APT37 Leverages Malicious LNK Files and Dropbox for C2 Infrastructure

APT37 conducted a targeted spear-phishing campaign (Operation:ToyBox Story) using Dropbox-hosted ZIP archives containing malicious LNK files that trigger fileless PowerShell/batch loaders to deploy RoKRAT. The campaign leveraged trusted cloud services and VPNs to hide C2, executed in-memory shellcode, and used multi-layer encryption to exfiltrate sensitive system data and screenshots; the report includes MD5 hashes, C2 IPs, and multiple email addresses as IOCs.