APT37 Uses Facebook, Telegram, and Trojanzied Installer in New Targeted Cyberattack

APT37 conducted a targeted intrusion campaign using social-engineered Messenger/Telegram lures and a tampered Wondershare PDFelement installer that injects a multi-stage, XOR‑encrypted payload into a suspended dism.exe process, ultimately deploying a RokRAT-like backdoor that exfiltrates documents and screenshots via Zoho WorkDrive OAuth2-based C2. The operation is highly evasive (signed-binary abuse, fileless execution, image‑disguised payloads) and appears aimed at defense-related targets, warranting behavior-based EDR and monitoring for unsigned ‘update’ installers, suspicious dism.exe activity, and cloud-storage C2 patterns.