APT37, a North Korean state-sponsored group, conducted a spear phishing campaign named 'Operation ToyBox Story' targeting activists focused on North Korea. The attack used emails with Dropbox links to malicious LNK files that deployed RoKRAT malware, which collected system information, screenshots, and exfiltrated data to cloud-based C2 servers. The campaign employed fileless attacks, multiple encryption layers, and used legitimate cloud services for command and control to evade detection. The threat actors impersonated academic events and used decoy documents to lure targets, highlighting the need for advanced endpoint detection and response solutions.
