EN PT-BR
← Voltar ao feed
high government energy engineering

BITTER (TA397) APT usa três cadeias de ataque com LNK, MSI e VHDX para instalar PapRAT e WmRAT na Ásia do Sul

4 fonte(s) · 4 atualização(ões) · publicado 02/11/2026 11:00 · coletado há 13 horas

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 03/11/2026 00:06; os links antigos trazem para cá.

Fontes: hackread.com ↗ infosecurity-magazine.com ↗ feeds.fortinet.com ↗ darkreading.com ↗

Em 2 de novembro de 2026, a Fortinet FortiGuard Labs (pesquisadora Cara Lin) detalhou uma campanha de espionagem de vários meses atribuída com alta confiança ao BITTER (TA397), com base em nomes de iscas, padrões de C2, metadados de arquivos e análise do malware (infosecurity-magazine.com). Os alvos são principalmente organizações da Ásia do Sul, em especial governo, energia e engenharia (hackread.com). A telemetria também mostra atividade no Sudeste Asiático e na Coreia do Sul (infosecurity-magazine.com). A campanha não explora vulnerabilidades de software. Ela usa engenharia social e ferramentas nativas do Windows (living off the land) em três cadeias de infecção, para entregar o RAT personalizado PapRAT e, em uma cadeia, o WmRAT. As iscas têm temática diplomática e militar, como uma carta de embaixador sobre a 11ª Cúpula do Belt and Road, um pedido de reunião bilateral e um convite para jantar de gala em 2026. Existem versões do PapRAT em C++ e em Rust, o que indica investimento contínuo no arsenal do grupo (feeds.fortinet.com).

Detalhes técnicos

  • Cadeia 1 (living off the land): atalhos LNK com temas diplomáticos e militares usam o ftp.exe nativo para executar um script disfarçado de arquivo de ícone. Esse script cria tarefas agendadas que usam curl e PowerShell para buscar novos comandos nos servidores do atacante (hackread.com, infosecurity-magazine.com). O script coleta informações do sistema e do antivírus e as envia ao C2 em um arquivo chamado abc.pdf. Uma mensagem de erro falsa do Windows distrai a vítima (hackread.com). Não foi encontrado binário de malware nem PapRAT nessa cadeia, então os operadores podem mudar as instruções pelo servidor. Como só há processos confiáveis do sistema, controles baseados em assinatura têm pouco a alertar (infosecurity-magazine.com, feeds.fortinet.com).
  • Cadeia 2: uma imagem VHDX, "Letter from the Ambassador – 11th Belt and Road Summit.vhdx", expõe um atalho que abre uma planilha isca e executa em silêncio o instalador MSI Visa_Details.msi. O MSI instala o PapRAT disfarçado de software da Microsoft (hackread.com, infosecurity-magazine.com).
  • Cadeia 3: um arquivo RAR contém um atalho de internet (URL) que busca um LNK via WebDAV. O LNK executa Imp_Details.msi e instala o PapRAT, que então baixa o WmRAT, disfarçado de vnces.exe, que contata netmansrvdns.com (hackread.com). O WmRAT é um RAT em C++ documentado antes por outros pesquisadores, e a FortiGuard o cita como elo adicional com o Bitter (infosecurity-magazine.com).
  • PapRAT em C++: apresenta-se como componente da Microsoft, faz beacon em HTTP simples e aceita oito comandos, entre eles shell remoto, transferência, exclusão e listagem de arquivos e diretórios, e captura de tela. A configuração de C2 é codificada em XOR com a chave 0x50 (infosecurity-magazine.com, hackread.com).
  • PapRAT em Rust: versão mais recente que migra para HTTPS e amplia os comandos de oito para onze, com execução de PowerShell, sleep/pausa e saída limpa. Ela inverte e desloca strings em .rdata com ROT-3, espera 42 segundos antes de iniciar e depois faz beacon a cada cinco segundos (hackread.com, feeds.fortinet.com, infosecurity-magazine.com).
  • Artefatos de atribuição: o nome de produto "papsolutions" e o arquivo PDB "requpap.pdb" (hackread.com).
  • Cargas relacionadas citadas nas detecções: SectopRAT (fileless), WmRAT, além de arquivos DLL e DB (feeds.fortinet.com).
  • Assinaturas FortiGuard AV: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr e W32/WmRAT.A!tr (feeds.fortinet.com).
  • Infraestrutura: netmansrvdns[.]com, rappellingaart[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, goodnfortunes[.]com, felixfuturenext[.]com e gomescareerplans[.]com (feeds.fortinet.com).

