ScarCruft Compromises a Yanbian Gaming Platform — A Wholesale Supply-Chain Takeover

APT37's sqgame[.]net intrusion — Cross-platform Windows·Android trojanization, espionage operation against ethnic Koreans and North Korean defectors in Yanbian
New BirdCall(zhuagou) Android variant · Zoho WorkDrive C&C · Simultaneous targeting of Korean digital certificates (.p12) and Hancom documents (.hwp) · China→DPRK tool genealogy

Document Information

Table of Contents

1. Summary
2. Incident Overview
3. Incident Timeline
4. Attack-Chain Technical Analysis
5. ScarCruft / APT37 Threat-Actor Profile
6. BirdCall — Analysis of the New Android Variant
7. Korea-Specific Threat — Simultaneous .p12 and .hwp Targeting
8. Indicators of Compromise (IoCs)
9. MITRE ATT&CK Mapping
10. Response Recommendations
11. Strategic Implications
12. References
13. Appendix A. Glossary

1. Summary

On 5 May 2026, the Slovak security vendor ESET disclosed a multi-platform supply-chain attack by the DPRK-aligned APT group ScarCruft (APT37). The target was sqgame[.]net, a gaming platform serving the Yanbian (延边) Korean Autonomous Prefecture community in China; both the Windows desktop client update package and the Android game APKs distributed via this platform were trojanized.

The campaign has been active since at least late 2024 — over 18 months — and ESET confirms that some malicious APKs remain published on the official sqgame website at the time of writing. ESET notified sqgame in December 2025 but has not received a response.

Three issues make this incident decisive.

First, ScarCruft has weaponized a new Android port (zhuagou) of the BirdCall backdoor, which it had previously confined to Windows. ESET identified seven distinct versions, from v1.0 (compiled around October 2024) through v2.0 (around June 2025) — evidence not of a one-off tool but of an actively developed and operated mobile espionage platform.

Second, the file-extension targeting list explicitly includes Korean public/financial certificate format .p12 and Hancom Office document format .hwp. This goes beyond intelligence collection: it implies a precision operation aimed at direct access to victims' Korean financial accounts and government services.

Third, the backdoor's internal codename zhuagou (抓狗) is not the literal Chinese phrase ("catching dogs") but rather established jargon in Chinese hacker, cracking, and game-cheat communities, used since around 2012 as a standard label for information-collection, credential-theft, and user-tracking modules. This strongly suggests the tool's lineage originated in Chinese hacker communities and was acquired and upgraded by the DPRK's ScarCruft (detail in §6.1).

⚠ A grim implication: Yanbian is the principal first transit region for North Korean defectors. This operation can effectively serve to identify the names, locations, and contact networks of defectors, their facilitators, and human-rights activists — a threat that should be classified not merely as cybersecurity but as physical-safety risk.

Key Judgments

2. Incident Overview

2.1 Targeted Platform Profile

2.2 Attack-Chain Summary

2.3 Victimology

ESET's analysis prioritizes targets as follows:

1. Yanbian-resident ethnic Koreans — sqgame is a platform tailored to traditional Yanbian games, making this primary target group self-evident.
2. North Korean defectors and facilitators (brokers, NGO staff, religious activists) — Yanbian is the main first-transit zone for defectors and a top tracking priority for the DPRK regime.
3. Korea-resident ethnic-Korean families — identified as secondary targets via contacts, SMS, and call records collected on victim devices.
4. Holders of Korean government and financial assets — a separate target group implied by the .p12 and .hwp targeting.

3. Incident Timeline

📌 What the June 2024 → October–November 2024 gap implies: a roughly four-to-five-month preparation window separates infrastructure migration from the start of trojanization. ScarCruft did not weaponize sqgame immediately upon compromise; rather, it conducted substantial reconnaissance and tool adaptation (notably the new Android port) — characteristic of a precision operation.

