ScarCruft Targets Gaming Platform With Windows, Android Backdoors

Gbhackers •Mayura Kathir • May 5, 2026

A sophisticated multiplatform supply-chain attack orchestrated by the North Korea-aligned APT group ScarCruft, targeting ethnic Koreans in China’s Yanbian region through a compromised gaming platform. The attack, believed to have been ongoing since late 2024, weaponized both Windows and Android components of sqgame[.]net, a video game platform that hosts traditional Yanbian-themed card and board games. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ScarCruft's Supply-Chain Attack Targets Yanbian Gaming Platform with BirdCall Malware ESET researchers reported a supply-chain attack by the North Korean APT group ScarCruft, targeting a gaming platform in the Yanbian region of China. The attack, ongoing since late 2024, involved trojanizing both Windows and Android components of the platform, sqgame[.]net, which hosts traditional Yanbian-themed games. The Android variant of the backdoor, named BirdCall, was developed over several months, with at least seven versions identified from October 2024 to June 2025. The malware is designed to gather intelligence on users, particularly targeting ethnic Koreans and North Korean defectors. The Windows version of BirdCall has been known since 2021 and includes capabilities such as keystroke logging and file exfiltration. The attack's command-and-control traffic was routed through cloud storage services, with ESET notifying the platform of the compromise in December 2025, but no response was received. The malicious APKs remain available for download on the site. 9 sources 76

Extracted Entities

ScarCruft Targets Gaming Platform With Windows, Android Backdoors

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (2)