cyber.hendryadrian.com
Security News · therecord.media

ESET Links Android BirdCall Campaign to APT37, Targeting Koreans in China

· Original article ↗

Summary

ESET attributed an Android BirdCall campaign to APT37, which hid the backdoor in Sqgame card-game updates distributed outside Google Play. The malware stole device data and recorded audio; researchers found seven versions and said the update package is no longer harmful

Key points

  • ESET attributed the Android BirdCall campaign to APT37 and said it likely targeted refugees or defectors from North Korea in China's Yanbian region.
  • The backdoor was embedded in card games from Sqgame and could capture screenshots, record calls and audio, and collect contacts, texts, call logs, media, and private keys.
  • Victims typically downloaded and installed the games through a browser rather than Google Play.
  • The initial download was benign; a later update package from Sqgame's compromised platform delivered the malware.
  • ESET found seven Android versions of BirdCall and said the update package had been compromised since at least November 2024.
  • Researchers said the update package is no longer malicious; ESET said it could not determine when the site was first compromised.

Article Details

Event Type
Android supply-chain malware campaign using a compromised game update package
Impact
ESET attributed the campaign to APT37 and reported that BirdCall was embedded in Android card games distributed by Sqgame, targeting ethnic Koreans in China’s Yanbian region. The backdoor can capture screenshots, record calls and ambient audio, and collect contacts, SMS messages, call logs, media files, and private keys. ESET said the update package had been compromised since at least November 2024 and that it is no longer malicious.

MITRE ATT&CK

T1429The Android BirdCall backdoor can record audio through the microphone and eavesdrop on the device’s surroundings.T1513The Android BirdCall backdoor can capture screenshots.T1533BirdCall collects data from the device, including contacts, SMS messages, call logs, media files, and private keys, and searches shared external storage for specific file types.

People

Filip JurčackoESET researcher who described how victims installed the compromised games and said researchers could not determine when the website was first compromised.

Threat Actors

APT37ESET attributed the BirdCall campaign targeting ethnic Koreans in China’s Yanbian region to APT37. The article says the group is allegedly housed within North Korea’s Ministry of State Security.

Malware

BirdCallA North Korean threat actor, APT37, delivered a backdoor called BirdCall embedded in popular Android card games from Sqgame to target ethnic Koreans in the Yanbian region, enabling screenshots, call recording, and broad

Vendors

Sqgamethreat actor, APT37, delivered a backdoor called BirdCall embedded in popular Android card games from Sqgame to target ethnic Koreans in the Yanbian region, enabling screenshots, call recording, and broad data

Products

AndroidA North Korean threat actor, APT37, delivered a backdoor called BirdCall embedded in popular Android card games from Sqgame to target ethnic Koreans in the Yanbian region, enabling screenshots, call recording, and broad

Countries

ChinaEthnic Koreans living in the Yanbian region of China were targeted by a sophisticated North Korean hacking group with a strain of malware attached to a popular Android mobile game.North KoreaThe Yanbian region of China is on the border with North Korea and is often referred to as “Third Korea.” ESET researchers said the campaign was likely aimed at refugees or defectors from the North Korean regime.

Related Articles