4. Attack-Chain Technical Analysis

4.1 Windows Chain — Four-Stage Multi-Loader

🔑 TTP of note — self-cleanup: After completing its work, the downloader automatically replaces the trojanized mono.dll with a clean copy, completely erasing infection traces from post-compromise static analysis. This is an OPSEC pattern engineered for ScarCruft's long-dwell operations.

4.2 Android Chain — Repackaging Model

ScarCruft is assessed not to have obtained sqgame's source code. Instead, it used decompilation, repackaging, and re-signing of already-built legitimate APKs.

4.3 C&C Infrastructure — Abuse of Legitimate Cloud Services

ScarCruft's signature TTP — C&C built on legitimate cloud services — persists in this campaign. Android BirdCall supports three cloud providers in code, but operationally uses only Zoho WorkDrive.

The 12 identified Zoho accounts all use English-name disguise patterns (tomasalfred37@, kalimaxim279@, smithbentley0617@, etc.), assessed as a tactic to avoid the immediate suspicion that Korean or Chinese names would draw from analysts.

4.4 Compromised Korean Web Infrastructure

ScarCruft compromised the following Korean infrastructure to host shellcode, BirdCall configuration images (encoded in JPG overlays), and a clean mono library:

📍 Domestic implication for Korea: Six Korean domains being recruited as hosting resources in a single campaign confirms that the security hygiene of Korean SMB web-hosting environments has become a preferred operational asset for DPRK APTs. KISA and the Ministry of Science and ICT should reassess the effectiveness of their SMB-security inspection programs.

5. ScarCruft / APT37 Threat-Actor Profile

5.1 Group Overview

5.2 BirdCall — ScarCruft's Signature Backdoor

BirdCall is a Windows C++ backdoor that ESET attributed to ScarCruft via private intelligence reporting in 2021. South Korean vendors S2W and AhnLab publicly described it in the same period as a "Matryoshka variant of RokRAT". BirdCall thus represents an upper tier of sophistication within ScarCruft's core RokRAT-family backdoor lineage.

5.3 Distinction from Lazarus

ScarCruft is often confused with Lazarus, but the differences are clear:

The sqgame operation aligns precisely with the ScarCruft pattern.

6. BirdCall — Analysis of the New Android Variant

6.1 Internal Codename zhuagou (抓狗) — Not Mere Naming, but a Lineage Clue

The internal codename of the Android BirdCall, as identified in the ESET report, is the Chinese zhuagou (抓狗). ESET's text glosses this literally as "catching dogs." This analysis argues that the term goes beyond literal Chinese: it is established jargon in the Chinese hacker community.

6.1.1 What zhuagou (抓狗) Means in the Chinese Hacker Community

In Chinese cracking, malware, and game-cheat communities, "抓狗" has been used since approximately 2012 as a standard module-name designation for:

• Account/credential harvesting — usernames, passwords, session tokens, certificate files
• User tracking — location, behavior, login times, contact-graph mapping
• Log harvesting — keystrokes, messages, call logs, etc.
• Detection and hooking — hooking target processes for data extraction
• Target acquisition — identifying, isolating, and gaining control of victims

In short, "抓狗" is not the literal "catching dogs" a casual Chinese speaker would parse, but a standard naming convention for information-collection / tracking / credential-theft modules used in the Chinese hacker scene for nearly 14 years. It is a long-established jargon term widely seen across game cheats, trojans, and banking malware.

6.1.2 What It Means That This Tool Is Named zhuagou

ScarCruft's choice of zhuagou for its Android backdoor is not a matter of naming taste. It encodes three concurrent layers of meaning:

📍 Original contribution of this analysis: ESET's report treats zhuagou as a literal translation ("catching dogs"). From the perspective of this archive, which has tracked Korean and Chinese hacker-scene activity, the naming is a decisive lineage clue. We assess that ScarCruft incorporated an existing Chinese-scene zhuagou-class module, upgraded it, and folded it into its own operations.

