but no response was received. The malicious APKs remain available for download on the site. 9 sources 76

Extracted Entities

North Korean hackers poison Chinese games in apparent bid to spy on refugees

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)