North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

The report attributes a multi-stage social engineering campaign to North Korean APT37 (ScarCruft) that used Facebook friend requests and Messenger-to-Telegram contact to convince targets to install a trojanized Wondershare PDFelement; the tampered installer runs embedded shellcode to contact a compromised site (japanroom.com), download a JPG-based second-stage payload and ultimately deploy RokRAT which uses Zoho WorkDrive for C2 to perform remote execution, reconnaissance and data capture while evading security tools.