[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc41XIbPq4kR1A6wfvgU5oSFP4HmptqELoLfAUInblLU":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b58e5297-83ea-4608-87ae-c441f3fde0f5","North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware","north-korea-s-apt37-uses-facebook-social-engineering-to-deliver-rokrat-malware-e1221a","The North Korean hacking group tracked as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan called RokRAT. \"The threat actor used two Facebook","North Korean threat group APT37 (ScarCruft) conducted a multi-stage social engineering campaign using Facebook friend requests to build trust with targets, then moved conversations to Telegram to deliver a trojanized Wondershare PDFelement installer. The tampered PDF viewer executes shellcode that downloads RokRAT, a remote access trojan that abuses Zoho WorkDrive for command-and-control and can capture screenshots, execute commands, and evade security software.","APT37 runs Facebook social engineering campaign to deliver RokRAT malware.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fnorth-koreas-apt37-uses-facebook-social.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhm-HTAVB66ntSv8R4Bgh9szlrPPh6ah0eJGTDheDntj2w9bW9XzWcgs2CAGsN_C8DS7T4M7V8q18_DtgMZu3mJONEewq_oWlpefdtwp6BgudRjw2Z68jXoP8tHCdxSyvZ-xvVuPlh-xpxEeIRHk1v2mq5KqZxS1z316ncG5j2Q9HQe_bJhIJE4XWONvyYL\u002Fs1600\u002Ftelegram.jpg","2026-04-13T09:15:00+00:00","2026-04-13T12:00:04.601004+00:00",9,[17,20,22,25,28],{"name":18,"type":19},"APT37","threat_actor",{"name":21,"type":19},"ScarCruft",{"name":23,"type":24},"Ruby Jumper","campaign",{"name":26,"type":27},"Wondershare PDFelement","product",{"name":29,"type":27},"Zoho WorkDrive","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"domain","japanroom[.]com","C2 server used by APT37 to deliver second-stage payload",{"type":40,"value":52,"context":53},"RokRAT","Remote access trojan deployed by APT37 via trojanized PDFelement; abuses Zoho WorkDrive for C2",[26,29],{"controls":56,"vendors":138},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":87,"name":88,"problem":89,"products":90},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,127,133],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":124,"url":125,"description":126},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":134,"product_name":135,"url":136,"description":137},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"apt37-exploits-social-media-trust-to-deploy-rokrat-malware","APT37 Exploits Social Media Trust to Deploy RokRAT Malware","North Korea's APT37 successfully weaponized social engineering by using Facebook to establish trust with targets before transitioning to Telegram to deliver malicious software. The attackers compromised a legitimate PDF viewer installer (Wondershare PDFelement) to deploy RokRAT malware that uses cloud services like Zoho WorkDrive for command-and-control, making detection more difficult. This attack demonstrates how sophisticated threat actors combine social manipulation with supply chain compromise to bypass traditional security controls. Organizations must recognize that human trust remains a critical vulnerability that can be exploited to deliver advanced persistent threats.",[144,145,146,147,148,149,150],"CIS Control 14","CIS Control 2","CIS Control 13","NIST AT-2","NIST AT-3","NIST SA-12","NIST SI-3",{}]