Tactics, Techniques & Procedures (TTPs): Specializes in supply chain compromise, mobile malware (BirdCall), and targeting regional dissidents. Known for high-fidelity social engineering and the use of zero-day exploits in localized software.

ScarCruft continues to demonstrate a high degree of adaptability, moving from document-based phishing to complex supply chain attacks. Their recent focus on gaming platforms suggests an intent to embed persistent backdoors in the personal devices of high-value targets, which are then used as bridges into corporate or government networks. The deployment of the BirdCall backdoor across both Android and Windows platforms indicates a mature, cross-platform development capability aimed at total surveillance.