APT37 Uses Facebook Pretexting and a Tampered PDF Installer to Target Victims
Summary
Genians analyzes an APT37-attributed campaign that used Facebook reconnaissance and military-document lures to deliver a tampered PDFelement installer, deploy memory-resident malware, and abuse legitimate websites and Zoho WorkDrive for C2 and data theft.
Key points
- The attackers used Facebook accounts claiming North Korean locations to build trust with targets, then moved conversations to Messenger and Telegram.
- A password-protected archive contained decoy military-themed PDFs and a tampered Wondershare PDFelement installer that ran embedded shellcode.
- The shellcode injected a payload into suspended dism.exe and retrieved a second stage through a JPG-disguised URL hosted on a legitimate website.
- The second-stage malware used Zoho WorkDrive for C2 and data exfiltration, and could execute commands, capture screenshots, collect system information, and steal selected documents and audio files.
- Genians attributes the activity to APT37 based on technical similarities to RokRAT and related campaign, infrastructure, and linguistic indicators.
- The report recommends behavior-based EDR monitoring, threat hunting, and scrutiny of suspicious activity following social-network contact, installer execution, and image-file requests.
- At the time of analysis, the C2 server was blocked and no successful connection was established.
Article Details
- Attack Vectors
- APT37 used Facebook accounts to identify and approach targets, build trust through Messenger conversations, and lure them to Telegram or other external channels.
- Targets were persuaded to install a password-protected archive’s tampered Wondershare PDFelement installer under the pretext that it was needed to open encrypted military-related PDFs.
- The installer was modified to redirect execution to shellcode in a code cave, which created suspended dism.exe and injected code into it using remote memory allocation, WriteProcessMemory, and a remote thread.
- The shellcode downloaded a second-stage payload from a C2 URL disguised as a JPG image request, decrypted it in memory, and executed it without writing it to disk.
- The later payload used Zoho WorkDrive for command-and-control and data exfiltration, and could execute remote commands, capture screenshots, collect system information, and gather files.
- Defensive Notes
- Use EDR behavior and process-tree analysis to identify abnormal child-process creation, injection into legitimate processes, and activity that follows execution of legitimate-looking installers.
- Review externally received files and archives, including those delivered through social networks or messaging platforms; verify their source and restrict execution of files unrelated to work.
- Hunt for unusual HTTP traffic, anomalous response sizes or structures for image requests, concealed data in network traffic, and external communications inconsistent with user activity.
- Monitor for suspicious use of Zoho WorkDrive and correlate network, process, and endpoint behaviors across the full attack chain.
- Use continuous threat hunting and behavioral correlation alongside IOC-based detection; the report notes the C2 server was blocked during analysis and no successful connection was established at that time.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | japanroom[.]com | Domain explicitly listed as C2 infrastructure; the report describes it as hosting the JPG-disguised second-stage payload. |
leon91729@zoho[.]com | Account identified in connection with Zoho service abuse during the second half of 2025. | |
scott[.]snyder@zoho[.]com | Account the report says APT37 used in a 2017 spear-phishing attack. | |
| IPV4 | 222[.]122[.]49[.]15 | IP explicitly listed in the report's C2 indicators. |
| IPV4 | 38[.]32[.]68[.]195 | IP repeatedly observed in related activity and associated with the actor's apparent use of Astrill VPN; the report cautions that it is within a VPN service range and has limited standalone value. |
| MD5 | 28d0143718153bf04c1919a26bb70c2d | MD5 indicator listed in the report's IOC section. |
| MD5 | 36be2cbb59cd1c3f745d5f80f9aee21c | MD5 indicator listed in the report's IOC section. |
| MD5 | c681fe3f42e82e9240afe97c23971cbc | MD5 indicator listed in the report's IOC section. |
| MD5 | d44a22d2c969988a65c7d927e22364c8 | MD5 indicator listed in the report's IOC section. |
| URL | hxxp[:]//japanroom[.]com/board/DATA/1288247428101[.]jpg | C2 URL used to retrieve the second-stage payload disguised as a JPG. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload collected documents and smartphone audio recordings from the infected system for exfiltration.T1016 · System Network Configuration DiscoveryThe payload queried ipinfo[.]io/json to determine the victim system's public IP address and geolocation.T1027 · Obfuscated Files or InformationThe shellcode used XOR encryption and runtime string construction to conceal its payload and C2 URL.T1036 · MasqueradingThe attacker added “(PDF_Security)” to the installer filename and disguised a downloaded payload as a JPG.T1055 · Process InjectionThe shellcode allocated executable memory in suspended dism.exe, wrote decrypted code into it, and started it with a remote thread.T1057 · Process DiscoveryThe payload enumerated running processes, including to check for 360Tray.exe.T1059.003 · Windows Command ShellThe payload supported remote command execution through cmd.exe /c.T1071.001 · Web ProtocolsThe shellcode used HTTP requests to communicate with the C2 server and retrieve the next-stage payload.T1082 · System Information DiscoveryThe payload collected host and user information, including computer name, username, and Windows version.T1102.002 · Bidirectional CommunicationThe later payload used Zoho WorkDrive's OAuth2 API as a bidirectional command-and-control channel.T1105 · Ingress Tool TransferThe shellcode downloaded a second-stage payload from the C2 server.T1113 · Screen CaptureThe payload captured desktop screenshots and transmitted them.T1204.002 · Malicious FileTargets were induced to execute the tampered installer disguised as a PDF viewer.T1518.001 · Security Software DiscoveryThe payload checked for 360Tray.exe, identified in the report as a component of the Qihoo 360 security product.T1566.003 · Spearphishing via ServiceThe actor used Facebook, Messenger, and Telegram to build trust, deliver lures, and provide the malicious archive.T1567.002 · Exfiltration to Cloud StorageThe payload exfiltrated collected information to Zoho WorkDrive cloud storage.T1593.001 · Social MediaAPT37 used Facebook accounts to conduct target reconnaissance and screening.
Threat Actors
Malware
Vendors
WondershareExecuted shellcode and gained initial access through a carefully tampered Wondershare PDFelement installerZohoIt receives attacker commands and exfiltrates stolen data through the OAuth2 API of Zoho WorkDrive, with two sets of OAuth authentication tokens hardcoded in the binary for this purpose.
Products
FacebookConducted reconnaissance using two Facebook accounts claiming to be from Pyongyang and Pyongsong, North KoreaGenian Insights EIntegrated Response Strategy with "Genian Insights E"MessengerBuilt trust by adding targets as Facebook friends, then moved the conversation to Messenger and lured them using specific topicsMicrosoft WindowsNote: DISM (Deployment Image Servicing and Management) is a command-line utility in Microsoft Windows for creating, modifying, and managing system image files such as WIM, VHD, and FFU.TelegramPDF documents containing technical information on military weapons through Facebook Messenger or Telegram, and then persuading targets to install a dedicated PDF viewer to open them.Wondershare PDFelementExecuted shellcode and gained initial access through a carefully tampered Wondershare PDFelement installerZoho WorkDriveIt receives attacker commands and exfiltrates stolen data through the OAuth2 API of Zoho WorkDrive, with two sets of OAuth authentication tokens hardcoded in the binary for this purpose.