6.1.3 Circumstantial Evidence for China → DPRK Tool Acquisition

Circumstantial evidence supporting hypothesis KJ-7:

• A publicly available Windows BirdCall dump (SHA-1: B06110E0FEB7592872E380B7E3B8F77D80DD1108) was uploaded to VirusTotal from China on 15 July 2024. This sample closely resembles the BirdCall in this campaign, suggesting collection by a Chinese security researcher or analyst.
• The Android port's package name retains com.example.zhuagou.SplashScreen, which violates standard package-naming conventions (reverse-DNS domains). com.example is the default sample namespace from Android development tutorials and reads as a marker of a quickly repackaged existing codebase.
• ScarCruft's history of tool acquisition: the group has previously absorbed and reworked external tools, notably RokRAT (first analyzed by Cisco Talos in 2017). The acquisition of the zhuagou lineage continues this pattern.
• A broader China → DPRK cyber-tool transfer pattern: multiple security vendors have reported flows of Chinese-scene game-cheat and banking-trojan tools into DPRK, Iranian, and Russian APT operations. The zhuagou case is interpretable as one instance of this flow.

⚠ Confidence caveat: This analysis is lexical and circumstantial inference rather than a definitive attribution backed by primary technical evidence such as code-equivalence comparisons. Confidence is rated "Medium-High" (KJ-7). A stronger claim would require comparison between the decompiled output of zhuagou-class Chinese-scene tools and the BirdCall Android implementation.

6.2 Version History

Seven versions were deployed over roughly eight months — an average refresh interval of 5–6 weeks. This indicates not a one-off tool but an active operational platform showing patterns of evasion aligned with the OS-update cycle and antivirus detection/update cycles. The cadence is notably similar to Android's security-patch cycle, suggesting continuous updates targeted at evading Android security improvements.

6.3 Core Capabilities

🔍 Operational meaning of the 19:00–22:00 audio window: Restricting audio collection to the evening hours — when targets are most likely to be with family or in private gatherings — is not mere automation but a HUMINT-augmenting design intended to map the target's family and associates. This reaffirms the operation's espionage character.

6.4 Background Persistence — The Silent-MP3 Trick

A noteworthy technique observed in some versions: looping playback of a silent MP3 file in the background to evade the OS's background-process termination policies. This design ensures stable audio capture when recording is enabled and represents a relatively new TTP for sustaining background espionage in mobile environments.

6.5 Commands — A Subset of the Windows Set

Android BirdCall implements a subset of the Windows command set. Commands not implemented on Android include shell execution (MP_ACTION_SHELL), HTTP port scanning (MP_ACTION_WEBSCAN), word-processor macro enablement (MP_ACTIONS_MORE), and browser credential theft. However, all core espionage capabilities are ported.

7. Korea-Specific Threat — Simultaneous .p12 and .hwp Targeting

7.1 .p12 — Korean Public/Financial Certificates

The PKCS#12 container format .p12 is a global standard, but carries a particularly distinctive meaning in Korea.

If a victim's .p12 is exfiltrated and the corresponding password is captured via keylogging, screen capture, or SMS one-time-code interception, the attacker reaches a state of direct authenticated login to the victim's Korean bank, brokerage, and government-service accounts. Given that many Yanbian ethnic Koreans hold Korean certificates for cross-border travel, remittances, and pension reception, this is a decisive asset.

7.2 .hwp — Hancom Office Documents

.hwp is the standard format of Hancom Office and the de facto standard document format of the Korean government, public agencies, and many Korean enterprises. ScarCruft has a documented history of .hwp exploitation (e.g., EPS-handling flaws).

7.3 The Combined Significance of Targeting Both Extensions

The simultaneous appearance of .p12 and .hwp on the same backdoor's targeted-extension list is not coincidence. The pairing addresses two operational axes at once:

📍 Original judgment of this report: ESET's text simply lists the targeted extensions. From the Korean security community's perspective, the combination of these two extensions should be reinterpreted not as an incidental side-effect of espionage but as a core pillar of the operation's design. This report flags this interpretation as the most important Korea-side implication of the incident.

