Genians analyzed Operation ToyBox Story, a March 2025 APT37 spear-phishing campaign that targeted activists and experts focused on North Korea. The attackers impersonated a South Korean national security think tank event and a North Korea-focused expert, using Dropbox links to deliver ZIP archives containing malicious LNK files disguised as HWP documents or event materials. Executing the LNK launched hidden PowerShell and BAT stages, created temporary files, loaded XOR-transformed shellcode in memory, and ultimately ran RoKRAT as a fileless payload. RoKRAT collected host details, process information, removable-drive data, and screenshots, then encrypted and attempted to exfiltrate the data through cloud-based C2 services including Dropbox, with references to pCloud and Yandex API patterns. The case matters because it shows APT37 continuing to abuse trusted cloud platforms and fileless LNK execution to evade pattern-based detection.