APT37 conducted a spear phishing campaign disguised as invitations to South Korean national security events, delivering malicious LNK files via Dropbox to execute fileless RoKRAT malware. This campaign exploited trusted cloud services for command and control (C2), challenging detection efforts and impacting endpoint security defenses. #APT37 #RoKRAT #Dropbox #EndpointSecurity
Keypoints
- In March 2025, APT37 targeted North Korean-focused activists using spear phishing emails that contained Dropbox links leading to ZIP archives with malicious LNK files.
- The campaign, named “Operation: ToyBox Story,” impersonated academic forums and national security conferences to lure victims.
- The malicious LNK files executed embedded PowerShell commands to load and run RoKRAT malware via a fileless attack method to evade traditional antivirus detection.
- RoKRAT malware collected system information, executed commands from the C2 server, captured screenshots, and exfiltrated data encrypted with multiple layers, using cloud storage API services like Dropbox, pCloud, and Yandex for C2 communication.
- Investigation identified Russian Yandex email accounts linked to the threat infrastructure along with several Gmail accounts previously attributed to APT37.
- Genian EDR’s endpoint detection and response capabilities proved effective in detecting and blocking these fileless attacks with detailed visibility into execution and C2 communication.
- The report emphasizes the importance of proactive endpoint monitoring and EDR-based anomaly hunting to defend against sophisticated fileless threats using legitimate cloud services as C2 servers.
MITRE Techniques
- [T1193] Spear Phishing Attachment – Used to deliver malicious LNK files disguised as conference invitations (“The email contained a Dropbox link leading to a compressed archive that included a malicious shortcut (LNK) file.”)
- [T1059.001] PowerShell – The LNK file executed embedded PowerShell commands to load shellcode and malware into memory (“The shortcut (LNK) file is configured to run PowerShell commands via embedded arguments…”)
- [T1106] Execution through API – RoKRAT executed commands like ‘cmd.exe’ on the infected host (“The malware also performs various actions such as communicating with the C2 server and executing ‘cmd.exe’ commands.”)
- [T1564.001] Hide Artifacts: Hidden Files and Directories – Created hidden batch and data files in the %Temp% directory to evade detection (“3 hidden files are created in the %Temp% directory…”)
- [T1027] Obfuscated Files or Information – Used XOR logic and multiple encryption layers including AES and RSA to encrypt payload and exfiltrated data (“The PE file embedded within the shellcode is decrypted using XOR logic… Data additionally encrypted using AES-CBC-128 and RSA.”)
- [T1071.001] Application Layer Protocol: Web Protocols – C2 communications were conducted via legitimate cloud API services such as Dropbox, pCloud, and Yandex (“C2 communication is conducted via Dropbox authentication… and used cloud-based API services.”)
- [T1021.004] Remote Services: Cloud Services – Use of cloud storage services as covert C2 infrastructure (“The group leverages legitimate cloud storage services as command and control (C2) servers.”)
- [T1086] PowerShell – Used again to load and execute memory resident malicious code (“Executing the malicious LNK file triggers… PowerShell command… creating a new thread to execute memory-resident code.”)
Indicators of Compromise
- [MD5 Hashes] Malicious payloads identified – examples include 81c08366ea7fc0f933f368b120104384, 723f80d1843315717bc56e9e58e89be5, and 10 more hashes.
- [C2 IP Addresses] Network infrastructure used for command and control – 89.147.101[.]65, 37.120.210[.]2, and one more IP.
- [Email Addresses] Threat actor infrastructure and communication – [email protected], [email protected], and multiple other Yandex and Gmail accounts linked to APT37 operations.
- [File Names] Malicious archives and LNK files – “러시아 전장에 투입된 인민군 장병들에게.zip” and “관련 포스터.zip” containing shortcut files used to deploy RoKRAT malware.
Read more: https://www.genians.co.kr/en/blog/threat_intelligence/toybox-story