7.4 .m4a — Additional Significance of Voice Recordings

The inclusion of .m4a deserves attention. It is not merely a generic music format but the default format produced by the native voice-recording apps on iPhone and some Android devices. By targeting voice files the victim has already recorded — meeting notes, phone-call recordings, voice memos — the attacker complements the backdoor's own time-restricted (19:00–22:00) microphone capture by harvesting pre-existing audio assets the victim themselves created.

8. Indicators of Compromise (IoCs)

8.1 File Hashes (SHA-1)

8.2 Network IoCs

Primary compromise infrastructure (sqgame)

• sqgame.com[.]cn / xiazai.sqgame.com[.]cn — 39.106.249[.]68 (Alibaba Hangzhou)
• sqgame[.]net — compromised primary domain

Compromised Korean hosting (payload/configuration staging)

• 1980food.co[.]kr — 211.239.117[.]117 — Android BirdCall configuration image
• inodea[.]com — 114.108.128[.]157 — Android BirdCall configuration image
• www.lawwell.co[.]kr — 221.143.43[.]214 — shellcode + clean mono library
• colorncopy.co[.]kr / swr.co[.]kr — 222.231.2[.]20 — shellcode
• sejonghaeun[.]com — 222.231.2[.]23 — clean mono library
• cndsoft.co[.]kr — 222.231.2[.]41 — shellcode

Zoho WorkDrive accounts (12 identified — Android BirdCall C&C)

• tomasalfred37@zohomail[.]com
• kalimaxim279@zohomail[.]com
• smithbentley0617@zohomail[.]com
• michaellarrow19@zohomail[.]com
• amandakurth94@zohomail[.]com
• rexmedina89@zohomail[.]com
• alishaross751@zohomail[.]com
• jamesdeeds385@zohomail[.]com
• joyceluke505@zohomail[.]com
• marjoriemiller280@zohomail[.]com
• teresadaniels200@zohomail[.]com
• michaelgiesen62@zohomail[.]com

Other

• ipinfo[.]io/json — location lookup (legitimate service; blocking impacts normal use)

8.3 Behavioral-Detection Hints

• Regular calls from Korean IPs to the Zoho WorkDrive API within a single time window (typically 19:00–22:00)
• Presence of com.example.zhuagou.* or com.mob.util.MobSs package trees on Android devices
• Application behavior that simultaneously searches external storage for .p12 and .hwp files
• Traces of mono.dll being modified and then restored to its clean version within minutes

9. MITRE ATT&CK Mapping

9.1 Enterprise (Windows Chain)

9.2 Mobile (Android Chain)

10. Response Recommendations

10.1 P0 — Immediate (within 24 hours)

10.2 P1 — Short-term (within 7 days)

10.3 P2 — Structural (within 30 days)

11. Strategic Implications

11.1 What Distinguishes This Operation from Prior ScarCruft Campaigns

11.2 Humanitarian Perspective

The most concerning aspect of this operation is not data theft. The contacts, SMS, call logs, location, and audio recordings collected from Yanbian-resident ethnic Koreans' and defectors' devices are directly usable by the DPRK regime to identify the target's family, associates, and concealment routes.

Historical patterns show that DPRK defector tracking proceeds digital reconnaissance → in-country tracking via human assets → family hostage-taking and forced repatriation. Material collected by this BirdCall campaign is sufficient to seed the first stage of that chain.

11.3 National-Security Implications

This incident implies the following:

1. "Koreans outside Korea" must fall within the responsibility scope of South Korean cybersecurity. The Korean diaspora across Yanbian, Central Asia, and Japan are direct DPRK-APT targets, and cybersecurity support for them should be elevated to a digital-dimension agenda within foreign and unification policy.

