Android Malware Spotted on Popular Game Platform via ScarCruft Hackers

Post Views: 1

Android Variant of BirdCall Malware Discovered

The North Korean hacker group APT37 has been delivering an Android version of a backdoor called BirdCall in a supply-chain attack through a video game platform.

This marks the first public documentation of the Android variant of BirdCall, a malware family associated with APT37 since 2021.
The Windows version of BirdCall can record keystrokes, capture screenshots, and exfiltrate files.

According to researchers at ESET, the threat actor created BirdCall for Android around October 2024 and developed at least seven versions.

The attacks were delivered through sqgame[.]net, a Chinese site hosting games for Android, iOS, and Windows platforms. However, only Android and Windows were targeted by the ScarCruft attacks.

The particular platform caters to Koreans in the autonomous Yanbian region in China, which serves as a crossing point for North Korean defectors and refugees. The compromised platform hosted games that allowed users to unknowingly download the malicious software.

Capabilities of the Android Version

Extracts IP geolocation information
Collects contact lists, call logs, and SMS messages
Gathers device information such as operating system, kernel, rooted status, IMEI number, MAC address, IP address, and network details
Sends information about battery temperature, RAM, and storage, cloud configuration, backdoor version, and file extensions of interest to the C2 server

The Android variant of BirdCall periodically captures screenshots, records audio via the microphone from 7 pm to 10 pm local time, and plays a silent MP3 in a loop to prevent the suspension of its process. It also exfiltrates files from a specified directory.

Differences from the Windows Version

Lacks shell command execution capability
No traffic proxying capability
No targeting data from browsers and messenger apps

Users are advised to exercise caution when downloading games from untrusted sources, especially those related to gaming platforms catering to specific regions or demographics.