Infosecurity
North Korean Hackers Trojanise Korean Gaming Site to Spy on Users
Part of the APT37 story · since 1 Sep 2025
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users. This article, 14th of 19.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
A North Korea-aligned espionage group known as ScarCruft, also referred to as APT37, Reaper and Ricochet Chollima, has compromised a regional gaming platform serving ethnic Koreans in China, according to new analysis from ESET researchers. The operation targeted users of sqgame[.]net, with both Windows and Android software trojanized to deliver a previously undocumented mobile backdoor, while the iOS game on the same site was left untouched.
On Windows, an update package for the desktop client has been seen since at least November 2024, delivering a downloader that fetches shellcode containing the RokRAT backdoor, which then deployed the newer BirdCall implant. The Android variant, internally named zhuagou, ran across seven versions between October 2024 and June 2025, repackaging legitimate game APKs and redirecting entry points through the backdoor to access data such as contacts, call logs, SMS, documents, media and private keys.
C2 traffic used cloud storage providers, with Zoho WorkDrive identified in the campaign and 12 separate Zoho accounts found. ESET noted the activity likely began in late 2024, and sqgame was notified in December 2025 but received no response at publication.
How the story developed
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
19 articles from 7 outlets since 1 Sep. Quiet since 16 Sep. This was the 14th report, 246 days after the first.
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users. This article, 14th of 19.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 19 articles as a listHide the list
- Mon 1 SepDay 02
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics08:45 · The Hacker News · First report
- North Korea’s APT37 deploys RokRAT in new phishing campaign against academics13:00 · Security Affairs
- Tue 2 SepDay 11
Quiet for 7 days
Tue 9 SepDay 81- APT37 Deploys New Rust and Python Malware Targeting Windows Systems07:05 · GBHackers · Picked up again
- Wed 10 SepDay 91
- APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer01:46 · SecurityOnline
Quiet for 9 weeks
Tue 11 NovDay 711- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline · Picked up again
Quiet for 6 weeks
Wed 24 DecDay 1141- “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets01:50 · SecurityOnline · Picked up again
Quiet for 9 weeks
Fri 27 FebDay 1792- ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets13:26 · The Hacker News · Picked up again
- APT37 hits airgapped networks via USB in Ruby Jumper campaign14:28 · Infosecurity
Quiet for 3 days
Mon 2 MarDay 1822- APT37 targets airgapped systems using five tools in Ruby Jumper12:10 · SecurityWeek · Picked up again
- APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C213:42 · Security Affairs
Quiet for 6 weeks
Mon 13 AprDay 2241- North Korea APT37 uses fake Facebook to spread RokRAT via PDF10:32 · The Hacker News · Picked up again
Quiet for 3 weeks
Tue 5 MayDay 2462- ScarCruft deploys Android BirdCall backdoor via sqgame.net10:00 · The Hacker News · Picked up again
- North Korean Hackers Trojanise Korean Gaming Site to Spy on Users15:21 · Infosecurity · This article, 14th of 19
Quiet for 6 weeks
Tue 16 JunDay 2881- North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT08:50 · The Hacker News · Picked up again
Quiet for 3 days
Fri 19 JunDay 2911- APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs08:50 · SecurityOnline · Picked up again
Quiet for 4 weeks
Fri 17 JulDay 3191- North Korean APT37 uses Dropbox phishing to deliver RokRAT malware14:11 · SecurityOnline · Picked up again
Quiet for 8 weeks
Thu 10 SepDay 3741- Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea09:54 · SecurityOnline · Picked up again
Quiet for 6 days
Wed 16 SepDay 3801- North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers01:24 · Dark Reading · Picked up again