2. The era of mobile-espionage platforms has fully arrived. Android BirdCall is ScarCruft's first dedicated mobile backdoor. Comparable patterns are likely to spread to other DPRK groups such as Lazarus and Kimsuky.

3. Legitimate-cloud C&C is now standard practice. The use of Zoho WorkDrive, pCloud, Yandex Disk, and similar legitimate SaaS for C&C is no longer novel — it is a standard operational pattern. Block-only responses have clear limits; the shift toward behavior-based detection is overdue.

4. SMB-hosting security in Korea. Six Korean domains were drafted as compromised hosts in this single campaign. The effectiveness and reach of KISA's SMB-security inspection programs warrants reassessment.

5. The importance of tracking tool acquisition and lineage. As the zhuagou case suggests, DPRK APTs do not create tools ex nihilo; they repeatedly acquire and rework existing Chinese- and Russian-scene hacker tools. Korean CTI analysis must develop the capacity to track tool genealogy beyond the IoCs of any single campaign — a multilayered analytical practice combining lexical analysis, source-code comparison, and operator-OPSEC patterns.

📍 Final assessment: The ScarCruft / sqgame operation is a paradigmatic case of a state-aligned APT taking wholesale possession of a diaspora community's infrastructure and converting it into a HUMINT asset. South Korean cybersecurity policy should preemptively prepare for the possibility that this pattern will not remain confined to Yanbian, but extend to the digital infrastructure (community apps, current-affairs media, religious/NGO self-hosting) of Korea-resident ethnic Koreans, Central Asian Koryo-saram, Korean Japanese, and Korean Americans.

12. References

12.1 Primary Sources

1. ESET Research / Filip Jurčacko, "A rigged game: ScarCruft compromises gaming platform in a supply-chain attack", WeLiveSecurity, 2026-05-05. https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/
2. ESET GitHub IoC repository — eset/malware-ioc/tree/master/scarcruft. https://github.com/eset/malware-ioc/tree/master/scarcruft
3. MITRE ATT&CK G0067 — APT37 (ScarCruft). https://attack.mitre.org/groups/G0067/

12.2 ScarCruft Background

1. ESET, "Who's swimming in South Korean waters? Meet ScarCruft's Dolphin", 2022-11-30. https://www.welivesecurity.com/2022/11/30/whos-swimming-south-korean-waters-meet-scarcrufts-dolphin/
2. S2W, "Matryoshka — Variant of RokRAT (APT37/ScarCruft)", 2021. https://medium.com/s2wblog/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48
3. AhnLab Security Emergency Response Center (ASEC), RokRAT analysis report, 2021. https://www.ahnlab.com/ko/contents/content-center/30164

12.3 Comparable Supply-Chain Attacks

1. ESET, "Operation NightScout: Supply-chain attack targets online gaming in Asia", 2021-02-01. https://www.welivesecurity.com/2021/02/01/operation-nightscout-supply-chain-attack-online-gaming-asia/
2. ESET, "Linux malware strengthens links between Lazarus and the 3CX supply-chain attack", 2023-04-20. https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/

12.4 Related Reports in This CTI Archive

1. CTI-2026-0422-MCP — UNC1069 / Sapphire Sleet and DPRK supply-chain poisoning scenarios
2. CTI-2026-0420-VERCEL — comparative supply-chain pattern (ShinyHunters)
3. CTI-2026-0320-CORUNA — mobile and zero-day threat ecosystem

Appendix A. Glossary

— End of Report —

© 2026 Dennis Kim · Cyber Threat Intelligence Division
github.com/gameworkerkim/CYBER-THREAT-INTELLIGENCE-REPORT

This report is an independent English-language analysis based primarily on public material from ESET Research. It does not represent the official position of ESET, sqgame, or any related organization.

TLP:GREEN · CTI-2026-0507-SCARCRUFT · Published: 2026-05-07

"The backdoor's codename was zhuagou. That was not merely a naming choice — it exposed at once the operators' conception of who the targets are and a clue to where the tool itself came from." — CTI-2026-0507