ScarCruft compromised a Yanbian-focused gaming platform in a supply-chain attack aimed at ethnic Koreans in China's Yanbian region, an area linked to North Korean refugees and defectors. The Windows client was affected through a malicious update that led to RokRAT and then the more capable BirdCall backdoor. Android games on the same platform were trojanized with an Android port of BirdCall, which ESET describes as a newly public ScarCruft tool. The campaign's espionage capabilities included collecting personal data, documents, contacts, SMS messages, call logs, media files, and private keys, as well as screenshots and audio recordings.