BITTER APT deploys PapRAT via living-off-the-land chains, LNK and MSI loaders, with new Rust variant
FortiGuard Labs reports a BITTER campaign that mixes native Windows tooling with custom malware to gain and keep access to targeted systems. One of three infection chains abuses ftp.exe, curl, scripts and scheduled tasks without dropping a traditional malware executable, which may reduce visibility for endpoint controls that focus on executables. The other two chains deliver PapRAT through LNK files and MSI installers. PapRAT supports system reconnaissance, file manipulation, secondary payload delivery, screenshot capture and remote command execution. A Rust variant of PapRAT sits alongside the C++ version, which indicates continued investment in BITTER's toolset.
Detalhes técnicos
- Chain 1: fileless-style execution using ftp.exe, curl, scripts and scheduled tasks.
- Chains 2 and 3: PapRAT delivered via LNK files and MSI installers. The article also mentions URL shortcuts and disk images as lures to treat with caution.
- The Rust PapRAT variant extends the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command.
- Related payloads named in the detections: SectopRAT (fileless) and WmRAT, along with DLL and DB files.
- FortiGuard AV signatures: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr, W32/WmRAT.A!tr.
- Infrastructure includes netmansrvdns[.]com, rappellingaart[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, goodnfortunes[.]com, felixfuturenext[.]com and gomescareerplans[.]com.
Remediação
- Treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages.
- Monitor scripting tools, scheduled task creation and installer activity, not only known malware signatures.
- Detect suspicious execution chains and outbound C2 traffic.
- Block the listed domains and URLs and hunt for the listed hashes.
- Fortinet states that FortiGuard Web Filtering and AntiVirus already cover the campaign URLs and payloads.
Linha do tempo
-
BITTER APT deploys PapRAT via living-off-the-land chains, LNK and MSI loaders, with new Rust variant
ler a análise desta fonte ocultar
FortiGuard Labs reports a BITTER campaign that mixes native Windows tooling with custom malware to gain and keep access to targeted systems. One of three infection chains abuses ftp.exe, curl, scripts and scheduled tasks without dropping a traditional malware executable, which may reduce visibility for endpoint controls that focus on executables. The other two chains deliver PapRAT through LNK files and MSI installers. PapRAT supports system reconnaissance, file manipulation, secondary payload delivery, screenshot capture and remote command execution. A Rust variant of PapRAT sits alongside the C++ version, which indicates continued investment in BITTER's toolset.
Technical Details
- Chain 1: fileless-style execution using ftp.exe, curl, scripts and scheduled tasks.
- Chains 2 and 3: PapRAT delivered via LNK files and MSI installers. The article also mentions URL shortcuts and disk images as lures to treat with caution.
- The Rust PapRAT variant extends the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command.
- Related payloads named in the detections: SectopRAT (fileless) and WmRAT, along with DLL and DB files.
- FortiGuard AV signatures: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr, W32/WmRAT.A!tr.
- Infrastructure includes netmansrvdns[.]com, rappellingaart[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, goodnfortunes[.]com, felixfuturenext[.]com and gomescareerplans[.]com.
Remediation
- Treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages.
- Monitor scripting tools, scheduled task creation and installer activity, not only known malware signatures.
- Detect suspicious execution chains and outbound C2 traffic.
- Block the listed domains and URLs and hunt for the listed hashes.
- Fortinet states that FortiGuard Web Filtering and AntiVirus already cover the campaign URLs and payloads.