Loading story…
A Genians threat intelligence report detailed a targeted intrusion campaign attributed to APT37, the North Korea-linked group also tracked in connection with RokRat activity. The campaign reportedly relied on pretexting to engage victims, with operators conducting reconnaissance through Facebook before moving to compromise targets through software tampering techniques.
The reporting links the activity to the DPRK cyber threat ecosystem and highlights a blend of social engineering and supply-chain-style manipulation to gain access and advance intrusions. Public references to the report emphasized the campaign's use of staged victim profiling and trusted-software abuse, underscoring APT37's continued focus on tailored espionage operations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Genians published a threat intelligence report analyzing an APT37 campaign that used pretexting, Facebook-based reconnaissance, and software tampering, and linked the activity to RokRat and DPRK-associated threat activity. The two Bluesky posts reference the same external report rather than separate incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked **APT37** (also tracked as **ScarCruft**) ran a multi-stage social engineering campaign that used fake Facebook personas to befriend targets, shifted conversations to Telegram, and then persuaded victims to install a trojanized version of **Wondershare PDFelement**. The lure claimed the software was needed to open encrypted military-related documents, with attacker-controlled accounts presenting themselves as contacts based in **Pyongyang** and **Pyongsong** to build credibility. When the tampered PDF viewer was executed, it launched encrypted shellcode, contacted command-and-control infrastructure hosted on a compromised legitimate website — including a site tied to the Seoul branch of a Japanese real estate service — and retrieved a JPG file that ultimately deployed the **RokRAT** remote access trojan. Researchers said the operation combined social engineering, legitimate software tampering, file-extension masquerading, abuse of trusted web infrastructure, and cloud-backed command and control through **Zoho WorkDrive**, showing that while RokRAT's core capabilities remain largely stable, its operators continue to refine delivery, execution, and evasion methods.
Jun 29, 2026
Researchers reported that **APT37**/**Reaper** (also tracked as **ScarCruft**) ran a surveillance campaign against **North Korean defectors in South Korea** and **human rights activists**, using credential-harvesting phishing pages and malware-laced lures to collect intelligence. The operation impersonated services including **Naver, iCloud, Kakao, Mail.ru, and 163.com**, and some phishing pages were built to intercept credentials and evade or relay **two-factor authentication** flows through web-based communications channels. Investigators found two exposed Reaper command-and-control servers that revealed both hosted malware and stolen victim data, providing a detailed view of the intrusion set. The campaign used **CHM** files for initial infection, **PowerShell** backdoors, modified DLL loaders, **ExtremeVNC**, and multiple **Chinotto** malware variants, including new Windows DLL samples identified as **CKU** and **DATA**, as well as an **AblyGo** backdoor, indicating ongoing tool development in a sustained North Korea-linked cyberespionage effort.
Aug 15, 2026
APT37, also tracked as **ScarCruft/RedEyes**, has continued delivering the **RokRAT** backdoor through spear-phishing campaigns that use malicious `.lnk` shortcut files, often packaged in ZIP or ISO archives and disguised as certificates, conference invitations, or other South Korea-focused policy and security documents. Researchers reported that the LNK files launch hidden `cmd` and PowerShell chains to extract decoy files, stage payloads from locations such as `%public%`, and retrieve additional components from cloud storage including **OneDrive** and **Dropbox**. The activity has primarily targeted South Korean users, especially people involved in North Korea-related issues, unification, military, education, and activist communities, while earlier RokRAT operations also used malicious HWP documents exploiting `CVE-2013-0808`. Once executed, RokRAT performs host reconnaissance, steals credentials and other user data, captures screenshots and process information, executes attacker commands, and can download further malware, while hiding command-and-control and exfiltration traffic inside trusted cloud services such as **pCloud**, **Yandex**, **Dropbox**, **OneDrive**, and previously **Twitter** and **Mediafire**. Multiple reports said the malware uses in-memory or fileless execution, anti-analysis checks, and HTTP headers masquerading as **Googlebot**, complicating detection by signature-based tools. Analysts linked the campaigns to APT37 through recurring malware code, infrastructure patterns, lure themes, and tradecraft, and noted that the group shifted from document-based delivery to LNK-driven infection chains after macro-blocking changes made older techniques less reliable.
Aug 15, 2026