APT37 Uses Facebook Personas and Trojanized PDFelement to Deliver RokRAT

North Korea-linked APT37 (also tracked as ScarCruft) ran a multi-stage social engineering campaign that used fake Facebook personas to befriend targets, shifted conversations to Telegram, and then persuaded victims to install a trojanized version of Wondershare PDFelement. The lure claimed the software was needed to open encrypted military-related documents, with attacker-controlled accounts presenting themselves as contacts based in Pyongyang and Pyongsong to build credibility.

When the tampered PDF viewer was executed, it launched encrypted shellcode, contacted command-and-control infrastructure hosted on a compromised legitimate website — including a site tied to the Seoul branch of a Japanese real estate service — and retrieved a JPG file that ultimately deployed the RokRAT remote access trojan. Researchers said the operation combined social engineering, legitimate software tampering, file-extension masquerading, abuse of trusted web infrastructure, and cloud-backed command and control through Zoho WorkDrive, showing that while RokRAT's core capabilities remain largely stable, its operators continue to refine delivery, execution, and evasion methods.