The Spy Group Hiding Their Orders Inside a Dropbox Folder

In March 2025, a North Korean spy crew emailed activists a poster, the download link pointed to Dropbox, and so did every secret command their malware would ever receive.

Is it??

There is an old piece of spy tradecraft called the dead drop.

You never meet your contact. Instead, you agree on a hiding spot, a loose brick in a wall, or a gap behind a park bench. One person leaves a package, and later, the other person picks it up. Nobody is ever seen together. There is no risky handoff to photograph, and no meeting to wiretap. It is just an ordinary wall that two strangers happen to use.

In March 2025, a North Korean spy group rebuilt that exact trick on the internet. Their hiding spot wasn’t a brick; it was a Dropbox folder, the exact same kind of free cloud storage millions of people use every day to share files.

Their malware would quietly open that folder, read the orders waiting inside, execute them, and leave the stolen files behind for its handlers to collect. There was no suspicious server of their own, and no strange address for a security team to block.

It was just a normal-looking app that everyone already trusts.

The campaign is known as Operation ToyBox Story, the malware is called RokRAT, and the group behind it has been playing this game patiently for years.

Why This Campaign Matters

Most people picture hacking as a dramatic digital break-in. The reality is far quieter, and far more clever.

The hardest attacks to stop are the ones that don’t look like attacks at all. When malware phones home to a shady, unknown server in a far-off country, defenders can easily spot that strange address and slam the door.

But when malware talks directly to Dropbox, a service the company’s own employees use all day, there is no obvious door to slam. The network traffic looks completely normal.

Security researchers call this tactic Living off Trusted Sites (LoTS). Instead of bringing their own infrastructure, attackers borrow the stellar reputation of services we all rely on.

The best hiding place isn’t the darkest corner. It’s the one spot nobody bothers to look, because it looks like it belongs to everybody.

Who Is APT37?

APT37 is a cyber-espionage hacking group widely linked to North Korea. Depending on the security firm, you will also see them tracked under a few different nicknames:

• ScarCruft
• Reaper
• Group123

APT37’s primary job is espionage, not financial extortion. They target individuals who matter directly to North Korea’s strategic interests: journalists, defectors, defense researchers, and — in this campaign — activists in South Korea who focus on North Korean affairs.

Their goal is to silently watch, listen, and steal intelligence.

Their signature tool, RokRAT, is a highly sophisticated RAT (Remote Access Trojan). Think of it as a hidden remote control secretly installed on your computer, letting an adversary far away see your screen, run commands, and copy your files without your knowledge.

The Lure: A Link You’d Click

Real cyber attacks rarely start with exotic technical weapons; they start with a boring email you were already expecting. In Operation ToyBox Story, researchers at Genians documented two specific target waves in March 2025:

• March 8 Wave: An email addressed to a North Korea expert carrying a document titled “To North Korean Soldiers Deployed to the Russian Battlefield.” It was topical, emotional, and exactly what the target studied.
• March 11 Wave: An invitation to a national-security think-tank event titled “Trump 2.0 Era: Prospects and South Korea’s Response,” arriving inside an archive called “Related Poster.zip.”

To dodge traditional defenses, the emails didn’t carry the malware as a direct attachment — attachments get scanned and flagged. Instead, they carried a download link dressed up with a familiar Naver Mail icon (South Korea’s giant web portal).

The link led directly to Dropbox. To the victim, it looked like a colleague had simply shared a file the normal way. Inside the downloaded archive was a shortcut file (a .lnk file). While a shortcut looks harmless, it can be quietly rigged to run hidden command strings the moment you double-click it.

