TLDR Tech / InfoSec
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack (18 minute read)
North Korea-aligned APT group ScarCruft (APT37) compromised sqgame[.]net, a gaming platform serving ethnic Koreans in China's Yanbian region, trojanizing its Windows update package and two Android card games to deploy the BirdCall backdoor — with the Android port marking a new addition to the group's arsenal. The Windows chain pivots through a sandbox-checking downloader to RokRAT and then BirdCall, while Android BirdCall abuses Zoho WorkDrive over HTTPS for C&C and exfiltrates contacts, SMS, call logs, screenshots, microphone recordings (limited to 7–10 PM local time), and files matching .doc/.docx/.xlsx/.pptx/.hwp/.pdf/.p12 extensions targeting defectors and refugees. Defenders should hunt for sqgame-sourced APKs and the trojanized mono.dll (SHA-1 95BDB94F6767A3CCE6D92363BBF5BC84B786BDB0), block the listed C2 infrastructure, including compromised South Korean domains (1980food.co[.]kr, inodea[.]com, and lawwell.co[.]kr), and flag outbound Zoho WorkDrive API traffic from non-business endpoints.
Read the full story