ESET researchers have attributed a supply-chain attack on sqgame, a gaming platform serving ethnic Koreans in China’s Yanbian region, to the North Korea-aligned espionage group ScarCruft. In findings released on May 5, 2026, the company said attackers distributed the BirdCall backdoor through two Android games and an update for the platform’s Windows client.
The investigation uncovered a previously undocumented Android version of BirdCall, which ESET had identified on Windows in 2021. ESET researcher Filip Jurčacko said the campaign was discovered in October 2025. Researchers estimated that the attack began in late 2024, based on their malware analysis, but could not determine when the website was first breached or when the malicious Android downloads became available.
At the time of its disclosure, ESET said the malicious Android packages remained available on the platform, while the Windows update package was no longer malicious. The company said it notified sqgame of the compromise in December 2025 and had received no response.
ESET assessed the campaign as espionage. Based on the platform’s audience, researchers inferred that its primary targets were ethnic Koreans living in Yanbian. They considered it probable that the attackers sought information on people living in or originating from the region who were of interest to the North Korean regime, most likely refugees or defectors.
Yanbian borders North Korea and includes crossing routes used by North Korean refugees and defectors. ESET describes ScarCruft, also known as APT37 or Reaper, as a suspected North Korean espionage group active since at least 2012, with a history of targeting defectors.
Two Android games and a Windows update
ESET’s investigation began with a suspicious Android application package found on VirusTotal. Researchers traced it to a modified version of Yanbian Red Ten, a card game offered through sqgame’s official website. A second Android game, New Drawing, contained the same backdoor. A third Android game was clean when examined.
Researchers found evidence that users downloaded the malicious packages through web browsers on their devices and probably installed them intentionally. ESET said it found no other distribution locations for those packages and no copies on Google Play.
The Windows installer available from the platform appeared clean during ESET’s analysis, and researchers found no malicious code in the iOS game they examined. The Windows attack instead involved an update package containing a modified mono.dll library. ESET’s telemetry showed that the package had been malicious as far back as November 2024, although the duration remained unknown.
ESET found that the modified library contained a downloader that checked running processes for signs of analysis tools and virtualized environments, stopping if it detected them. Otherwise, it downloaded and executed shellcode containing RokRAT. The company’s telemetry showed that RokRAT subsequently downloaded and installed BirdCall on affected Windows computers.
Surveillance capabilities on Windows and Android
ESET’s analysis describes Windows BirdCall as capable of capturing screenshots, logging keystrokes and clipboard contents, stealing credentials and files, and executing shell commands. The company said the backdoor typically uses a multistage loading chain beginning with Ruby or Python scripts, with some components encrypted using a computer-specific key.
The Android version implements a subset of the Windows backdoor’s capabilities. ESET found that it could collect contacts, SMS messages, call logs, documents, media files and private keys, as well as capture screenshots and record surrounding audio.
Researchers identified seven Android versions, ranging from version 1.0, created approximately in October 2024, to version 2.0, created approximately in June 2025. Those dates describe the malware’s development history rather than establishing when the platform was breached.
Cloud services used for command and control
ESET said Windows BirdCall uses legitimate cloud storage services, including Dropbox and pCloud, or compromised websites for command-and-control communications.
The Android samples supported pCloud, Yandex Disk and Zoho WorkDrive, but ESET observed only Zoho WorkDrive in use. Support for the other two services did not establish their use in this campaign.
