North Korean APT Targets Yanbian Gamers via Trojanized Platform

ESET researchers disclosed a supply-chain attack targeting the Yanbian gaming community in China, attributed to the North Korean APT group ScarCruft (APT37). The attackers compromised a Yanbian gaming site to distribute trojanized versions of legitimate Windows and Android gaming software. The campaign was discovered and publicly disclosed in June 2026; no internal discovery date was provided. The number of affected users or systems was not quantified.

The attack chain began with the compromise of the gaming platform's software distribution mechanism, replacing legitimate installers with trojanized variants. On Windows, the malicious payload delivered a backdoor capable of keylogging, screen capture, microphone and webcam recording, and file exfiltration. On Android, the trojanized app requested extensive permissions to harvest contacts, SMS messages, call logs, and device location. ScarCruft is known for using spear-phishing and watering hole attacks, but this incident marks a shift to supply-chain compromise. Exfiltrated data types include user credentials, system information, keystrokes, screenshots, audio/video recordings, and arbitrary files.

No post-incident developments such as regulatory actions, litigation, ransom payments, or remediation milestones were reported in the article.