ThreatLabz

This report details APT37’s tactics for distributing the Chinotto PowerShell backdoor across multiple delivery mechanisms — including CHM files, a novel Excel XLL add-in, malicious LNK shortcuts, macro-enabled Office documents, and HWP files with embedded OLE objects — and provides technical analysis, file hashes, and metadata (e.g., VM MAC address, PDB path) useful for detection, attribution, and hunting.