North Korea's APT37 Uses Facebook and Telegram to Deliver RokRAT Malware in Defense-Sector Campaign

North Korean APT37 is running a new targeted intrusion campaign using Facebook social engineering and Telegram to deliver RokRAT backdoor malware to defense-sector targets. The group created fake Facebook profiles listing Pyongyang as their location to screen potential victims, then moved conversations to Telegram to deliver trojanized Wondershare PDFelement installers. The payload provides system reconnaissance, command execution, and screenshot capture, with command-and-control implemented over Zoho WorkDrive OAuth2 APIs to blend with legitimate business traffic. South Korean firm Genians attributed the campaign to APT37 based on tooling and infrastructure overlap.