A reported APT37 intrusion chain shows how a familiar brand, a Windows shortcut, and a legitimate cloud service can be stitched into a low-noise control path.