APT37 Abuses Facebook, Telegram, and Tampered Installer in New Targeted Intrusion Attack

Cybersecuritynews •Tushar Subhra Dutta • April 13, 2026

A North Korean state- threat group known as APT37 has launched a new targeted intrusion campaign using social media platforms, encrypted messaging apps, and a carefully tampered software installer to compromise victims. The attack is notable for how convincingly it mimics everyday digital interactions, making it much harder for targets to recognize the threat before […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT37 Launches Targeted Cyberattack Using Social Media and Tampered Software APT37, a North Korean state-sponsored threat group, has initiated a new targeted intrusion campaign aimed at defense-related entities. The attack utilizes social media platforms like Facebook and encrypted messaging apps such as Telegram, alongside a tampered installer of Wondershare PDFelement, to gain unauthorized access to sensitive data. This operation showcases APT37's advanced social engineering tactics, making it difficult for victims to identify the threat. The campaign is characterized by its stealthy approach and the effective mimicry of legitimate digital interactions. Current reports indicate that the campaign is ongoing, with a focus on exfiltrating sensitive information. Organizations in the defense sector are particularly at risk, necessitating enhanced security measures. Behavior-based endpoint detection and response (EDR) solutions are recommended to detect process injection and other malicious activities. 2 sources 76

Extracted Entities

APT37 Abuses Facebook, Telegram, and Tampered Installer in New Targeted Intrusion Attack

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Platforms (2)