BirdCall

Reported Context (4)

By trojanizing Windows update files and Android game packages, the group deployed the BirdCall backdoor to exfiltrate personal documents and record audio from victim devices. Taiwan Arrests Student Accused of Rail Network Hacking; PamDOORa Linux Backdoor Emerges
A North Korean threat actor, APT37, delivered a backdoor called BirdCall embedded in popular Android card games from Sqgame to target ethnic Koreans in the Yanbian region, enabling screenshots, call recording, and broad ESET Links Android BirdCall Campaign to APT37, Targeting Koreans in China
ScarCruft (APT37) conducted a multiplatform supplyâchain attack against a Yanbian-themed gaming platform, trojanizing Windows update components and Android game APKs to deliver the BirdCall backdoor for espionage. ScarCruft Used Trojanized Gaming Updates and Android Apps to Deliver BirdCall
APT37 (aka ScarCruft/Ricochet Chollima) delivered an Android variant of the BirdCall backdoor through trojanized APKs on the sqgame[.]net game platform. APT37 Uses Trojanized Android Games to Deliver BirdCall Spyware

Malware (3)

People (3)

Threat Actors (8)

MITRE ATT&CK (17)

Vendors (4)

Products (9)

Tools (2)

Industries (1)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.