[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvbv7XoT_oqAQQh1B4Hps7ZiACBoT0HLeqz2pr3inV_4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":20,"created_at":21,"published_at":22,"article":23,"tags":27,"podcasts":40,"controls":47},"fc3f83fc-e3c4-4c63-b376-57905cf37b1c","apt37-exploits-social-media-trust-to-deploy-rokrat-malware","b58e5297-83ea-4608-87ae-c441f3fde0f5","APT37 Exploits Social Media Trust to Deploy RokRAT Malware","North Korea's APT37 successfully weaponized social engineering by using Facebook to establish trust with targets before transitioning to Telegram to deliver malicious software. The attackers compromised a legitimate PDF viewer installer (Wondershare PDFelement) to deploy RokRAT malware that uses cloud services like Zoho WorkDrive for command-and-control, making detection more difficult. This attack demonstrates how sophisticated threat actors combine social manipulation with supply chain compromise to bypass traditional security controls. Organizations must recognize that human trust remains a critical vulnerability that can be exploited to deliver advanced persistent threats.","**Employee training:**\n- Implement regular security awareness training focused on social engineering tactics across social media platforms\n- Establish clear policies for accepting friend requests and sharing information with unknown contacts on social platforms\n- Train employees to verify contact authenticity through alternative communication channels before engaging\n\n**Software security controls:**\n- Deploy application allowlisting to prevent execution of unauthorized software installers\n- Implement endpoint detection and response (EDR) solutions that monitor for suspicious process behaviors\n- Block or monitor file downloads from personal messaging applications on corporate devices\n\n**Supply chain protection:**\n- Verify software integrity using digital signatures and checksums before installation\n- Download software only from official vendor websites or trusted repositories\n- Implement network monitoring to detect unusual cloud service communications that may indicate C2 activity",[12,13,14,15,16,17,18],"CIS Control 14","CIS Control 2","CIS Control 13","NIST AT-2","NIST AT-3","NIST SA-12","NIST SI-3",{},"published","2026-04-13T12:09:22.111594+00:00","2026-04-13T12:09:21.964+00:00",{"id":7,"url":24,"slug":25,"title":26},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fnorth-koreas-apt37-uses-facebook-social.html","north-korea-s-apt37-uses-facebook-social-engineering-to-deliver-rokrat-malware-e1221a","North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware",[28,34],{"id":29,"name":30,"slug":31,"description":32,"color":33},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":35,"name":36,"slug":37,"description":38,"color":39},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[41],{"id":42,"date":43,"edition":44,"title":45,"audio_url":46},"84165361-5d5a-416a-b968-58cfce24c62b","2026-04-13","afternoon","ThreatNoir Afternoon Brief — April 13","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-13\u002Fthreatnoir-afternoon-brief-2026-04-13.mp3",[48,52,56],{"slug":49,"name":50,"problem":51},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":53,"name":54,"problem":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":57,"name":58,"problem":59},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]