APT37 Deploys New Rust and Python Malware Targeting Windows Systems

According to GBHackers On Security, the North Korean-aligned threat group APT37, also known as ScarCruft, Ruby Sleet, and Velvet Chollima, has evolved its cyber warfare capabilities by deploying Rust and Python-based malware targeting Windows systems.

The campaign features Rustonotto, a newly identified Rust-based backdoor active since June 2025, which executes Windows commands and transmits results to attacker-controlled infrastructure, alongside Chinotto, a PowerShell backdoor in use since 2019, and FadeStealer, a multi‑vector surveillance tool first discovered in 2023.

FadeStealer can log keystrokes, capture screenshots, record audio, monitor devices, and exfiltrate data via password-protected RAR archives, with communications to C2 servers using HTTP POST requests and Base64 encoding. The infection chain leverages Windows shortcut files and CHM files for initial compromise, followed by PowerShell payloads, with TxF-based code injection described as a notable evasion technique.

The Python-based component uses Process Doppelgänging to decrypt and inject FadeStealer into legitimate Windows processes, while targets include random selections of calc.exe, msinfo32.exe, and svchost.exe to maintain operational security.