TF-MAL-apk.chinotto

Description

ThreatFox malware family `apk.chinotto`. Printable name: Chinotto.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• APT37 Targets Windows with Rust Backdoor and Python Loader
  web:community.gurucul.com

  The group leverages a single C2 server to control multiple malware components, including the newly discovered Rustonotto (aka CHILLYCHINO), a Rust-based backdoor active since June 2025; the long-used PowerShell backdoor Chinotto ; and FadeStealer, a surveillance tool that captures keystrokes, screenshots, audio, and removable media activity.

  2026-05-22 01:09 UTC
• APT37 Deploys New Rust and Python Malware Against Windows Systems
  web:cyberpress.org

  The campaign orchestrates three primary malware components through a single command-and-control server: Rustonotto, the newly identified Rust-compiled backdoor active since June 2025; Chinotto , a well-documented PowerShell backdoor operational since 2019; and FadeStealer, a comprehensive surveillance tool first discovered in 2023.

  2026-05-22 01:09 UTC
• Windows under threat from Rustonotto Rust backdoor and Python loader ...
  web:cybersecsentinel.com

  Overview A novel campaign by North Korean-aligned APT37, active since at least 2012, has introduced a Rust-based backdoor named Rustonotto, alongside PowerShell loader Chinotto and data stealer FadeStealer. The infection chain begins with spear-phishing attachments, delivering malware via malicious Windows shortcut files or CHM help files, enabling stealth and persistence on Windows systems .

  2026-05-22 01:09 UTC
• New APT37 Attacking Windows Machines With New Rust and Python Based Malware
  web:cybersecuritynews.com

  APT37, the North Korean-aligned threat actor also known as ScarCruft, Ruby Sleet, and Velvet Chollima, has expanded its arsenal with sophisticated new malware targeting Windows systems. Active since 2012, the group primarily focuses on South Korean individuals connected to the North Korean regime or involved in human rights activism. The threat actor has now introduced a Rust-based backdoor ...

  2026-05-22 01:09 UTC
• APT37 Expands Arsenal with Rustonotto Backdoor, PowerShell Chinotto ...
  web:cybersixt.com

  A new report reveals North Korea's APT37 is using Rust-based malware called Rustonotto, marking a shift toward modern languages and multi-platform attacks.

  2026-05-22 01:09 UTC
• Chinotto (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Chinotto malware family including references, samples and yara signatures.

  2026-05-22 01:09 UTC
• PDF 3-rUTI 2025 Amendment Summaryv3 - auanet.org
  web:www.auanet.org

  The changes below constitute updates made in the 2025 Amendment:

  2026-05-22 01:09 UTC
• Threat Signal Report | FortiGuard Labs
  web:www.fortiguard.com

  FortiGuard Labs is aware of reports of recent activity from APT37. APT37 is a nation-state threat actor attributed to North Korea. The latest discovery by researchers at Kaspersky Labs has revealed a sophisticated, targeted attack that utilizes the stolen credentials from Facebook and email accounts belonging to an associate of the targeted victim.

  2026-05-22 01:09 UTC
• Chinotto: Kaspersky uncovered formerly unknown malware operated by ...
  web:www.kaspersky.co.uk

  In a recent investigation, Kaspersky researchers uncovered a previously unknown malware dubbed Chinotto targeting North Korean defectors and human rights activists. The malware operated by an Advanced Persistent Threat (APT) actor ScarCruft is implemented in PowerShell, Windows executables, and Android apps. It is capable of controlling and exfiltrating sensitive information from its targets ...

  2026-05-22 01:09 UTC
• APT37: Rust Backdoor & Python Loader | ThreatLabz - Zscaler
  web:www.zscaler.com

  In recent campaigns, APT37 utilizes a single command-and-control (C2) server to orchestrate all components of their malware arsenal, including a Rust-based backdoor that ThreatLabz dubbed Rustonotto (also known as CHILLYCHINO), a PowerShell-based malware known as Chinotto , and FadeStealer.

  2026-05-22 01:09 UTC

Only Available for Registered Users. Sign in to view.