Remediação

  • Trate com cautela LNK, atalhos de internet, imagens de disco (VHDX) e pacotes MSI inesperados, sobretudo quando chegam por mensagens não solicitadas (feeds.fortinet.com, infosecurity-magazine.com).
  • Monitore tarefas agendadas, ferramentas de script (PowerShell, curl, ftp.exe) e atividade de instaladores MSI, além das assinaturas de antivírus (hackread.com, feeds.fortinet.com).
  • Detecte cadeias de execução suspeitas e tráfego de C2 de saída. Bloqueie os domínios e URLs listados e procure pelos hashes publicados pela Fortinet (feeds.fortinet.com).
  • Aplique privilégio mínimo, restrinja os mecanismos nativos de script e remova privilégios administrativos permanentes, conforme a Keeper Security (hackread.com, infosecurity-magazine.com).
  • Procure as tarefas agendadas e o abuso de curl/ftp.exe, e não só o implante. Remover o primeiro implante encontrado pode não expulsar o atacante (infosecurity-magazine.com).
  • A Fortinet afirma que o FortiGuard Web Filtering e o AntiVirus já cobrem as URLs e cargas da campanha (feeds.fortinet.com).

Relatos divergentes

  • Descrição do grupo: o darkreading.com chama o BITTER de grupo vinculado à Índia. O infosecurity-magazine.com o descreve como grupo suspeito do sul da Ásia, e o hackread.com diz que ele atua desde pelo menos 2013. Nenhuma fonte traz a atribuição da própria Fortinet a um país. O darkreading.com é apenas manchete e não traz detalhes de apoio.
  • Comandos da variante Rust: o infosecurity-magazine.com cita os três novos comandos como execução de PowerShell, pausa e saída. O hackread.com e o feeds.fortinet.com falam em sleep e saída limpa. Provavelmente é diferença de redação, e os três comandos coincidem em função.
  • Escopo geográfico: apenas o infosecurity-magazine.com menciona Sudeste Asiático e Coreia do Sul, e apenas o hackread.com lista os setores de governo, energia e engenharia.

Linha do tempo

  1. hackread.com ↗ · pub. 02/11/2026 11:01 · coletado 02/11 12:01

    BITTER APT uses fake diplomatic lures and living-off-the-land tradecraft to deploy PapRAT and WmRAT in South Asia

    ler a análise desta fonte

    Fortinet FortiGuard Labs detailed a cyberespionage campaign against government, energy and engineering organizations in South Asia, attributed with high confidence to BITTER APT, a suspected South Asian group active since at least 2013. The actors deliver a custom RAT, PapRAT, to Windows systems through three infection chains that rely on deception and living-off-the-land (LotL) techniques rather than software vulnerabilities. Lures are themed around diplomatic and military topics, such as a fake letter from an ambassador about the 11th Belt and Road Summit. PapRAT supports remote command execution, file transfer and deletion, directory and drive listing, and screenshot capture. In one chain it also pulls down a second implant, WmRAT.

    Technical Details

    • Chain 1: diplomatic- and military-themed LNK shortcuts launch a script disguised as an icon file through ftp.exe, using curl, PowerShell and scheduled tasks. The script collects system and antivirus information and sends it to the C2 in a file named abc.pdf. A fake Windows error message distracts the victim.
    • Chain 2: a VHDX image, "Letter from the Ambassador – 11th Belt and Road Summit.vhdx", exposes a shortcut that opens a decoy spreadsheet while silently running the MSI installer Visa_Details.msi, which deploys PapRAT disguised as Microsoft software.
    • Chain 3: a RAR archive contains a URL shortcut that fetches an LNK via WebDAV, which launches Imp_Details.msi and deploys PapRAT. PapRAT then downloads WmRAT, disguised as vnces.exe, which contacts netmansrvdns.com.
    • Attribution artifacts: build artifacts include the product name "papsolutions" and the PDB filename "requpap.pdb".
    • Variants: C++ and Rust versions exist. The C++ sample's C2 configuration is XOR-encoded with key 0x50. The Rust version reverses and ROT-3-shifts strings in .rdata, extends the command set from eight to eleven (PowerShell execution, sleep, clean exit), waits 42 seconds before starting and then beacons every five seconds.

