APT37 Used Facebook Reconnaissance and Software Tampering in Targeted Intrusions
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Apr 13, 2026
A Genians threat intelligence report detailed a targeted intrusion campaign attributed to APT37, the North Korea-linked group also tracked in connection with RokRat activity. The campaign reportedly relied on pretexting to engage victims, with operators conducting reconnaissance through Facebook before moving to compromise targets through software tampering techniques.
The reporting links the activity to the DPRK cyber threat ecosystem and highlights a blend of social engineering and supply-chain-style manipulation to gain access and advance intrusions. Public references to the report emphasized the campaign's use of staged victim profiling and trusted-software abuse, underscoring APT37's continued focus on tailored espionage operations.
