This technique, known as “Living off Trusted Sites” (LoTS), enables the attackers to bypass security controls by utilizing legitimate cloud services as command and control (C2) infrastructure, making malicious traffic difficult to distinguish from legitimate business communications. “This threat actor demonstrates advanced operational security by purposely breaking up file extensions during runtime execution to avoid pattern-based detection,” noted the Genians threat intelligence team. Their researchers discovered that APT37 has evolved its tactics from previous campaigns but maintained core components like the RoKRAT malware family, which has been continually deployed with minimal code changes to maximize operational effectiveness while evading detection. The malicious campaign leverages Dropbox links embedded within these emails, leading victims to download compressed archives containing shortcuts (LNK files) that execute fileless malware. Genians Security Center (GSC) identified and analyzed this campaign, naming it “Operation: ToyBox Story” based on distinctive keywords found in the malware. Security experts are particularly concerned about this campaign’s targeting of individuals working on North Korean issues, suggesting potential intelligence gathering objectives related to South Korean national security strategies. In March 2025, a sophisticated spear phishing campaign attributed to the North Korean state-sponsored hacking group APT37 has been targeting activists focused on North Korean affairs. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Genians researchers identified that these shortcuts contain embedded PowerShell commands designed to extract and execute multiple components while displaying a decoy document to the victim. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The analysis of the embedded shellcode reveals how the malware transforms data using XOR logic to load encrypted payloads into memory. The continued use of cloud services as C2 infrastructure by APT37 highlights the growing challenge of distinguishing malicious from legitimate traffic in modern network environments.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 13 May 2025 11:55:06 +0000