APT37 is running a new social-engineering-driven cyber‑espionage campaign that abuses Facebook, Telegram, and a trojanized Wondershare PDFelement installer to deliver a RokRAT‑like backdoor and exfiltrate sensitive data via Zoho WorkDrive.
The operation shows a clear evolution of APT37’s long‑standing TTPs toward social‑network reconnaissance, tampered installers, and multi‑stage, fileless payload delivery.
APT37 Shifts To Facebook and Trojanized Installer
Genians Security Center analyzed a recent intrusion campaign in which APT37 used two Facebook accounts listing Pyongyang and Pyeongtaek, North Korea, as their locations to identify and screen targets in defense‑related sectors.
The operators first sent friend requests, exchanged small talk, and then moved the conversation to Facebook Messenger to build trust before introducing more sensitive topics, such as “encrypted” military weapons documents.
Using a classic pretexting tactic, the actor claimed that these documents were protected and could only be opened with a “dedicated PDF viewer,” which was delivered either via Messenger or via Telegram as an encrypted ZIP archive (m.zip).
Stealthy C2 With Zoho WorkDrive and evolving APT37 TTPs
The final payload abuses the OAuth2 API of Zoho WorkDrive as command‑and‑control infrastructure, with multiple client IDs, secrets, and refresh tokens hardcoded into the binary.
It captures desktop screenshots, executes arbitrary commands via cmd.exe, collects host and user identifiers, enumerates drives, and even queries ipinfo[.]io to determine public IP and geolocation before exfiltrating data to Zoho WorkDrive over encrypted channels.
Data, including documents (.DOC, .XLS, .PPT, .PDF, .HWP, .TXT) and smartphone audio files (.M4A, .AMR), is packaged, encrypted with AES‑256‑CBC, and uploaded in a way that blends seamlessly with legitimate cloud storage traffic.
The malware also includes evasion features such as process‑based product checks (for example, 360 security), fake updater filenames like OfficeUpdate.exe, and a pool of browser‑like User‑Agent strings to disguise HTTP requests.
Infrastructure and persona‑level clues reinforce the link to APT37. The two Facebook accounts used in this operation were created on the same day and list North Korean localities.
Related activity repeatedly resolves to an Astrill VPN IP that threat‑intel vendors have previously tied to North Korea‑linked clusters.
Genians’ earlier “Operation ToyBox Story” and subsequent reports documented APT37’s habit of abusing legitimate cloud services (Dropbox, Yandex, pCloud, Zoho) and hiding RokRAT inside images or DLL sideloading chains, with recent campaigns also leveraging Zoho accounts and North Korean typefaces like “Chollima” in decoy documents.
Across these cases, RokRAT’s core functionality has changed little, but delivery and evasion have steadily evolved from LNK and HWP‑based spear‑phishing to DLL sideloading, steganography, and now Facebook‑driven social engineering plus trojanized installers making detection based solely on static IoCs increasingly fragile.
Defenders should assume that similar campaigns will continue to blend legitimate software, compromised or abused web infrastructure, and cloud APIs to hide C2 activity.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
