APT37-Linked RokRAT Campaign Used Academic Conference Lures and Cloud C2

A targeted spearphishing campaign dubbed Operation Capsule Vault used genuine materials from a real academic event to lure researchers, policy workers, and academics into opening malware. Victims were sent a Dropbox link to a malicious ISO image containing a PIF executable disguised as a PDF seminar booklet; when opened, it displayed a legitimate decoy document while silently extracting shellcode and launching a multi-stage loader based on EMBED_PAYLOAD_v2.

The shellcode restored and injected a final x64 RokRAT payload into explorer.exe, where it performed system reconnaissance, file collection, and screen-capture functions while communicating with command-and-control infrastructure over Dropbox, pCloud, and Yandex Cloud. Researchers tied the activity to the broader RokRAT cluster through code similarities, reused cloud-C2 patterns, boundary strings, and reused Yandex OAuth-related infrastructure, and assessed the operation as highly likely linked to APT37.