North Korea-aligned ScarCruft compromised the sqgame.net gaming platform in a supply chain attack, deploying the multi-platform BirdCall backdoor on Windows and Android devices. The malware, an evolution of RokRAT, collects sensitive data like contact lists, SMS, call logs, and media files, primarily targeting ethnic Koreans in China.
Initial Access
Gaming Platform Breach
confirmed
ScarCruft compromised the sqgame.net video game platform, gaining unauthorized access to its infrastructure. This supply chain attack likely began in late 2024.
Defender cut points
Implement robust supply chain security audits and continuous integrity monitoring for web servers and content management systems.Enforce strong access controls and multi-factor authentication for platform administration accounts.
