North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

North Korean APT37 group orchestrates a sophisticated social engineering campaign using Facebook to distribute RokRAT malware.

• •Threat actors create Facebook accounts claiming to be from Pyongyang and Pyongsong to identify and build trust with targets before moving conversations to Messenger
• •Attack uses pretexting tactics to trick users into installing a trojanized version of Wondershare PDFelement, disguised as a PDF viewer for encrypted military documents
• •Compromised infrastructure of a Japanese real estate website (japanroom[.]com) serves as command-and-control server for issuing malicious commands
• •RokRAT payload is disguised as a JPG image file, demonstrating evasive file extension masquerading
• •Malware uses Zoho WorkDrive as secondary C2 to capture screenshots, execute remote commands via cmd.exe, and evade detection by security programs