{"id":575,"date":"2026-04-13T11:12:01","date_gmt":"2026-04-13T11:12:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=575"},"modified":"2026-04-13T11:12:01","modified_gmt":"2026-04-13T11:12:01","slug":"north-koreas-apt37-uses-facebook-social-engineering-to-deliver-rokrat-malware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=575","title":{"rendered":"North Korea’s APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 13, 2026<\/span><\/span>Social Engineering \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The North Korean hacking group tracked\u00a0as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat actors approached targets on Facebook and added them as friends on the social media platform, turning the trust-building exercise into a delivery channel for a remote access trojan\u00a0called RokRAT.<\/p>\n

\u00abThe threat actor used two Facebook accounts with their location set to Pyongyang\u00a0and Pyongsong, North Korea, to identify and screen targets,\u00bb the Genians Security Center\u00a0(GSC) said<\/a> in a technical breakdown of the campaign. \u00abAfter building trust through friend requests, the actor moved the conversation to Messenger and used specific topics to lure targets as part of the initial social engineering stage of the\u00a0attack.\u00bb<\/p>\n

Central to the attack is the use of what the GSC describes as pretexting, a tactic where the threat actors aim to trick unsuspecting users into installing a dedicated PDF viewer, claiming the software was necessary to open encrypted military documents. The\u00a0PDF viewer used in the infection chain is a tampered version of Wondershare PDFelement, which, when launched, triggers the execution of embedded shellcode that allows the attackers to obtain an initial\u00a0foothold.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Another significant aspect of the campaign is that it utilizes legitimate but compromised infrastructure for command-and-control (C2), weaponizing the website associated with the Seoul arm of a Japanese real estate information service to issue malicious commands and payloads. What’s more, the payload takes the form of a seemingly harmless JPG image to deliver\u00a0RokRAT.<\/p>\n

\u00abThis is assessed as a highly evasive strategy that combines legitimate software tampering, abuse of a legitimate website, and file extension masquerading,\u00bb the GSC\u00a0said.<\/p>\n

\"\"<\/a><\/div>\n

In the attack sequence detailed by the South Korean cybersecurity company, the threat actors have been found to create two Facebook accounts — \u00abrichardmichael0828\u00bb and \u00abjohnsonsophia0414,\u00bb both of which were created on November 10, 2025 — and deliver a ZIP file after moving the conversation to Telegram, with the archive containing the trojanized version of Wondershare PDFelement along with four PDF documents and a text file containing instructions to install the program to view the\u00a0PDFs.<\/p>\n

The encrypted shellcode executed after the launch of the tampered installer allows it to establish communication with the C2 server (\u00abjapanroom[.]com\u00bb) and download a second-stage payload, a JPG image (\u00ab1288247428101.jpg\u00bb) that’s then used to final RokRAT\u00a0payload.<\/p>\n

The malware, for its part, abuses Zoho WorkDrive as C2 \u2013 a tactic\u00a0also detailed by Zscaler ThreatLabz in February 2026 as part of a campaign codenamed Ruby Jumper \u2013 enabling it to capture screenshots, enable remote command execution via \u00abcmd.exe,\u00bb collect host information, perform system reconnaissance, and evade detection by security programs like Qihoo’s 360 Total Security, while disguising malicious\u00a0traffic.<\/p>\n

\u00abIts core functionality has remained relatively stable and has been reused repeatedly across multiple operations over time,\u00bb the GSC said. \u00abThis shows that RokRAT has focused less on changing its core functionality and more on evolving its delivery, execution, and evasion\u00a0chain.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Apr 13, 2026Social Engineering \/ Threat Intelligence The North Korean hacking group tracked\u00a0as APT37 (aka ScarCruft) has been attributed to a fresh multi-stage, social engineering campaign in which threat…<\/p>\n","protected":false},"author":1,"featured_media":576,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1187,529,1058,1188,1186,42,247,1189,1057],"class_list":["post-575","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-apt37","tag-deliver","tag-engineering","tag-facebook","tag-koreas","tag-malware","tag-north","tag-rokrat","tag-social"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=575"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/575\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/576"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}