APT37 Leverages Malicious LNK Files and Dropbox for C2 Infrastructure

The North Korea-linked threat group APT37 launched a sophisticated spear phishing campaign targeting activists and organizations focused on North Korean affairs.

The attackers disguised their emails as invitations and information from a South Korean national security think tank, referencing real-world events such as “Trump 2.0 Era: Prospects and South Korea’s Response” to enhance credibility.

These phishing emails contained Dropbox links leading to compressed ZIP archives, each harboring a malicious shortcut (LNK) file engineered to execute fileless malware upon user interaction.

The campaign, dubbed “Operation: ToyBox Story” by the Genians Security Center (GSC), highlighted APT37’s ongoing evolution in attack methodology.

The group has a documented history of leveraging trusted cloud platforms-including Dropbox, pCloud, and Yandex-as command and control (C2) infrastructure, a tactic known as “Living off Trusted Sites” (LoTS).

This approach enables attackers to blend malicious traffic with legitimate cloud service activity, complicating detection and response efforts.

Attack Chain and Technical Analysis

The spear phishing operation unfolded in two distinct cases. In one, the attackers impersonated a South Korea-based expert and distributed an archive titled “To North Korean Soldiers Deployed to the Russian Battlefield.zip.”

In the other, they posed as a national security conference organizer, enticing recipients to open a ZIP file named “Related Poster.zip.”

Both archives contained LNK files designed to execute hidden PowerShell commands, which in turn initiated a multi-stage malware loader chain.

Upon execution, the LNK file deployed a decoy document to allay suspicion while simultaneously creating hidden files in the system’s temporary directory.

The loader chain used obfuscated batch scripts and PowerShell commands to decrypt and inject shellcode directly into memory-a hallmark of fileless attack techniques.

The final payload was a variant of the RoKRAT malware family, known for its modular architecture and ability to evade traditional antivirus solutions.

RoKRAT’s primary functions include collecting detailed system information-such as OS build, device name, user credentials, and BIOS version-and exfiltrating this data to the attacker’s C2 server.

The malware also supports a wide range of post-exploitation commands, including process termination, script deletion, removable drive enumeration, and execution of arbitrary commands via cmd.exe.

Notably, RoKRAT is capable of capturing real-time screenshots and uploading them, along with other stolen data, to cloud-based C2 endpoints.

Data exfiltration is achieved through a multi-layered encryption process: system data is first obfuscated with an XOR operation using a pseudo-random key, then further encrypted with AES-CBC-128, and finally the AES key is wrapped with RSA encryption.

The resulting payload is transmitted to the attacker’s Dropbox account using access tokens linked to Russian Yandex email addresses, further complicating attribution and takedown efforts.

Threat Attribution and Infrastructure

GSC’s investigation identified multiple Yandex and Gmail addresses associated with the campaign, some of which matched LinkedIn profiles-though the authenticity of these identities remains unconfirmed.

The infrastructure analysis revealed continued use of legitimate cloud storage services for C2, as well as VPN providers like NordVPN and AstrillVPN to mask the threat actor’s origin.

Comparative static analysis using tools such as Capa demonstrated that the RoKRAT samples from this campaign closely matched earlier variants, indicating minimal changes to the underlying codebase.

This persistence underscores APT37’s reliance on proven malware modules, augmented by evolving delivery mechanisms and obfuscation strategies.

The fileless nature of these attacks, combined with the abuse of widely trusted cloud platforms, poses significant challenges for conventional security solutions.

Pattern-based detection may fail to recognize such threats, especially when malicious LNK files are embedded within compressed archives.

As a result, endpoint detection and response (EDR) solutions with behavioral analysis and anomaly detection capabilities are critical for identifying and mitigating these attacks.

Proactive threat hunting and continuous monitoring of cloud service interactions are essential components of a robust defense strategy.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates