EN PT-BR
← Voltar ao feed
high

Bitter (TA397) deploys PapRAT and WmRAT via LNK, MSI and VHDX chains against South Asian organizations

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 11:00 · coletado há 1 hora

Fortinet FortiGuard Labs (Cara Lin) attributes with high confidence a multi-month cyber-espionage campaign to Bitter (TA397), a suspected South Asian group, based on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses native Windows tools together with a custom RAT, PapRAT, to maintain access. Targets are mainly South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea. Lures referenced a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

Detalhes técnicos

  • Chain 1 (living off the land): a malicious LNK file abuses the built-in ftp.exe to run scripts and create scheduled tasks. The tasks use curl to fetch fresh commands from attacker servers. No malware binary and no PapRAT were found, so operators can change instructions server-side.
  • Chains 2 and 3: PapRAT is delivered via MSI packages, one hidden with a decoy spreadsheet inside a VHDX image and the other fetched through an internet shortcut in a RAR archive.
  • PapRAT C++ build: poses as a Microsoft component, beacons over plaintext HTTP and supports eight commands, including remote shell, file transfer and screenshots.
  • PapRAT Rust variant: a more recent build that switches to HTTPS and adds three commands (PowerShell execution, pause, exit).
  • In the third chain PapRAT downloads WmRAT, a C++ RAT documented previously by other researchers, which FortiGuard cites as an additional link to Bitter.
  • Because chain 1 uses trusted system processes, signature-based controls have little to alert on, and hunting for PapRAT alone could miss part of the campaign.

Remediação

  • Handle unexpected LNK files, internet shortcuts, disk images and MSI installers with care (FortiGuard).
  • Apply least-privilege access, tighter limits on native scripting engines and removal of standing administrative rights (Keeper Security comment).
  • Hunt for the scheduled tasks and curl/ftp.exe abuse, not only the implant, since removing the first implant found may not evict the attacker.

Linha do tempo

  1. infosecurity-magazine.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:01 primeiro registro

    Bitter (TA397) deploys PapRAT and WmRAT via LNK, MSI and VHDX chains against South Asian organizations

    ler a análise desta fonte

    Fortinet FortiGuard Labs (Cara Lin) attributes with high confidence a multi-month cyber-espionage campaign to Bitter (TA397), a suspected South Asian group, based on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses native Windows tools together with a custom RAT, PapRAT, to maintain access. Targets are mainly South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea. Lures referenced a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

    Technical Details

    • Chain 1 (living off the land): a malicious LNK file abuses the built-in ftp.exe to run scripts and create scheduled tasks. The tasks use curl to fetch fresh commands from attacker servers. No malware binary and no PapRAT were found, so operators can change instructions server-side.
    • Chains 2 and 3: PapRAT is delivered via MSI packages, one hidden with a decoy spreadsheet inside a VHDX image and the other fetched through an internet shortcut in a RAR archive.
    • PapRAT C++ build: poses as a Microsoft component, beacons over plaintext HTTP and supports eight commands, including remote shell, file transfer and screenshots.
    • PapRAT Rust variant: a more recent build that switches to HTTPS and adds three commands (PowerShell execution, pause, exit).
    • In the third chain PapRAT downloads WmRAT, a C++ RAT documented previously by other researchers, which FortiGuard cites as an additional link to Bitter.
    • Because chain 1 uses trusted system processes, signature-based controls have little to alert on, and hunting for PapRAT alone could miss part of the campaign.

    Remediation

    • Handle unexpected LNK files, internet shortcuts, disk images and MSI installers with care (FortiGuard).
    • Apply least-privilege access, tighter limits on native scripting engines and removal of standing administrative rights (Keeper Security comment).
    • Hunt for the scheduled tasks and curl/ftp.exe abuse, not only the implant, since removing the first implant found may not evict the attacker.