The Infection Chain: A Ghost in Memory

When the victim double-clicks the shortcut, a carefully staged sequence unfolds in the background:

[User Clicks Shortcut]
          │
          ▼
┌──────────────────────────┐
│ Decoy Document Opens     │ ──► Keeps user distracted and unaware
└──────────────────────────┘
          │
          ▼
┌──────────────────────────┐
│ Hidden Files Dropped     │ ──► toy03.bat, toy02.dat, toy01.dat placed in %Temp%
└──────────────────────────┘
          │
          ▼
┌──────────────────────────┐
│ In-Memory Execution      │ ──► Decrypted shellcode assembles RokRAT directly
└──────────────────────────┘     in RAM; no malware binary touches the disk

Most antivirus tools work like a guard checking IDs at the entry gate: they inspect files as they land on the hard drive. Because RokRAT is stitched together directly in the computer’s memory, it acts like a ghost assembled from scattered parts. It leaves almost nothing on the drive for an antivirus scanner to find, technique known as a fileless attack.

For the Technical Reader:

The execution loader applies a simple XOR decryption to toy01.dat and spawns a thread to run the resulting shellcode. This shellcode in turn XOR-decrypts an embedded Portable Executable (PE) and launches RokRAT entirely in-memory. No RokRAT binary is ever written to disk.

The Backdoor: Dropbox as a Command Center

Dropbox

Once RokRAT is active in memory, it needs orders. This is where the digital dead drop functions.

Instead of connecting to a server owned by the hackers, RokRAT logs into a legitimate Dropbox account using an embedded access token (a hardcoded, pre-saved password string). From there, it speaks Dropbox’s own standard API language to execute commands:

• **/files/list_folder** — Checks the directory to see what new orders are waiting.
• **/files/download** — Picks up new operational instructions or secondary tools.
• **/files/upload** — Drops off stolen files and automated desktop screenshots.
• **/files/delete** — Deletes the files afterward to clean up its operational track.

A standard cloud backup application does the exact same four things. To an enterprise security tool watching network traffic, RokRAT checking in for orders is completely indistinguishable from an employee syncing their daily files.

The forensic investigation also revealed a small human detail: the malicious Dropbox tokens were tied to throwaway Yandex email accounts (a major Russian internet service) using fake, Western-sounding names like *rolf.gehrung@yandex.com*. It represents three layers of borrowed flags used to run a single North Korean operation.

What RokRAT Steals

Once it is securely settled in and listening to its Dropbox mailbox, RokRAT possesses a devastating array of spy capabilities:

• Machine Fingerprinting: Collects the computer name, active username, Windows OS version, system architecture, and hardware model.
• Screen Surveillance: Quietly captures real-time screenshots and saves them as temporary local files before exfiltrating them.
• Arbitrary Execution: Executes any command sent down by its handlers and can pull down secondary payloads masquerading as harmless system updates (e.g., KB400928_doc.exe).
• Data Scrambling: Before any stolen data leaves the computer, it is scrambled twice — first with a simple throwaway key, and then with robust AES encryption. Even if the network traffic is intercepted mid-flight, defenders see meaningless cryptographic noise rather than stolen documents.

Why Hiding Inside Cloud Apps Works

The underlying defensive evasion strategy is incredibly effective:

• No Malicious Domains to Block: Completely banning dropbox.com would break critical business operations for the entire company. Therefore, the traffic is permitted, and the malware rides along safely.
• Default Encryption: Dropbox encrypts traffic using standard HTTPS. The contents of the commands are sealed inside normal secure web traffic, hiding them from network deep-packet inspection.
• Borrowed Trust: Security filters implicitly trust high-reputation cloud applications because billions of legitimate files flow through them daily.
• Disposable Infrastructure: Infrastructure management becomes trivial. If an enterprise security team manages to identify and burn one Dropbox account, the threat actors simply spin up a new free account in minutes.

What Defenders Must Do

When blocking bad IP addresses or domain names no longer works, the defensive focus must shift from “where is this program connecting?” to “does this process behavior make contextual sense?”

• Audit API Context Over Destinations: An innocent user opening a newsletter file should never cause an underlying process to quietly interact with Dropbox’s developer programming interface (api.dropboxapi.com) in the background. The destination is trusted, but the context is highly anomalous.
• Restrict Untrusted Shortcut Execution: Treat inbound .lnk shortcut files received from external internet sources with extreme suspicion. A newsletter or poster should be a flat PDF or image file, not an executable shortcut script.
• Inspect Link-Based File Delivery: Attackers have deliberately pivoted to utilizing download links rather than attachments to completely bypass traditional email gateway scanners.
• Monitor Process Memory Anomalies: Implement behavioral endpoint detection tools capable of spotting fileless code injection and abnormal threads running entirely inside system memory spaces.

