Website Popular in Korean Ethnic Enclave in China Hosts Apps Laced With a Backdoor
A North Korean hacking group has been spying on a Korean ethnic enclave in China by infiltrating the Android apps of a regional gaming platform that hosts digital card and board games.
See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready?
The Yanbian region of northern China is a crossing point for refugees fleeing the totalitarian Pyongyang government, leading security researchers at Eset to conclude that the hackers are most likely attempting to surveil defectors.
Eset researchers spotted the campaign after digging into a suspicious Android app file on VirusTotal. The APK file contains a backdoor, an Android version of a known backdoor traced to North Korea known as BirdCall.
“Surprisingly, the APK available for download on the official website is the same as the APK we initially found on VirusTotal,” researchers wrote. The website is www.sqgame.net. A second Android app file available on the website for another game also contains BirdCall.
Researchers attributed the supply-chain attack to a threat actor Eset tracks ScarCruft and said the campaign appears to have been active since late 2024. Also known as APT37 or Reaper, the group has been active in Asia and, to a lesser extent, in Europe and the Middle East.
It’s most likely that the hackers didn’t obtain access to the source code of the games on Sqgame, but rather to the web server, allowing them to recompile the original APKs to incorporate the backdoor. The Android version implements a “subset of the commands and capabilities” from the Windows backdoor version but it includes the ability to collect contacts, SMS messages, call logs, documents, media files and private keys. The Android backdoor can additionally “take screenshots and record surrounding audio.”
The malware blends command and control traffic with normal traffic, with the ability to use pCloud, Yandex Disk and Zoho WorkDrive as C2 servers, although the hackers apparently decided to only use Zoho WorkDrive.