{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/winnti/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["APT41","Wicked Panda","BARIUM","Brass Typhoon","Winnti","Double Dragon"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["living-off-the-land","defense-evasion","windows","endpoint"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe Microsoft HTML Help application (hh.exe) is a legitimate system binary that can be abused by attackers to perform unauthorized actions. By invoking the decompile parameter, an attacker can extract the contents of a Compiled HTML Help (.chm) file to a specified directory. This technique, documented as T1218.001, is often used as a proxy for execution or to unpack malicious payloads staged within seemingly benign help files. APT41 and other actors have historically utilized this mechanism to evade detection by leveraging a trusted, signed Windows binary to facilitate the delivery of secondary malware or configuration files. Defenders should prioritize monitoring for the infrequent use of the decompile switch in their endpoint environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts or obtains a malicious CHM file containing secondary payloads or scripts.\u003c/li\u003e\n\u003cli\u003eThe malicious file is delivered to the target host via phishing or web download.\u003c/li\u003e\n\u003cli\u003eThe attacker executes hh.exe via a command-line interface or script.\u003c/li\u003e\n\u003cli\u003eThe command utilizes the -decompile flag: hh.exe -decompile \u0026lt;output_dir\u0026gt; \u0026lt;chm_file\u0026gt;.\u003c/li\u003e\n\u003cli\u003eThe contents of the CHM are extracted to the filesystem.\u003c/li\u003e\n\u003cli\u003eThe extracted payloads, often scripts or binaries, are executed to achieve the primary goal, such as establishing C2 or persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of this technique can allow attackers to bypass security restrictions by using a trusted system utility to drop malicious files. This facilitates further system compromise, persistence, and potential data exfiltration. While specific victim counts are not cited in current reports, the technique is a known component in the toolsets of advanced persistent threat groups.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy detection coverage for the command-line usage of hh.exe with the decompile parameter.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement the provided Sigma rule to alert on suspicious process creation events.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon or EDR process-creation logging to capture full command-line arguments.\u003c/li\u003e\n\u003cli\u003eAudit the use of CHM files within the environment to identify unexpected help file execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:24:40Z","date_published":"2026-10-12T18:24:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hh-decompile-abuse/","summary":"Threat actors, including APT41, abuse the native Windows HTML Help application (hh.exe) to decompile CHM files for staging malicious payloads or bypassing security controls.","title":"Abuse of Compiled HTML Help Application for Decompilation","url":"https://feed.craftedsignal.io/briefs/2026-10-hh-decompile-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - Winnti","version":"https://jsonfeed.org/version/1.1"}