North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware
APT37 runs Facebook social engineering campaign to deliver RokRAT malware.
North Korean threat group APT37 (ScarCruft) conducted a multi-stage social engineering campaign using Facebook friend requests to build trust with targets, then moved conversations to Telegram to deliver a trojanized Wondershare PDFelement installer. The tampered PDF viewer executes shellcode that downloads RokRAT, a remote access trojan that abuses Zoho WorkDrive for command-and-control and can capture screenshots, execute commands, and evade security software.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Wondershare PDFelement?
Get an email when a new story names Wondershare PDFelement, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNorth Korea's APT37 successfully weaponized social engineering by using Facebook to establish trust with targets before transitioning to Telegram to deliver malicious software. The attackers compromised a legitimate PDF viewer installer (Wondershare PDFelement) to deploy RokRAT malware that uses cloud services like Zoho WorkDrive for command-and-control, making detection more difficult. This attack demonstrates how sophisticated threat actors combine social manipulation with supply chain compromise to bypass traditional security controls. Organizations must recognize that human trust remains a critical vulnerability that can be exploited to deliver advanced persistent threats.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — japanroom[.]com
- malware — RokRAT