APT37 Pretexting Campaign: Facebook Social Engineering Delivers RokRAT via Tampered PDFelement Installer — Threadlinqs Intelligence
As of 2026-07-19, APT37 Pretexting Campaign: Facebook Social Engineering Delivers RokRAT via Tampered PDFelement Installer is a high-severity apt threat attributed to APT37 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1526 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: APT37 · North Korea · ESPIONAGE
North Korea-linked APT37 (ScarCruft) built trust on Facebook using two fake personas, moved targets to Telegram, and delivered a trojanized Wondershare PDFelement installer disguised as a viewer for
Genians Security Center documented a targeted intrusion attributed to APT37 (aka ScarCruft, Reaper, Group123, Ricochet Chollima, InkySquid, Red Eyes, APT-C-28, ATK4, Moldy Pisces) in which the threat actor established rapport with victims via two Facebook accounts, 'richardmichael0828' and 'johnsonsophia0414', both created on 2025-11-10 and geolocated to Pyongyang and Pyongsong, North Korea. After friend requests and Messenger conversations built around military and technical-cooperation pretexts, the actor moved the conversation to Telegram and delivered an encrypted archive 'm.zip' containing a tampered Wondershare PDFelement installer (Wondershare_PDFelement_Installer(PDF_Security).exe), several decoy PDF documents with military-themed titles rendered in the North Korean 'Chollima' typeface, and a Korean-language instructions file ('설명서_(instructions)_.txt') containing North Korean dialect terms such as '콤퓨터' (computer) and '프로그람' (program). The archive password was shared separately over Telegram.
The tampered installer retains the legitimate Wondershare application's functionality but lacks the vendor's digital signature and carries roughly 2 KB of shellcode injected into an unused code cave at offset 0x0015A0E0. On execution, the shellcode dynamically constructs the path to %windir%\System32\dism.exe using 4-byte MOV instructions, creates the process suspended (CREATE_SUSPENDED), allocates PAGE_EXECUTE_READWRITE memory via VirtualAllocEx, XOR-decrypts (key 0x6D) an embedded payload, writes it via WriteProcessMemory, and launches it with CreateRemoteThread — classic process hollowing (T1055.012) with retry logic (up to 5 attempts at 0.1s intervals) before returning control to the legitimate installer flow to preserve appearances.
The injected payload retrieves a second stage disguised as a JPEG image at http://japanroom[.]com/board/DATA/1288247428101.jpg. japanroom[.]com is the Seoul branch website of a legitimate Japanese real-estate information service that has been compromised to host attacker infrastructure, allowing the C2 traffic to blend into normal web activity and evade domain-reputation blacklisting. The delivered file has its MZ/PE header signatures stripped but preserves internal PE structure; a single-byte XOR (key derived from the first byte of the file) decrypts it, which is validated against the 0x55 0x8B (PUSH EBP / MOV EBP,ESP) function prologue, followed by a second 4-byte DWORD XOR layer (key 0x86F68586) across an 851,968-byte payload, ultimately reconstructing the RokRAT backdoor entirely in memory (fileless execution).
RokRAT performs system reconnaissance (computer name, username, Windows version, IP/geolocation, SMBIOS identifiers, running process list), screen capture (GetDC/GetSystemMetrics/CreateCompatibleBitmap/BitBlt, JPEG-encoded), arbitrary command execution via 'cmd.exe /c', and document/media collection targeting .DOC, .XLS, .PPT, .PDF, .HWP, .TXT, .M4A, and .AMR files. It performs defense evasion by enumerating running processes for Qihoo 360 (360Tray.exe) and carries 21 distinct User-Agent strings to blend into web traffic. All collected data is encrypted with AES-256-CBC prior to exfiltration. Debug/tracking strings recovered from the sample include 'JinHyok', '#FBI#TOOLKIT#GIDRA@TEAM', and '@-IV-FBI-SERVER2', consistent with prior North Korea-nexus tooling.
Command-and-control and exfiltration abuse the Zoho WorkDrive OAuth2 API using two sets of hardcoded client_id/refresh_token/client_secret credentials, disguising C2 and exfiltration traffic as legitimate cloud-storage business traffic. This technique mirrors the 'Ruby Jumper' campaign documented by Zscaler ThreatLabz in February 2026, in which RokRAT abused Zoho WorkDrive for command retrieval and data exfiltration, and matches historical APT37 Zoho account abuse (scott.snyder@zoho.com in 2017; leon91729@zoho.com identified H2 2025, registered under alias 'kingtiger1970').
Genians assessed high code similarity between the RokR
Target sectors: government administration, defense, military, academic research
Target regions: south korea, japan, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1589.001, T1585.001, T1584.004, T1566.003, T1566.001, T1566.002, T1204.002, T1059.003, T1543, T1036.005