APT37 likely used spearphishing emails impersonating a real academic conference to deliver an ISO containing a PDF-disguised PIF loader. The EMBED_PAYLOAD_v2 loader displayed a legitimate decoy document while decoding shellcode and injecting an x64 RokRAT variant into explorer.exe. RokRAT collected host and document data, executed commands, captured screens, and used pCloud, Dropbox, and Yandex for resilient cloud-based command and control. Reused Yandex credentials, infrastructure, implementation details, and strong code similarity to Operation Artemis support the APT37 attribution.