EN PT-BR
← Voltar ao feed
high government energy engineering

BITTER APT uses fake diplomatic lures and living-off-the-land tradecraft to deploy PapRAT and WmRAT in South Asia

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 11:01 · coletado há 1 hora

Fortinet FortiGuard Labs detailed a cyberespionage campaign against government, energy and engineering organizations in South Asia, attributed with high confidence to BITTER APT, a suspected South Asian group active since at least 2013. The actors deliver a custom RAT, PapRAT, to Windows systems through three infection chains that rely on deception and living-off-the-land (LotL) techniques rather than software vulnerabilities. Lures are themed around diplomatic and military topics, such as a fake letter from an ambassador about the 11th Belt and Road Summit. PapRAT supports remote command execution, file transfer and deletion, directory and drive listing, and screenshot capture. In one chain it also pulls down a second implant, WmRAT.

Detalhes técnicos

  • Chain 1: diplomatic- and military-themed LNK shortcuts launch a script disguised as an icon file through ftp.exe, using curl, PowerShell and scheduled tasks. The script collects system and antivirus information and sends it to the C2 in a file named abc.pdf. A fake Windows error message distracts the victim.
  • Chain 2: a VHDX image, "Letter from the Ambassador – 11th Belt and Road Summit.vhdx", exposes a shortcut that opens a decoy spreadsheet while silently running the MSI installer Visa_Details.msi, which deploys PapRAT disguised as Microsoft software.
  • Chain 3: a RAR archive contains a URL shortcut that fetches an LNK via WebDAV, which launches Imp_Details.msi and deploys PapRAT. PapRAT then downloads WmRAT, disguised as vnces.exe, which contacts netmansrvdns.com.
  • Attribution artifacts: build artifacts include the product name "papsolutions" and the PDB filename "requpap.pdb".
  • Variants: C++ and Rust versions exist. The C++ sample's C2 configuration is XOR-encoded with key 0x50. The Rust version reverses and ROT-3-shifts strings in .rdata, extends the command set from eight to eleven (PowerShell execution, sleep, clean exit), waits 42 seconds before starting and then beacons every five seconds.

Remediação

  • Monitor scheduled tasks, scripting tools (PowerShell, curl, ftp.exe) and MSI installer activity alongside signature-based AV.
  • Enforce least-privilege access, restrict native scripting engines and remove standing administrative rights (advice from Keeper Security's CISO, Shane Barney).

Linha do tempo

  1. hackread.com ↗ · pub. 02/11/2026 11:01 · coletado 02/11 12:01 primeiro registro

    BITTER APT uses fake diplomatic lures and living-off-the-land tradecraft to deploy PapRAT and WmRAT in South Asia

    ler a análise desta fonte

    Fortinet FortiGuard Labs detailed a cyberespionage campaign against government, energy and engineering organizations in South Asia, attributed with high confidence to BITTER APT, a suspected South Asian group active since at least 2013. The actors deliver a custom RAT, PapRAT, to Windows systems through three infection chains that rely on deception and living-off-the-land (LotL) techniques rather than software vulnerabilities. Lures are themed around diplomatic and military topics, such as a fake letter from an ambassador about the 11th Belt and Road Summit. PapRAT supports remote command execution, file transfer and deletion, directory and drive listing, and screenshot capture. In one chain it also pulls down a second implant, WmRAT.

    Technical Details

    • Chain 1: diplomatic- and military-themed LNK shortcuts launch a script disguised as an icon file through ftp.exe, using curl, PowerShell and scheduled tasks. The script collects system and antivirus information and sends it to the C2 in a file named abc.pdf. A fake Windows error message distracts the victim.
    • Chain 2: a VHDX image, "Letter from the Ambassador – 11th Belt and Road Summit.vhdx", exposes a shortcut that opens a decoy spreadsheet while silently running the MSI installer Visa_Details.msi, which deploys PapRAT disguised as Microsoft software.
    • Chain 3: a RAR archive contains a URL shortcut that fetches an LNK via WebDAV, which launches Imp_Details.msi and deploys PapRAT. PapRAT then downloads WmRAT, disguised as vnces.exe, which contacts netmansrvdns.com.
    • Attribution artifacts: build artifacts include the product name "papsolutions" and the PDB filename "requpap.pdb".
    • Variants: C++ and Rust versions exist. The C++ sample's C2 configuration is XOR-encoded with key 0x50. The Rust version reverses and ROT-3-shifts strings in .rdata, extends the command set from eight to eleven (PowerShell execution, sleep, clean exit), waits 42 seconds before starting and then beacons every five seconds.

    Remediation

    • Monitor scheduled tasks, scripting tools (PowerShell, curl, ftp.exe) and MSI installer activity alongside signature-based AV.
    • Enforce least-privilege access, restrict native scripting engines and remove standing administrative rights (advice from Keeper Security's CISO, Shane Barney).