North Korean-aligned threat actor APT37 — also tracked as ScarCruft, Ruby Sleet, and Velvet Chollima — has expanded its malware arsenal with a newly identified Rust-based backdoor, in campaigns dissected by Zscaler ThreatLabz. The research, conducted in collaboration with the Korea National Police Agency (KNPA), reveals a consolidated C2 architecture orchestrating three distinct implants against South Korean individuals engaged in North Korea-related academia, human rights activism, and political research.
A New Rust Implant Enters the Toolkit
ThreatLabz named the newly identified backdoor Rustonotto (also known as CHILLYCHINO) — active since June 2025 and the first known instance of APT37 leveraging the Rust programming language to target Windows systems. Despite its relative simplicity — receiving Base64-encoded Windows commands via HTTP GET with a U= parameter and returning results via R= — Rustonotto's use of Rust signals the group's interest in modern, memory-safe languages that could eventually support cross-platform deployment.
In one observed campaign, a Windows shortcut file (MD5: b9900bef33c6cc9911a5cd7eeda8e093) invokes a PowerShell script that extracts two hex-encoded payloads using the markers AEL, BEL, and EOF. The first payload drops a decoy Hangul Word Processor (HWP) document titled "Two Perspectives on North Korea in South Korean Society" (last modified June 11, 2025), while the second writes Rustonotto to disk and establishes persistence via a scheduled task named MicrosoftUpdate configured to execute every five minutes.
CHM Delivery and Chinotto Backdoor
A parallel campaign delivered malware via a Windows Compiled HTML Help (CHM) file disguised as a password document for a job-description ZIP archive targeting KT Group applicants. When opened, the CHM writes a Run key registry value that fetches a malicious HTML Application (HTA) file from the threat actor's server on every user logon. The HTA delivers Chinotto — a well-documented PowerShell backdoor in use since 2019 — which connects to the same C2 infrastructure as Rustonotto.
Chinotto creates a unique victim identifier by combining the computer name and username, polls the C2 every five seconds via HTTP POST (U=[victim ID]), and supports a rich command set including:
- FINFO / DIRUP / SFILE: File and directory enumeration and exfiltration.
- DOWNF / CURLC: Remote file download via HTTP or curl.
- REGED / TASKA: Registry modification and scheduled task creation for persistence.
- ZIPEX / RENAM / DELET: Archive extraction, file renaming, and deletion.
An execution marker in the TEMP directory prevents duplicate execution on the same host. All command results are Base64-encoded before transmission back to the C2 via the R= parameter.
FadeStealer: Surveillance via Process Doppelganging
Following initial compromise via Chinotto, APT37 deployed FadeStealer — a surveillance implant first identified in 2023 — through a Python-based loader implementing the Process Doppelganging code injection technique, using Transactional NTFS (TxF) to stealthily inject malicious code without writing a conventional executable to disk. FadeStealer logs keystrokes, captures screenshots and audio, monitors connected devices and removable media, and exfiltrates collected data via HTTP POST in password-protected RAR archives with Base64 encoding.
The payloads were packaged in Microsoft Cabinet (.CAB) files with embedded Python launchers — a tradecraft evolution that keeps the stealer deployment chain off conventional file-based detection paths.
Single C2, Full Arsenal
A notable operational detail: all three implants — Rustonotto, Chinotto, and FadeStealer — communicate with a single C2 server, a consolidation that simplifies APT37's infrastructure management but also creates a single pivot point for defenders. ThreatLabz collaborated with S2W, whose concurrent research documented APT37's use of PubNub-based communication malware and VCD ransomware deployment in related campaigns, reinforcing the breadth of the group's active operational tempo in 2025.