Korean-speaking users via sqgame[.]net (China-based game platform)

Date (as written): 2026-05-05
Year: 2026
Country: KR,CN
Actors (as written): APT37 (a.k.a. ScarCruft, Ricochet Chollima)
Actor pages: APT37
Tags (as written): Attack: Malware; Attack Class: Cyber Espionage

Source entries (3)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Korean-speaking users via sqgame[.]net (China-based game platform) · 2026-05-05

Researchers at ESET discover APT37 deploying a new Android variant of BirdCall spyware via trojanized APKs on a gaming platform targeting Korean speakers in China's Yanbian region (North Korean defectors). [Date Occurred: Since October 2024; Date Discovered: Since October 2024]

https://www.hackmageddon.com/2026/05/21/1-15-may-2026-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/scarcruft-hackers-push-birdcall-android-malware-via-game-platform/

ESET WeLiveSecurity

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack · 2026/05/05

ESET researchers have investigated an ongoing attack by the ScarCruft APT group that targets the Yanbian region via backdoor-laced Windows and Android games.

https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/

ESET WeLiveSecurity

ESET APT Activity Report Q4 2025–Q1 2026 (DPRK-related paragraph 3) · 2026/05/28

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q4-2025-q1-2026/

Suggest a correction on GitHub