Indicators of Compromise (IOCs)

⚠️ Defender Note: Verify All Values

Before implementing these indicators in active production blocks, verify all values against the original source intelligence. The source report provides MD5 hashes only; SHA-256 values are not provided.

Campaign & Environment Artifacts:

• Campaign: Operation ToyBox Story — APT37 / ScarCruft Espionage (March 2025)
• Dropped Files: toy03.bat, toy02.dat, toy01.dat — Located inside the %Temp% directory; handles the loader and encrypted stages
• Malicious Shortcut: hkais_1e9ce53a18e24ebc01b539ba7ba6bedd.lnk — Weaponized Case B “poster” shortcut trap
• Received Payload: KB400928_doc.exe — Secondary payload fetched from Dropbox, masquerading as an innocent Windows Update
• Artifact: .tmp JPEG files — Temporary local desktop screenshots stored in %Temp% before active exfiltration

Command & Control (C2) Networks:

• C2 Infrastructure:
• api.dropboxapi[.]com
• content.dropboxapi[.]com
• Operational Detail: Network nodes utilized by the malware for list_folder, upload, download, and delete actions.
• C2 IP Addresses:
• 89.147.101[.]65
• 89.147.101[.]71
• 37.120.210[.]2
• Operational Detail: Threat infrastructure nodes actively noted per Genians tracking records.

Data Marker: 0xFADEADBA — Hardcoded 4-byte signature prefix appended to all encrypted exfiltrated data packets

Compromised Accounts & Access Tokens:

• Dropbox Token A:
• qpIH7aCNxGUAAAAAAAAAAbvHIsHbphV6aB6THhpP-8t30a_TXE14lh4kLBHEl6Cp
• (Hardcoded C2 access token embedded directly into the malware core)
• Dropbox Token B:
• 2SufkFqeegMAAAAAAAAAAXBHNzzqhiDRu4wvncLkI7VIkC8Zd3YkJWlqZbpL8afr
• (Hardcoded C2 access token embedded directly into the malware core)
• Linked Handler Accounts:
• rolf.gehrung@yandex.com
• ekta.sahasi@yandex.com
• Operational Detail: Fraudulent Yandex email addresses tied explicitly to the generation of the active API tokens.

Malicious File Hashes (MD5):

• Sample Hash 1: 81c08366ea7fc0f933f368b120104384 — Malicious binary sample (verify full set directly from source report)
• Sample Hash 2: 723f80d1843315717bc56e9e58e89be5 — Malicious binary sample (verify full set directly from source report)

References & Further Reading

• Genians Security Center — Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation ToyBox Story).
• The Hacker News — ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics (September 2025).
• Security Affairs — North Korea’s APT37 deploys RokRAT in new phishing campaign against academics (2025).
• Historical Context: Prior tracked RokRAT campaigns show systematic abuse of alternative cloud service providers, including pCloud and Yandex Cloud infrastructure, for stealth command-and-control communication (Multiple Vendors, 2023–2024).

📈 Master the art of modern threat hunting.

Generic security training fails when advanced persistence relies on trusted, legitimate architecture. I drop regular, highly actionable case studies peeling back the curtain on sophisticated state-sponsored evasion campaigns.

To ensure you never miss a playbook breakdown:

• Follow my profile on Medium for immediate alerts on new posts.
• Subscribe to email updates by clicking the little envelope icon (✉️) next to the follow button so my latest technical deep dives land straight in your inbox.

Thank you for reading. This article was written by Pop123. If you found this breakdown of modern behavioral defense valuable, consider following my profile here on Medium. I write regularly about active threat intel, defense evasion mechanics, and practical engineering strategies for modern security teams.

Let’s connect — leave your thoughts, claps, or mitigation questions in the responses below!