# A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

ScarCruft trojanized Windows and Android games on the sqgame platform, delivering BirdCall backdoor to spy on Yanbian ethnic Koreans.

- Payout: Real-world hack
- Severity: high
- Program: sqgame
- Analysis by: ESET Research
- Disclosed: 2026-05-05
- Write-up quality: 8/10
- Original: https://www.welivesecurity.com/en/eset-research/rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-rigged-game-scarcruft-compromises-gaming-platform-supply-chain-attack
- Tags: area:mobile domain:desktop domain:mobile impact:data-leak impact:pii-leak kind:incident platform:threat-intel sev:high tech:android tech:windows technique:reverse-engineering vuln:misconfiguration

**Target:** Gaming platform website, Windows desktop client update package, Android APKs
**Root cause:** Attackers compromised the sqgame website or web server and repackaged legitimate game APKs and a mono.dll update library with malicious downloader/backdoor code, modifying AndroidManifest entry points and patching the DLL.
**Steps:**
1. Download trojanized APK from `http://sqgame.com[.]cn/ybht.apk` or `http://sqgame.com[.]cn/sqybhs.apk`; manifest entry point set to `com.example.zhuagou.SplashScreen` or `com.mob.util.MobSs`
2. On Windows, client fetches update `http://xiazai.sqgame.com[.]cn/dating/20240429.zip` containing patched `mono.dll`
3. Downloader checks running processes for analysis tools/VM and aborts if found; else locates sqgame client process and mono library path
4. Downloader fetches and executes shellcode (RokRAT) from compromised South Korean sites, then terminates the client process and replaces trojanized mono.dll with clean version
5. RokRAT downloads and installs BirdCall backdoor; Android backdoor starts original game activity, waits for internet connection, then contacts Zoho WorkDrive C&C
**How found:** ESET spotted a suspicious APK on VirusTotal, traced it to the official sqgame website, found the same APK served there, then identified a second trojanized game and a malicious mono.dll in an update package via telemetry.
**Exploitation:** Supply-chain compromise of sqgame site and update server; victims intentionally downloaded trojanized games or received malicious client updates. Backdoor used cloud storage (Zoho WorkDrive) for C&C, collected contacts, SMS, call logs, files, screenshots, audio, and exfiltrated staged data.
**Escalation:** Windows chain: trojanized mono.dll downloader → RokRAT → BirdCall for deeper espionage capabilities.
**Insight:** Check official vendor download pages and update packages for repackaged APKs/DLLs whose manifest entry points or library hashes differ from the legitimate build; VirusTotal hits can lead back to still-live supply-chain compromises.

## Proof of concept (copied exactly from the original report)

**Trojanized Android game APK download URLs**

```
http://sqgame.com[.]cn/ybht.apk
03E3ECE9F48CF4104AAFC535790CA2FB3C6B26CF
Trojanized game with the BirdCall backdoor.

2025-10
http://sqgame.com[.]cn/sqybhs.apk
```

**Malicious Windows update package URL**

```
http://xiazai.sqgame.com[.]cn/dating/20240429.zip
```

**Android BirdCall default configuration JSON**

```
{
 "bi": "E823D451D636D0A0",
 "skey": "A8FE823D451D636D0A0366C0629EF5C3##@(()(#@",
 "si": "20251105141404",
 "rft": 20000,
 "fst": true,
 "kill": false,
 "log": true,
 "ctm": 10000,
 "scr": false,
 "rec": false,
 "cmd": 0,
 "data": 1,
 "bd_version": 37,
 "extentions": ".jpg;.doc;.docx;.xls;.xlsx;.ppt;.pptx;.txt;.hwp;.pdf;.m4a;.p12;",
 "cloud": [
 {
 "ct": 9,
 "idx": 28,
 "cid": "1000.2IGB56IS1FHQ1V332R[redacted]",
 "cst": "fa7ec5c8b050[redacted]",
 "rt": "1000.a7fc479e[redacted]",
 "at": "empty",
 "fid": "8mwe5bbc0a2759839401f813968808a2f36a6",
 "dm": "",
 "use": 0
 },
 [redacted]
 ]
}
```