ANALYSIS OF APT37 ATTACK CASE DISGUISED AS A THINK TANK FOR NATIONAL SECURITY STRATEGY IN SOUTH KOREA

Summary from the TLDR InfoSec newsletter

The APT37 threat actor from North Korea launched a March 2025 spear phishing campaign, posing as a South Korean national security think tank, which delivered malicious LNK files via Dropbox that ultimately installed the RoKRAT backdoor. Dubbed "Operation: ToyBox Story," the attack employed fileless malware techniques to evade detection, with the RoKRAT backdoor capturing screenshots and system info before encrypting and exfiltrating data to cloud-based command servers. The attackers utilized legitimate cloud services (Dropbox, pCloud, and Yandex) as C2 infrastructure and Russian Yandex email addresses, specifically targeting activists focused on North Korea.