{
  "name": "Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks",
  "slug": "pretexting-based-targeted-intrusion-analysis-of-facebook-reconnaissance-and-software-tampering-attacks",
  "description": "APT37 conducted a sophisticated social engineering campaign utilizing Facebook accounts claiming locations in Pyongyang and Pyongsong, North Korea, to conduct reconnaissance and build trust with targets. After establishing relationships through Facebook Messenger, the threat actor migrated conversations to Telegram and employed pretexting tactics, claiming to share encrypted PDF documents containing military weapons information. Victims were persuaded to install a tampered Wondershare PDFelement installer that executed embedded shellcode for initial compromise. The attack chain delivered follow-on commands through a JPG-disguised payload hosted on a compromised Japanese real estate website. The malware abused Zoho WorkDrive OAuth2 APIs as C2 channels, exfiltrating screenshots, documents, system information, and audio files. The campaign employed multiple evasion techniques including code cave injection, process hollowing into legitimate dism.exe, XOR encryption layers, and fileless in-memory execution.",
  "published": "2026-04-14T08:55:08.690000+00:00",
  "created_at": "2026-04-14T09:52:17.786000+00:00",
  "modified_at": "2026-04-14T07:52:17+00:00",
  "created_at_opencti": "2026-04-14T09:52:17.786000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "apt37",
    "facebook reconnaissance",
    "installer tampering",
    "north korea",
    "pretexting",
    "process hollowing",
    "rokrat",
    "shellcode injection",
    "social engineering",
    "zoho workdrive c2"
  ],
  "tags": [
    "2026-04-14",
    "apt37",
    "facebook reconnaissance",
    "installer tampering",
    "north korea",
    "pretexting",
    "process-hollowing",
    "rokrat",
    "shellcode injection",
    "social engineering",
    "zoho workdrive c2"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "ca81ac5e-3eaf-4521-b106-143c9fe13dc4",
        "name": "d5a3321b215d2b141de7ebe24398cf43320a2016e4f20d079ddf7015ceb069a8"
      },
      {
        "id": "d4fc4941-3472-4a72-896c-4f2f2d593ecc",
        "name": "222.122.49.15"
      },
      {
        "id": "0d470238-2484-4593-ad6b-5f61d2eba633",
        "name": "japanroom.com"
      },
      {
        "id": "1daa744a-f0b9-43f6-bac7-c87327f43e0c",
        "name": "https://www.genians.com/"
      },
      {
        "id": "17eb8132-db16-4198-bf49-bccffa7bd8d4",
        "name": "dad0ca56b3fe2aeb1f7908765f279db5fc33392caf4849c573a5d63bf7e15604"
      },
      {
        "id": "c2eab014-7b64-489b-8a07-4588ce13cd58",
        "name": "3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102"
      },
      {
        "id": "f7bdb652-9a15-4788-a5d2-8d8e8f7f2442",
        "name": "8448b5ff7fac8b65dd9e5056a8a4b3e4230b7b602f46e24f1667821a64a90e6e"
      },
      {
        "id": "d1ead69b-a469-4dfe-8c73-e250eda6f948",
        "name": "tac@genians.com"
      },
      {
        "id": "783ca30f-43f3-4b86-9850-af8b63e20078",
        "name": "38.32.68.195"
      },
      {
        "id": "d77a7712-8a8a-4ac3-9582-6409696ddaf2",
        "name": "www.genians.com"
      },
      {
        "id": "dbd60040-41c7-424d-be30-f79a98d3e5fd",
        "name": "http://japanroom.com/board/DATA/1288247428101.jpg"
      }
    ],
    "intrusion_sets": [
      {
        "id": "950aa317-d079-47cd-913e-10433cf55ecc",
        "name": "APT37",
        "slug": "apt37"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "ce39cd5d-9e4c-4138-b546-abd68e57f8c2",
        "name": "T1071.004"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      }
    ],
    "malware": [
      {
        "id": "df02a7ff-d258-46c0-87a1-745be7c680b4",
        "name": "ROKRAT - S0240",
        "slug": "rokrat-s0240"
      }
    ],
    "observables": [
      {
        "id": "6c95ce46-540d-4a06-bfcb-7e38abdf301b",
        "name": "japanroom.com"
      },
      {
        "id": "452a5803-67fc-4bd4-bfd9-57c01a00fbeb",
        "name": "tac@genians.com"
      },
      {
        "id": "c8692a9b-6717-4517-884e-01d236c05903",
        "name": "www.genians.com"
      },
      {
        "id": "124defa7-79c0-406c-8cd2-5995ade03ab8",
        "name": "38.32.68.195"
      },
      {
        "id": "119e5543-6fbc-468f-ac98-dae283f77564",
        "name": "222.122.49.15"
      },
      {
        "id": "a99c5b07-9513-4d15-9076-21dc7ffbefe0",
        "name": "http://japanroom.com/board/DATA/1288247428101.jpg"
      },
      {
        "id": "64f69dd5-2b9a-489d-a499-9674ffc2054e",
        "name": "https://www.genians.com/"
      },
      {
        "id": "",
        "name": "d5a3321b215d2b141de7ebe24398cf43320a2016e4f20d079ddf7015ceb069a8"
      },
      {
        "id": "",
        "name": "dad0ca56b3fe2aeb1f7908765f279db5fc33392caf4849c573a5d63bf7e15604"
      },
      {
        "id": "",
        "name": "3ecb8632582982f5ea4cef6b32ac468bd43c61896b5de57416c8100f8ab90102"
      },
      {
        "id": "",
        "name": "8448b5ff7fac8b65dd9e5056a8a4b3e4230b7b602f46e24f1667821a64a90e6e"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "japanroom.com"
      }
    ]
  },
  "external_refs": [
    {
      "id": "a1046a2b-5ea1-4d7e-97e2-28403434b326",
      "standard_id": "external-reference--3d1cc376-48f4-582b-8620-cab2895cf459",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.genians.co.kr/en/blog/threat_intelligence/pretexting",
      "hash": null,
      "external_id": null,
      "created": "2026-04-14T09:52:10.964Z",
      "modified": "2026-04-14T09:52:10.964Z",
      "createdById": null
    },
    {
      "id": "7b058c02-298b-4f16-8b63-9773575f2b1f",
      "standard_id": "external-reference--52c2a696-fcec-5ae0-9829-30e07ca04ea9",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/69de00eccc0fa8439b871c56",
      "hash": null,
      "external_id": "69de00eccc0fa8439b871c56",
      "created": "2026-04-14T09:52:10.933Z",
      "modified": "2026-04-14T09:52:10.933Z",
      "createdById": null
    }
  ]
}