BITTER Delivers PapRAT and WmRAT to South Asian Organizations via Fake Diplomatic Invitations

Linha do tempo

1. gbhackers.com ↗ · pub. 03/11/2026 02:59 · coletado 03/11 04:00 primeiro registro

   BITTER Delivers PapRAT and WmRAT to South Asian Organizations via Fake Diplomatic Invitations

   ler a análise desta fonte ocultar

   FortiGuard Labs attributes, with high confidence, a campaign by the suspected South Asian cyberespionage group BITTER that delivers a custom RAT, PapRAT, to South Asian organizations. The attribution rests on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses three infection chains built on diplomatic-themed lures (LNK, VHDX and RAR/URL shortcut). One chain abuses the native Windows ftp.exe as a living-off-the-land technique. PapRAT in turn downloads a secondary implant, WmRAT, and a newer Rust variant of PapRAT has appeared. C2 telemetry shows targets concentrated in South Asia.

   Technical Details

   • Chain 1: a malicious LNK abuses ftp.exe. The ! prefix makes it run the next token as a local shell command (e.g. !more res.ico pipes a script into cmd), sidestepping PowerShell/wscript monitoring. The script creates a scheduled task disguised as a Microsoft update and uses curl to contact the C2, saving output to err.log. It then shows a fake "Explorer was unable to open this file!" error. The task fetches a Base64-encoded script that pulls server-side-updated commands, avoiding PE drops and process injection. One recovered script performs reconnaissance (directory listings, running tasks, installed antivirus, mounted drives). Lure example: "NV-683 Request for Bilateral Meeting during 22nd HACGAM".
   • Chain 2: a VHDX image named "Letter from the Ambassador – 11th Belt and Road Summit" exposes one visible LNK and two hidden files, a decoy spreadsheet and Visa_Details.msi. The LNK silently runs the MSI while opening the decoy. The MSI's only action is a Type 194 CustomAction that drops PapRAT.
   • Chain 3: "Official Invitation Majilis 2026 Gala Dinner.rar" holds a URL shortcut that retrieves an LNK over WebDAV from rappellingaart[.]com, then runs Imp_Details.msi to deploy PapRAT. PapRAT downloads vnces.exe, which is WmRAT.
   • WmRAT: a C++ RAT masquerading as bruzsvc.exe with "Microsoft Corporation" version strings. It beacons over plaintext HTTP every 10 seconds, XOR-encodes its C2 host, port and paths with key 0x50, and identifies victims as username_computername. It supports eight commands: msg, FDD, DEL, RUN, GDR, SS1, UPP and DWW.
   • Rust PapRAT variant: named after the PDB requpap.pdb and the product name "papsolutions". It waits 42 seconds, then polls over HTTPS every 5 seconds. Its constants are reversed and ROT-3 shifted, and one decodes to www[.]rivingtonclarks[.]com/banana/, matching an earlier "Banana Login" panel and a fruit-word naming pattern. It adds MS2 (PowerShell execution), SLP (sleep/resume polling) and BYE (exit).
   • Background: Proofpoint documented WmRAT and MiyaRAT in December 2024 against a Turkish defense organization. In June 2025 Proofpoint and Threatray assessed BITTER as state-backed, collecting intelligence aligned with Indian government interests and masquerading as diplomatic entities from China, Madagascar, Mauritius and South Korea.

   Remediation

   • Monitor ftp.exe launching shell commands and scheduled tasks that pipe files into cmd.
   • Watch for headless conhost, curl with certificate checks disabled, and mounted VHDX images.
   • Block WebDAV access to untrusted hosts.
   • Block the listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com and netmansrvdns[.]com.