APT37 Hackers Fake Academic Forum Invites to Deliver Malicious LNK Files via Dropbox Platform

The North Korean state-sponsored hacking group APT37 has launched a sophisticated spear phishing campaign in March 2025, targeting activists focused on North Korean issues.

Disguised as invitations to an academic forum hosted by a South Korean national security think tank, these emails cleverly referenced a real event titled “Trump 2.0 Era: Prospects and South Korea’s Response” to lure unsuspecting recipients.

Sophisticated Spear Phishing Campaign

The campaign, dubbed “Operation: ToyBox Story” by Genians Security Center (GSC), utilized the trusted Dropbox cloud platform to deliver malicious shortcut (LNK) files, showcasing APT37’s evolving tactics in exploiting legitimate services for nefarious purposes.

This approach, often termed “Living off Trusted Sites (LoTS),” mirrors the group’s previous reliance on platforms like pCloud and Yandex for command and control (C2) operations, highlighting their strategy to blend into legitimate traffic and evade traditional detection mechanisms.

The phishing emails, observed on March 8 and 11, 2025, contained deceptive attachments mimicking legitimate Hangul (HWP) documents and conference posters, leading victims to download ZIP archives from Dropbox.

Once extracted, these archives revealed malicious LNK files that, upon execution, triggered hidden PowerShell commands to deploy the RoKRAT malware a notorious remote access trojan associated with APT37.

The malware initiates its attack by creating hidden files in the %Temp% directory, executing batch scripts obfuscated to evade detection, and loading shellcode into memory using XOR logic for fileless execution.

RoKRAT’s capabilities are extensive, including system information harvesting (e.g., OS build version, device name, and BIOS details), real-time screenshot capture saved in hexadecimal-named temporary files, and data exfiltration to cloud-based C2 servers like api.dropboxapi[.]com.

Technical Breakdown of Malware Delivery

The collected data undergoes multi-layered encryption with XOR, AES-CBC-128, and RSA before transmission, ensuring that sensitive information remains concealed during exfiltration.

GSC’s analysis revealed striking similarities with prior APT37 campaigns, such as the use of identical encryption routines and behavioral patterns mapped to MITRE ATT&CK tactics, indicating minimal code evolution despite persistent attacks.

This fileless approach complicates detection by traditional antivirus solutions, necessitating advanced endpoint detection and response (EDR) systems like Genian EDR, which can flag anomalous behaviors and provide detailed attack storylines for proactive threat hunting.

The campaign’s infrastructure also ties back to Russian Yandex email accounts and previously identified Gmail addresses, alongside VPN services like NordVPN for origin obfuscation, underscoring APT37’s meticulous efforts to remain untraceable.

Organizations are urged to enhance monitoring for suspicious cloud service communications and refrain from opening LNK files from unverified sources to mitigate such risks.

Indicators of Compromise (IoC)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!