APT37: Rust Backdoor & Python Loader

**Executive Summary:** This technical analysis documents an APT37 multi-stage campaign that delivers Chinotto (PowerShell backdoor), Rustonotto (Rust C2 agent), and FadeStealer (data-stealer) via malicious Windows shortcut (LNK), CHM help files, and CAB/RAR payloads; the actor uses scheduled tasks, Base64-encoded C2 communication to a PHP backend, and advanced injection techniques (Transacted NTFS / Process Doppelgänging) to persist, surveil (keystrokes, screenshots, audio, device contents), and exfiltrate sensitive files in passworded RAR archives.