Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks

APT37 conducted a sophisticated social engineering campaign utilizing Facebook accounts claiming locations in Pyongyang and Pyongsong, North Korea, to conduct reconnaissance and build trust with targets. After establishing relationships through Facebook Messenger, the threat actor migrated conversations to Telegram and employed pretexting tactics, claiming to share encrypted PDF documents containing military weapons information. Victims were persuaded to install a tampered Wondershare PDFelement installer that executed embedded shellcode for initial compromise. The attack chain delivered follow-on commands through a JPG-disguised payload hosted on a compromised Japanese real estate website. The malware abused Zoho WorkDrive OAuth2 APIs as C2 channels, exfiltrating screenshots, documents, system information, and audio files. The campaign employed multiple evasion techniques including code cave injection, process hollowing into legitimate dism.exe, XOR encryption layers, and fileless in-memory execution.

• Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto TiesMalware2026-09-19
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14