APT37 Uses Facebook, Telegram, and Trojanzied Installer in New Targeted Cyberattack

Gbhackers •Mayura Kathir • April 13, 2026

APT37 is running a new targeted intrusion campaign that abuses , Telegram, and a tampered Wondershare PDFelement installer to gain stealthy access and exfiltrate sensitive data, likely from defense‑related targets. The operation shows a continued evolution of APT37’s social engineering and evasion tradecraft, and demands behavior‑based EDR capable of spotting process injection, abused cloud storage, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT37 Launches Targeted Cyberattack Using Social Media and Tampered Software APT37, a North Korean state-sponsored threat group, has initiated a new targeted intrusion campaign aimed at defense-related entities. The attack utilizes social media platforms like Facebook and encrypted messaging apps such as Telegram, alongside a tampered installer of Wondershare PDFelement, to gain unauthorized access to sensitive data. This operation showcases APT37's advanced social engineering tactics, making it difficult for victims to identify the threat. The campaign is characterized by its stealthy approach and the effective mimicry of legitimate digital interactions. Current reports indicate that the campaign is ongoing, with a focus on exfiltrating sensitive information. Organizations in the defense sector are particularly at risk, necessitating enhanced security measures. Behavior-based endpoint detection and response (EDR) solutions are recommended to detect process injection and other malicious activities. 2 sources 76

Extracted Entities

APT37 Uses Facebook, Telegram, and Trojanzied Installer in New Targeted Cyberattack

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

MITRE ATT&CK (2)

Platforms (3)