APT37 is running a new targeted intrusion campaign that abuses Facebook, Telegram, and a tampered Wondershare PDFelement installer to gain stealthy access and exfiltrate sensitive data, likely from defense‑related targets.
The operation shows a continued evolution of APT37’s social engineering and evasion tradecraft, and demands behavior‑based EDR capable of spotting process injection, abused cloud storage, and image‑disguised payloads beyond simple signatures.
The operators first sent friend requests, then built trust in one‑to‑one Messenger chats using tailored topics before shifting the conversation to “more secure” channels such as Telegram.
Under the pretext of sharing encrypted military weapons documents, the actor claimed that a dedicated PDF viewer was required and pushed victims to install it to open the files.
Genians Security Center analyzed a campaign in which APT37 used two Facebook accounts claiming to be from Pyongyang and Pyeongtaek, North Korea, to identify and screen specific targets before an attack.
The malicious package was delivered as a password‑protected ZIP (for example, “m.zip”) via Telegram, bundling a fake PDF viewer executable, multiple military‑themed decoy PDFs, and a Korean‑language “instructions” text file that used North‑Korean style spellings such as “콤퓨터,” “프로그람,” and “화일,” supporting a DPRK nexus.
The “dedicated viewer” turned out to be a carefully modified Wondershare PDFelement installer named “Wondershare_PDFelement_Installer(PDF_Security).exe,” mimicking the legitimate filename but adding “(PDF_Security)” as masquerade.
Unlike the official installer, the tampered file lacked a valid Wondershare digital signature, indicating modification and making absence of a signature a key IoC for defenders.
Internally, the actor preserved normal installer behavior, changing only the PE entry point by inserting roughly 2 KB of shellcode into a code cave at the end of the .text section and redirecting execution there first.
The shellcode constructs the path to “%windir%\System32\dism.exe” at runtime, resolves APIs via PEB‑based hash routines. It launches dism.exe in a suspended state before injecting a decrypted payload into its memory with VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
After completing the malicious sequence, control flows back to the original entry point so the legitimate PDF element setup runs, masking compromise behind a normal installation.
The shellcode contains a 51‑byte XOR‑encrypted blob that decodes at runtime into a C2 URL on a legitimate Japanese real estate information service, specifically the Seoul branch path, ending in “1288247428101.jpg.”
Although it uses a .jpg extension and appears to request an image, the response is treated as an XOR‑encrypted second‑stage payload, not media content.
A first XOR pass uses the leading byte as key to decrypt the downloaded data and verify that the result starts with standard x86 function prologue bytes (55 8B), looping with retries if validation fails.
The threat actor retained the main function of the tampered installer and modified only the entry point.
A second decryption layer then uses a 4‑byte key to reconstruct a PE image with removed MZ/PE signatures, which is mapped and run purely in memory, completing a fully fileless, multi‑stage execution chain.
The final payload strongly resembles APT37’s RokRAT backdoor family, whose capabilities include system reconnaissance, command execution, and screenshot capture, and which has a history of abusing legitimate cloud services for C2.
The malware gathers host details, running processes, disk layout, public IP and geolocation, and exfiltrates screenshots plus documents and mobile audio recordings with extensions including DOC, XLS, PPT, PDF, HWP, TXT, M4A, and AMR.
Command‑and‑control is implemented over Zoho WorkDrive’s OAuth2 APIs, with multiple client IDs, client secrets, and refresh tokens hardcoded to blend in with normal business traffic, similar to previously reported APT37 activity using Zoho as stealth C2.
Collected data is encrypted with AES‑256‑CBC before upload, and the implant also checks for specific security products, can drop a fake “OfficeUpdate.exe” updater, and cycles through numerous User‑Agent strings to further obfuscate network behavior.
The campaign’s tradecraft aligns with APT37’s documented evolution from HWP and LNK‑delivered RokRAT to cloud‑backed, fileless implants and multi‑stage XOR‑encrypted loaders, including repeated abuse of Zoho WorkDrive for C2.
Facebook accounts created on the same day, Korean‑language markers, infrastructure overlaps, and historic use of Zoho accounts and North Korean‑style decoys further support attribution to this DPRK‑linked cluster.
Given the heavy use of tampered installers, process injection into signed binaries, cloud C2, and image‑disguised payloads, signature‑only controls are insufficient; organizations must deploy behavior‑based EDR with strong telemetry around parent‑child process chains, unsigned “update” binaries, suspicious dism.exe activity.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…