BITTER espionage group deploys new PapRAT RAT in three infection chains against South Asian organizations
BITTER, a South Asian cyberespionage group, is targeting South Asian organizations with PapRAT, a previously unreported remote access trojan that exists in both C++ and Rust versions (fortinet.com). Fortinet FortiGuard Labs attributes the campaign to BITTER with high confidence and reports three infection chains built on LNK, VHDX, URL and MSI files (fortinet.com). The chains depend on lure files delivered through unsolicited messages, and the LNK chain abuses the native ftp.exe utility to run scripts and create scheduled tasks. No CVE is involved, so the risk comes from a targeted intrusion that needs user interaction, not from an exploitable flaw. Fortinet published its analysis on 2 November 2026 (fortinet.com), and the article appeared a week later. Criticity is high: this is an active targeted campaign with a new implant, but no vulnerability, mass exposure or confirmed large-scale compromise is reported.
Detalhes técnicos
The first chain uses a LNK file that abuses ftp.exe to run scripts and create scheduled tasks that keep contact with the C2 server. The second chain uses a VHDX disk image containing a LNK file that opens a lure Excel spreadsheet while an MSI installer runs in the background to deploy PapRAT. The third chain uses a URL shortcut that retrieves a LNK file over WebDAV, which leads to an MSI installer that deploys PapRAT (article). Fortinet describes the staged model in detail: the script on goodnfortunes[.]com gathers directory and scheduled-task lists, files from Desktop, Documents and Downloads, installed antivirus data and mounted drives, saves the results as abc.pdf, sends them out with curl and then deletes the file (article, fortinet.com). A second script variant fetches talk.log from techtalkhelp[.]com, which holds Base64-encoded PowerShell instructions (article, fortinet.com).
The MSI-delivered PapRAT supports eight commands: FDD (directory listing), RUN (arbitrary file execution), GDR (drive enumeration), SS1 (screenshot capture), UPP (upload to the C2 server rivingtonclarks[.]com), DWW (download from the C2 server), and two commands related to sleep and process handling (article). The Rust variant adds MS2 (PowerShell execution), SLP (sleep and polling resumption) and BYE (process termination) (article). Through the DWW command the malware retrieves a second payload, vnces.exe, which is WmRAT, a tool Fortinet links to BITTER (fortinet.com). Fortinet notes that updating commands server-side avoids dropping a new binary, which lowers detection by some security appliances (article).
Known IOCs from the Fortinet report include the hostnames netmansrvdns[.]com and rappellingaart[.]com, the URLs hxxps://techtalkhelp[.]com/talk.log, hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php, hxxps://goodnfortunes[.]com/ucl.php, hxxps://felixfuturenext[.]com/Epistemological/ and hxxp://gomescareerplans[.]com/docs, and the SHA256 hashes of the LNK samples, the PapRAT sample (569a21b5...6a4b33) and the WmRAT sample (411c0b9a...88546b) (fortinet.com).
Remediação
Fortinet advises monitoring malicious activity across scripting tools, scheduled tasks and installer activity, and not relying only on known malware signatures (article). Organizations should handle unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages (article). Defenders can block the listed domains and hashes and alert on ftp.exe or curl launched from LNK files and on scheduled tasks that run cmd or PowerShell.
Linha do tempo
-
BITTER espionage group deploys new PapRAT RAT in three infection chains against South Asian organizations
ler a análise desta fonte ocultar
BITTER, a South Asian cyberespionage group, is targeting South Asian organizations with PapRAT, a previously unreported remote access trojan that exists in both C++ and Rust versions (fortinet.com). Fortinet FortiGuard Labs attributes the campaign to BITTER with high confidence and reports three infection chains built on LNK, VHDX, URL and MSI files (fortinet.com). The chains depend on lure files delivered through unsolicited messages, and the LNK chain abuses the native ftp.exe utility to run scripts and create scheduled tasks. No CVE is involved, so the risk comes from a targeted intrusion that needs user interaction, not from an exploitable flaw. Fortinet published its analysis on 2 November 2026 (fortinet.com), and the article appeared a week later. Criticity is high: this is an active targeted campaign with a new implant, but no vulnerability, mass exposure or confirmed large-scale compromise is reported.
Technical Details
The first chain uses a LNK file that abuses ftp.exe to run scripts and create scheduled tasks that keep contact with the C2 server. The second chain uses a VHDX disk image containing a LNK file that opens a lure Excel spreadsheet while an MSI installer runs in the background to deploy PapRAT. The third chain uses a URL shortcut that retrieves a LNK file over WebDAV, which leads to an MSI installer that deploys PapRAT (article). Fortinet describes the staged model in detail: the script on goodnfortunes[.]com gathers directory and scheduled-task lists, files from Desktop, Documents and Downloads, installed antivirus data and mounted drives, saves the results as abc.pdf, sends them out with curl and then deletes the file (article, fortinet.com). A second script variant fetches talk.log from techtalkhelp[.]com, which holds Base64-encoded PowerShell instructions (article, fortinet.com).
The MSI-delivered PapRAT supports eight commands: FDD (directory listing), RUN (arbitrary file execution), GDR (drive enumeration), SS1 (screenshot capture), UPP (upload to the C2 server rivingtonclarks[.]com), DWW (download from the C2 server), and two commands related to sleep and process handling (article). The Rust variant adds MS2 (PowerShell execution), SLP (sleep and polling resumption) and BYE (process termination) (article). Through the DWW command the malware retrieves a second payload, vnces.exe, which is WmRAT, a tool Fortinet links to BITTER (fortinet.com). Fortinet notes that updating commands server-side avoids dropping a new binary, which lowers detection by some security appliances (article).
Known IOCs from the Fortinet report include the hostnames netmansrvdns[.]com and rappellingaart[.]com, the URLs hxxps://techtalkhelp[.]com/talk.log, hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php, hxxps://goodnfortunes[.]com/ucl.php, hxxps://felixfuturenext[.]com/Epistemological/ and hxxp://gomescareerplans[.]com/docs, and the SHA256 hashes of the LNK samples, the PapRAT sample (569a21b5...6a4b33) and the WmRAT sample (411c0b9a...88546b) (fortinet.com).
Remediation
Fortinet advises monitoring malicious activity across scripting tools, scheduled tasks and installer activity, and not relying only on known malware signatures (article). Organizations should handle unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages (article). Defenders can block the listed domains and hashes and alert on ftp.exe or curl launched from LNK files and on scheduled tasks that run cmd or PowerShell.