North Korean hackers targeted ethnic Koreans in China with Android ‘BirdCall’ malware

North Korean state-sponsored hackers, attributed to APT37, have been targeting ethnic Koreans in China with a sophisticated Android malware campaign. The attackers utilized a backdoor embedded in a suite of card games developed by Sqgame, allowing them to gain unauthorized access to compromised devices. This campaign highlights the shifting threat landscape, where state-aligned activity in China is increasingly driven by geopolitical motivations rather than financial gain. The use of socially engineered malware, such as the "BirdCall" Android trojan, demonstrates the attackers' ability to adapt and evade detection. The attribution of this campaign to APT37 suggests a high level of sophistication and resources¹. This development matters to cybersecurity practitioners, as it underscores the need for a distinct threat model that accounts for the unique characteristics of state-sponsored attacks, rather than relying on traditional approaches focused on criminal activity.