    Remediation

    • Monitor scheduled tasks, scripting tools (PowerShell, curl, ftp.exe) and MSI installer activity alongside signature-based AV.
    • Enforce least-privilege access, restrict native scripting engines and remove standing administrative rights (advice from Keeper Security's CISO, Shane Barney).
  2. infosecurity-magazine.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:01

    Bitter (TA397) deploys PapRAT and WmRAT via LNK, MSI and VHDX chains against South Asian organizations

    ler a análise desta fonte

    Fortinet FortiGuard Labs (Cara Lin) attributes with high confidence a multi-month cyber-espionage campaign to Bitter (TA397), a suspected South Asian group, based on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses native Windows tools together with a custom RAT, PapRAT, to maintain access. Targets are mainly South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea. Lures referenced a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

    Technical Details

    • Chain 1 (living off the land): a malicious LNK file abuses the built-in ftp.exe to run scripts and create scheduled tasks. The tasks use curl to fetch fresh commands from attacker servers. No malware binary and no PapRAT were found, so operators can change instructions server-side.
    • Chains 2 and 3: PapRAT is delivered via MSI packages, one hidden with a decoy spreadsheet inside a VHDX image and the other fetched through an internet shortcut in a RAR archive.
    • PapRAT C++ build: poses as a Microsoft component, beacons over plaintext HTTP and supports eight commands, including remote shell, file transfer and screenshots.
    • PapRAT Rust variant: a more recent build that switches to HTTPS and adds three commands (PowerShell execution, pause, exit).
    • In the third chain PapRAT downloads WmRAT, a C++ RAT documented previously by other researchers, which FortiGuard cites as an additional link to Bitter.
    • Because chain 1 uses trusted system processes, signature-based controls have little to alert on, and hunting for PapRAT alone could miss part of the campaign.

    Remediation

    • Handle unexpected LNK files, internet shortcuts, disk images and MSI installers with care (FortiGuard).
    • Apply least-privilege access, tighter limits on native scripting engines and removal of standing administrative rights (Keeper Security comment).
    • Hunt for the scheduled tasks and curl/ftp.exe abuse, not only the implant, since removing the first implant found may not evict the attacker.
  3. feeds.fortinet.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:00

    BITTER APT deploys PapRAT via living-off-the-land chains, LNK and MSI loaders, with new Rust variant

    ler a análise desta fonte

    FortiGuard Labs reports a BITTER campaign that mixes native Windows tooling with custom malware to gain and keep access to targeted systems. One of three infection chains abuses ftp.exe, curl, scripts and scheduled tasks without dropping a traditional malware executable, which may reduce visibility for endpoint controls that focus on executables. The other two chains deliver PapRAT through LNK files and MSI installers. PapRAT supports system reconnaissance, file manipulation, secondary payload delivery, screenshot capture and remote command execution. A Rust variant of PapRAT sits alongside the C++ version, which indicates continued investment in BITTER's toolset.

    Technical Details

    • Chain 1: fileless-style execution using ftp.exe, curl, scripts and scheduled tasks.
    • Chains 2 and 3: PapRAT delivered via LNK files and MSI installers. The article also mentions URL shortcuts and disk images as lures to treat with caution.
    • The Rust PapRAT variant extends the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command.
    • Related payloads named in the detections: SectopRAT (fileless) and WmRAT, along with DLL and DB files.
    • FortiGuard AV signatures: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr, W32/WmRAT.A!tr.
    • Infrastructure includes netmansrvdns[.]com, rappellingaart[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, goodnfortunes[.]com, felixfuturenext[.]com and gomescareerplans[.]com.

    Remediation

    • Treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages.
    • Monitor scripting tools, scheduled task creation and installer activity, not only known malware signatures.
    • Detect suspicious execution chains and outbound C2 traffic.
    • Block the listed domains and URLs and hunt for the listed hashes.
    • Fortinet states that FortiGuard Web Filtering and AntiVirus already cover the campaign URLs and payloads.
  4. darkreading.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:00 primeiro registro só resumo do feed

    India-linked BITTER group runs PapRAT cyberespionage campaign against South Asian organizations via three attack chains

    ler a análise desta fonte

    The India-linked threat group BITTER is running a cyberespionage campaign against organizations in South Asia, delivering a malware family tracked as PapRAT. According to the report, the operators abuse legitimate Windows functionality across three distinct attack chains. The source article is only a headline and standfirst, so it gives no detail on victims, infrastructure, indicators or vulnerabilities.

    Technical Details

    • Attribution: BITTER, described as a known India-linked threat group.
    • Malware: PapRAT.
    • Tradecraft: three separate attack chains that use legitimate Windows functionality (living off the land). The article excerpt does not name the specific features or binaries.