Rigged Game: How North Korea’s ScarCruft Group Infiltrated a Gaming Platform to Deploy BirdCall Spyware

The seemingly innocuous download of a mobile game could culminate in a smartphone being compromised by sophisticated spyware. Researchers at ESET have revealed that the ScarCruft group, widely associated with North Korea, infiltrated a gaming platform catering to ethnic Koreans in the Yanbian region of China, embedding the BirdCall backdoor within its infrastructure. The breach targeted the service sqgame[.]net, which hosted various locally themed titles.

The selection of this specific platform appears calculated. For years, ScarCruft has maintained a persistent interest in North Korean defectors, human rights activists, and academic professionals. Furthermore, Yanbian is recognized as a perilous transit point for individuals crossing the Tumen River while fleeing North Korea.

The offensive likely commenced in late 2024. The adversaries compromised platform components for both Android and Windows; however, the malicious APK files were exclusively disseminated through the download pages of several Android-based games. Conversely, the iOS versions remained untainted. On Windows, at least since November 2024, an update to a platform component delivered a subverted DLL library, though this specific package no longer distributes malicious code.

Historically, BirdCall has been predominantly identified on Windows systems. ESET specialists characterize the backdoor as an evolution of RokRAT, an instrument long utilized by ScarCruft in espionage campaigns. In recent years, this malware family has been adapted for macOS and Android, and this latest operation demonstrates that the group is continuously refining its malicious architecture and broadening its target demographic.

On Windows, BirdCall is capable of capturing screenshots, logging keystrokes, exfiltrating clipboard contents, executing arbitrary commands, and harvesting sensitive data from the host. To communicate with its operators, the backdoor leverages legitimate cloud storage providers, including Dropbox and pCloud, effectively obfuscating its malicious traffic.

The Android iteration, while lacking the full feature set of its Windows counterpart, remains a potent tool for surreptitious surveillance. The backdoor aggregates contacts, SMS messages, call logs, media files, documents, and screenshots, and is even capable of recording ambient audio. For command-and-control communication, the mobile variant of BirdCall utilizes the pCloud and Zoho WorkDrive services.

ESET has identified seven distinct versions of the Android backdoor, with the earliest iteration dating back to October 2024. The firm assesses that ScarCruft is actively enhancing this utility, and the campaign is designed not for the mass infection of gamers, but for the targeted monitoring of specific individuals.