✨ The Containment Era is here. →Explore ✨

aviatrix logoAviatrix

Overview

Threat intelligence hub

Command Center

Visualize blast radius & threats

Under Active Attack

Executive Summary

In May 2026, the North Korean state-sponsored hacking group ScarCruft (APT37) executed a supply chain attack by compromising the sqgame[.]net gaming platform, which serves the Yanbian region in China. The attackers trojanized Android game APKs available on the platform, embedding a new variant of their BirdCall backdoor malware. This Android version of BirdCall is capable of extracting geolocation data, collecting contacts, call logs, SMS messages, device information, and exfiltrating files of interest. Additionally, it can take periodic screenshots and record audio during specific time frames. The campaign appears to target ethnic Koreans in the Yanbian region, a known crossing point for North Korean defectors and refugees. (bleepingcomputer.com)

This incident underscores the evolving tactics of state-sponsored threat actors, particularly their expansion into mobile platforms through supply chain compromises. The development of Android-specific malware variants like BirdCall highlights the increasing risk to mobile device users, emphasizing the need for heightened vigilance and robust security measures when downloading applications, especially from third-party sources.

Why This Matters Now

The ScarCruft attack demonstrates a significant shift in cyber-espionage tactics, with state-sponsored actors now targeting mobile platforms through supply chain vulnerabilities. This evolution increases the risk to individual users and organizations, emphasizing the urgency for enhanced security practices and awareness regarding application sources and permissions.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

BirdCall is a backdoor malware associated with the North Korean hacking group ScarCruft (APT37). Initially targeting Windows systems, it has been adapted to infect Android devices, enabling extensive data collection and espionage activities.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the malware's ability to escalate privileges, move laterally, establish command and control channels, and exfiltrate data, thereby reducing the attack's overall impact.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The initial compromise may have been limited by CNSF's embedded security controls, potentially reducing the malware's ability to execute upon installation.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust Segmentation could have restricted the malware's ability to gain elevated permissions, thereby limiting its access to sensitive data and device functionalities.

Lateral Movement

Control: East-West Traffic Security

Mitigation: While the malware did not attempt lateral movement, East-West Traffic Security could have further limited any potential spread within the network.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud Visibility & Control could have limited the malware's ability to establish command-and-control channels, thereby reducing its operational effectiveness.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress Security & Policy Enforcement could have restricted the malware's data exfiltration efforts, thereby limiting the amount of sensitive information transmitted to the attacker's servers.

Impact (Mitigations)

The overall impact of the attack could have been limited by the combined effect of CNSF controls, reducing the scope of data exfiltration and potential espionage activities.

Impact at a Glance

Affected Business Functions

  • User Data Management
  • Application Security
  • Customer Trust
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: N/A

Data Exposure

Personal data of users, including contacts, call logs, SMS messages, and potentially sensitive documents.

Recommended Actions

  • • Implement supply chain security measures to ensure the integrity of software updates and downloads.
  • • Enforce strict application permissions and conduct regular audits to detect unauthorized access.
  • • Utilize network segmentation to limit the spread of malware and protect sensitive data.
  • • Monitor and control outbound traffic to prevent unauthorized data exfiltration.
  • • Educate users on the risks of downloading applications from untrusted sources and the importance of verifying software authenticity.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image