APT37 Uses Facebook, Telegram, and Trojanized Installer In New Intrusion Campaign

APT37 ran a targeted social‑engineering campaign using Facebook personas and Telegram to distribute a trojanized Wondershare PDFelement installer that deploys a RokRAT‑like backdoor. The malware captures screenshots, executes commands, enumerates hosts, and exfiltrates documents and audio via Zoho WorkDrive using hardcoded OAuth2 credentials and AES‑256‑CBC encryption, while employing evasion techniques and infrastructure linked to North Korea.