Supply Chain Alert: ScarCruft Uses Gaming Platform for BirdCall Deployment

Has anyone else parsed the latest report on ScarCruft (APT37)? They've reportedly compromised a video game platform in a supply chain espionage attack to push the BirdCall backdoor. What stands out to me is the expansion from purely Windows operations to a cross-platform approach, now hitting both Windows and Android users—specifically targeting ethnic Koreans in China.

Since this is a supply chain attack involving trojanized components, traditional allow-listing might fail if the parent process is a trusted game executable. The group likely leverages DLL side-loading or masquerades updates to deliver the payload.

For immediate triage in a Windows environment, I recommend auditing the game installation directories for unsigned binaries or unexpected child processes. Here’s a quick PowerShell snippet to flag suspicious files in a hypothetical game folder:

$targetPath = "C:\Program Files\GamingClient"
Get-ChildItem -Path $targetPath -Recurse -Include *.dll,*.exe | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
        Write-Host "Unsigned/Invalid Signature: $($_.FullName)" -ForegroundColor Red
    }
}

Given the Android vector, mobile EDR telemetry is going to be crucial here. Are you all seeing an increase in mobile devices being targeted as initial access vectors in your sectors?