The Hacker Newsinfo@thehackernews.com (The Hacker News)
North Korea APT37 uses fake Facebook to spread RokRAT via PDF
Part of the APT37 story · since 1 Sep 2025
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF. This article, 12th of 19.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
According to the Genians Security Center (GSC), North Korea’s APT37 (ScarCruft) has launched a multi-stage social‑engineering campaign on Facebook to deliver a remote access trojan called RokRAT. The threat actor created two Facebook accounts, “richardmichael0828” and “johnsonsophia0414,” on 10 November 2025 and then moved the conversation to Telegram to push the attack, with targets identified and screened via location settings in Pyongyang and Pyongsong, North Korea.
Central to the operation is pretexting, steering victims to install a tampered Wondershare PDFelement PDF viewer that launches embedded shellcode to gain initial foothold, while the campaign also leverages legitimate but compromised infrastructure for command-and-control on a site tied to a Seoul-based real estate information service.
The payload is delivered as a seemingly harmless JPG image, and later communication with a C2 server uses the domain japanroom[.]com to fetch a second-stage payload; the malware also abuses Zoho WorkDrive as C2 to enable features such as screenshot capture and remote command execution. The article notes that RokRAT’s core functionality remains stable while its delivery and evasion chains evolve, per the GSC.
How the story developed
Quiet for 6 weekslast report 16 Sep19 articles7 outlets
19 articles from 7 outlets since 1 Sep. Quiet since 16 Sep. This was the 12th report, 224 days after the first.
- Mon 1 Sep, 08:45 UTC. The Hacker News, first report. ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics.
- Mon 1 Sep, 13:00 UTC. Security Affairs, its first report on the story. North Korea’s APT37 deploys RokRAT in new phishing campaign against academics.
- Tue 2 Sep, 01:30 UTC. SecurityOnline, its first report on the story. Operation HanKook Phantom: APT-37 Targets South Korean Institutions with LNK-Based Espionage Campaign.
- Tue 9 Sep, 07:05 UTC. GBHackers, its first report on the story. APT37 Deploys New Rust and Python Malware Targeting Windows Systems.
- Wed 10 Sep, 01:46 UTC. SecurityOnline. APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer.
- Tue 11 Nov, 01:00 UTC. SecurityOnline. North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices.
- Wed 24 Dec, 01:50 UTC. SecurityOnline. “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets.
- Fri 27 Feb, 13:26 UTC. The Hacker News. ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets.
- Fri 27 Feb, 14:28 UTC. Infosecurity, its first report on the story. APT37 hits airgapped networks via USB in Ruby Jumper campaign.
- Mon 2 Mar, 12:10 UTC. SecurityWeek, its first report on the story. APT37 targets airgapped systems using five tools in Ruby Jumper.
- Mon 2 Mar, 13:42 UTC. Security Affairs. APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2.
- Mon 13 Apr, 10:32 UTC. The Hacker News. North Korea APT37 uses fake Facebook to spread RokRAT via PDF. This article, 12th of 19.
- Tue 5 May, 10:00 UTC. The Hacker News. ScarCruft deploys Android BirdCall backdoor via sqgame.net.
- Tue 5 May, 15:21 UTC. Infosecurity. North Korean Hackers Trojanise Korean Gaming Site to Spy on Users.
- Tue 16 Jun, 08:50 UTC. The Hacker News. North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT.
- Fri 19 Jun, 08:50 UTC. SecurityOnline. APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs.
- Fri 17 Jul, 14:11 UTC. SecurityOnline. North Korean APT37 uses Dropbox phishing to deliver RokRAT malware.
- Thu 10 Sep, 09:54 UTC. SecurityOnline. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea.
- Wed 16 Sep, 01:24 UTC. Dark Reading, its first report on the story. North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers.
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 19 articles as a listHide the list
- Mon 1 SepDay 02
- ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics08:45 · The Hacker News · First report
- North Korea’s APT37 deploys RokRAT in new phishing campaign against academics13:00 · Security Affairs
- Tue 2 SepDay 11
Quiet for 7 days
Tue 9 SepDay 81- APT37 Deploys New Rust and Python Malware Targeting Windows Systems07:05 · GBHackers · Picked up again
- Wed 10 SepDay 91
- APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto, and FadeStealer01:46 · SecurityOnline
Quiet for 9 weeks
Tue 11 NovDay 711- North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices01:00 · SecurityOnline · Picked up again
Quiet for 6 weeks
Wed 24 DecDay 1141- “Casting Call” for Malware: APT37 Poses as TV Writers to Hack Targets01:50 · SecurityOnline · Picked up again
Quiet for 9 weeks
Fri 27 FebDay 1792- ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets13:26 · The Hacker News · Picked up again
- APT37 hits airgapped networks via USB in Ruby Jumper campaign14:28 · Infosecurity
Quiet for 3 days
Mon 2 MarDay 1822- APT37 targets airgapped systems using five tools in Ruby Jumper12:10 · SecurityWeek · Picked up again
- APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C213:42 · Security Affairs
Quiet for 6 weeks
Mon 13 AprDay 2241- North Korea APT37 uses fake Facebook to spread RokRAT via PDF10:32 · The Hacker News · Picked up again · This article, 12th of 19
Quiet for 3 weeks
Tue 5 MayDay 2462- ScarCruft deploys Android BirdCall backdoor via sqgame.net10:00 · The Hacker News · Picked up again
- North Korean Hackers Trojanise Korean Gaming Site to Spy on Users15:21 · Infosecurity
Quiet for 6 weeks
Tue 16 JunDay 2881- North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT08:50 · The Hacker News · Picked up again
Quiet for 3 days
Fri 19 JunDay 2911- APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs08:50 · SecurityOnline · Picked up again
Quiet for 4 weeks
Fri 17 JulDay 3191- North Korean APT37 uses Dropbox phishing to deliver RokRAT malware14:11 · SecurityOnline · Picked up again
Quiet for 8 weeks
Thu 10 SepDay 3741- Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea09:54 · SecurityOnline · Picked up again
Quiet for 6 days
Wed 16 SepDay 3801- North Korean Hackers Hide Linux Implant Inside HAProxy Load Balancers01:24 · Dark Reading · Picked up again