North Korean Hackers Infect Mobile Games to Spy on Defectors in China

A North Korean hacking group has targeted ethnic Koreans in China’s Yanbian region using infected mobile games. The group, known as APT37, hid malware called BirdCall inside popular Android apps from Sqgame. This area, often called 'Third Korea,' is home to many North Korean defectors and refugees.

APT37 has been active since 2012 and is believed to operate under North Korea’s Ministry of State Security. The group specialises in espionage, focusing on South Korea, other Asian nations, and North Korean defectors. Their targets often include government, military, and refugee communities.

The attack began when users downloaded a harmless file from the Sqgame website. Later, a compromised update package turned the app malicious. BirdCall, initially found on Windows devices in 2021 by South Korean cybersecurity firm AhnLab, was later adapted for Android. Once installed, BirdCall gives APT37 full access to infected devices. It can steal contact lists, SMS messages, call logs, and media files. The malware also collects private keys, takes screenshots, and records phone calls.

The Yanbian region’s large population of North Korean defectors made it a prime target for this operation. APT37’s use of gaming apps to spread BirdCall highlights their evolving tactics. Infected devices now risk exposing sensitive personal and organisational data to the hacking group.