TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

The Record (Recorded Future)

North Korean hackers targeted ethnic Koreans in China with Android ‘BirdCall’ malware

just now · Read original ↗

ATT&CK techniques detected

4 predictions
T1195.002Compromise Software Supply Chain
95%
“files and private keys. the android version of the backdoor was developed over the span of several months and eset says it found seven versions of it. eset researcher filip jurcacko said victims typically downloaded the compromised games through a web browser on their devices and…”
T1195.001Compromise Software Dependencies and Development Tools
46%
“files and private keys. the android version of the backdoor was developed over the span of several months and eset says it found seven versions of it. eset researcher filip jurcacko said victims typically downloaded the compromised games through a web browser on their devices and…”
T1588.001Malware
35%
“north korean hackers targeted ethnic koreans in china with android ‘ birdcall ’ malware north korean hackers targeted ethnic koreans in china with android ‘ birdcall ’ malware ethnic koreans living in the yanbian region of china were targeted by a sophisticated north korean hacki…”
T1588.002Tool
33%
“north korean hackers targeted ethnic koreans in china with android ‘ birdcall ’ malware north korean hackers targeted ethnic koreans in china with android ‘ birdcall ’ malware ethnic koreans living in the yanbian region of china were targeted by a sophisticated north korean hacki…”

Summary

Researchers at cybersecurity firm ESET attributed the campaign to APT37 and said the hackers used a backdoor attached to a suite of card games from a company called Sqgame.