Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story)

APT37 used Dropbox to spread ZIP files with malicious LNK files that filelessly executed RoKRAT and triggered extra malware with the keyword ‘toy’.