The Unintentional Leak: A glimpse into the attack vectors of APT37

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Initial access via CHM and archive-contained decoys used to deliver Chinotto backdoor. “The decoy files are password-protected. The password to open the decoy file is displayed by the CHM file.”
• [T1105] Ingress Tool Transfer – CHM loader downloads a malicious HTA file from the attacker’s server and executes it. “download a malicious HTA file from the attacker’s server and executing it.”
• [T1059.001] PowerShell – The HTA file contains the PowerShell backdoor called Chinotto. “The HTA file contains the PowerShell backdoor called Chinotto.”
• [T1023] LNK – LNK files recovered from GitHub were used to execute MSHTA and download the malicious HTA file. “these LNK files were used to execute MSHTA and download the malicious HTA file from the attacker’s server.”
• [T1059.005] Visual Basic – Macro-based MS Office Word file uses VBA macros to launch MSHTA and download the HTA file. “This macro would launch MSHTA to download the PowerShell-based Chinotto backdoor as well.”
• [T1218.005] Mshta – MSHTA is used to download and execute the HTA payload that hosts the Chinotto backdoor. “Launches MSHTA to download an HTA file from the URL: …”