North Korean APT37 Targets Ethnic Koreans in China with BirdCall Malware

North Korean state-sponsored threat group APT37 (aka ScarCruft or Reaper) is actively targeting ethnic Koreans residing in China. The campaign leverages Android malware dubbed ‘BirdCall’, according to The Record by Recorded Future. This isn’t just about data exfiltration; it’s about specific intelligence collection on a diaspora group, indicating a clear, focused objective.

The attack vector involves a backdoor embedded within a suite of card games developed by a company named Sqgame. This is a classic supply chain compromise, even if it’s via a seemingly innocuous app. Attackers understand that people drop their guard with entertainment software, making it an effective vector for initial access and persistent surveillance.

For defenders, this underscores the need for stringent mobile device security, especially for high-risk individuals or those operating in sensitive regions. The attacker’s calculus here is low-and-slow, relying on social engineering and trust in legitimate-looking applications. Don’t just scan; validate the integrity of all installed applications, even those for leisure.