BITTER (TA397) APT uses three LNK, MSI and VHDX chains to deliver PapRAT and WmRAT in South Asia

Linha do tempo

1. gbhackers.com ↗ · pub. 03/11/2026 02:59 · coletado 03/11 04:00

   BITTER Delivers PapRAT and WmRAT to South Asian Organizations via Fake Diplomatic Invitations

   ler a análise desta fonte ocultar

   FortiGuard Labs attributes, with high confidence, a campaign by the suspected South Asian cyberespionage group BITTER that delivers a custom RAT, PapRAT, to South Asian organizations. The attribution rests on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses three infection chains built on diplomatic-themed lures (LNK, VHDX and RAR/URL shortcut). One chain abuses the native Windows ftp.exe as a living-off-the-land technique. PapRAT in turn downloads a secondary implant, WmRAT, and a newer Rust variant of PapRAT has appeared. C2 telemetry shows targets concentrated in South Asia.

   Technical Details

   • Chain 1: a malicious LNK abuses ftp.exe. The ! prefix makes it run the next token as a local shell command (e.g. !more res.ico pipes a script into cmd), sidestepping PowerShell/wscript monitoring. The script creates a scheduled task disguised as a Microsoft update and uses curl to contact the C2, saving output to err.log. It then shows a fake "Explorer was unable to open this file!" error. The task fetches a Base64-encoded script that pulls server-side-updated commands, avoiding PE drops and process injection. One recovered script performs reconnaissance (directory listings, running tasks, installed antivirus, mounted drives). Lure example: "NV-683 Request for Bilateral Meeting during 22nd HACGAM".
   • Chain 2: a VHDX image named "Letter from the Ambassador – 11th Belt and Road Summit" exposes one visible LNK and two hidden files, a decoy spreadsheet and Visa_Details.msi. The LNK silently runs the MSI while opening the decoy. The MSI's only action is a Type 194 CustomAction that drops PapRAT.
   • Chain 3: "Official Invitation Majilis 2026 Gala Dinner.rar" holds a URL shortcut that retrieves an LNK over WebDAV from rappellingaart[.]com, then runs Imp_Details.msi to deploy PapRAT. PapRAT downloads vnces.exe, which is WmRAT.
   • WmRAT: a C++ RAT masquerading as bruzsvc.exe with "Microsoft Corporation" version strings. It beacons over plaintext HTTP every 10 seconds, XOR-encodes its C2 host, port and paths with key 0x50, and identifies victims as username_computername. It supports eight commands: msg, FDD, DEL, RUN, GDR, SS1, UPP and DWW.
   • Rust PapRAT variant: named after the PDB requpap.pdb and the product name "papsolutions". It waits 42 seconds, then polls over HTTPS every 5 seconds. Its constants are reversed and ROT-3 shifted, and one decodes to www[.]rivingtonclarks[.]com/banana/, matching an earlier "Banana Login" panel and a fruit-word naming pattern. It adds MS2 (PowerShell execution), SLP (sleep/resume polling) and BYE (exit).
   • Background: Proofpoint documented WmRAT and MiyaRAT in December 2024 against a Turkish defense organization. In June 2025 Proofpoint and Threatray assessed BITTER as state-backed, collecting intelligence aligned with Indian government interests and masquerading as diplomatic entities from China, Madagascar, Mauritius and South Korea.

   Remediation

   • Monitor ftp.exe launching shell commands and scheduled tasks that pipe files into cmd.
   • Watch for headless conhost, curl with certificate checks disabled, and mounted VHDX images.
   • Block WebDAV access to untrusted hosts.
   • Block the listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com and netmansrvdns[.]com.
2. hackread.com ↗ · pub. 02/11/2026 11:01 · coletado 02/11 12:01

   BITTER APT uses fake diplomatic lures and living-off-the-land tradecraft to deploy PapRAT and WmRAT in South Asia

   ler a análise desta fonte ocultar

   Fortinet FortiGuard Labs detailed a cyberespionage campaign against government, energy and engineering organizations in South Asia, attributed with high confidence to BITTER APT, a suspected South Asian group active since at least 2013. The actors deliver a custom RAT, PapRAT, to Windows systems through three infection chains that rely on deception and living-off-the-land (LotL) techniques rather than software vulnerabilities. Lures are themed around diplomatic and military topics, such as a fake letter from an ambassador about the 11th Belt and Road Summit. PapRAT supports remote command execution, file transfer and deletion, directory and drive listing, and screenshot capture. In one chain it also pulls down a second implant, WmRAT.

   Technical Details

   • Chain 1: diplomatic- and military-themed LNK shortcuts launch a script disguised as an icon file through ftp.exe, using curl, PowerShell and scheduled tasks. The script collects system and antivirus information and sends it to the C2 in a file named abc.pdf. A fake Windows error message distracts the victim.
   • Chain 2: a VHDX image, "Letter from the Ambassador – 11th Belt and Road Summit.vhdx", exposes a shortcut that opens a decoy spreadsheet while silently running the MSI installer Visa_Details.msi, which deploys PapRAT disguised as Microsoft software.
   • Chain 3: a RAR archive contains a URL shortcut that fetches an LNK via WebDAV, which launches Imp_Details.msi and deploys PapRAT. PapRAT then downloads WmRAT, disguised as vnces.exe, which contacts netmansrvdns.com.
   • Attribution artifacts: build artifacts include the product name "papsolutions" and the PDB filename "requpap.pdb".
   • Variants: C++ and Rust versions exist. The C++ sample's C2 configuration is XOR-encoded with key 0x50. The Rust version reverses and ROT-3-shifts strings in .rdata, extends the command set from eight to eleven (PowerShell execution, sleep, clean exit), waits 42 seconds before starting and then beacons every five seconds.

   Remediation

   • Monitor scheduled tasks, scripting tools (PowerShell, curl, ftp.exe) and MSI installer activity alongside signature-based AV.
   • Enforce least-privilege access, restrict native scripting engines and remove standing administrative rights (advice from Keeper Security's CISO, Shane Barney).
3. infosecurity-magazine.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:01

   Bitter (TA397) deploys PapRAT and WmRAT via LNK, MSI and VHDX chains against South Asian organizations

   ler a análise desta fonte ocultar

   Fortinet FortiGuard Labs (Cara Lin) attributes with high confidence a multi-month cyber-espionage campaign to Bitter (TA397), a suspected South Asian group, based on lure filenames, C2 patterns, file metadata and malware analysis. The campaign uses native Windows tools together with a custom RAT, PapRAT, to maintain access. Targets are mainly South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea. Lures referenced a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.

   Technical Details

   • Chain 1 (living off the land): a malicious LNK file abuses the built-in ftp.exe to run scripts and create scheduled tasks. The tasks use curl to fetch fresh commands from attacker servers. No malware binary and no PapRAT were found, so operators can change instructions server-side.
   • Chains 2 and 3: PapRAT is delivered via MSI packages, one hidden with a decoy spreadsheet inside a VHDX image and the other fetched through an internet shortcut in a RAR archive.
   • PapRAT C++ build: poses as a Microsoft component, beacons over plaintext HTTP and supports eight commands, including remote shell, file transfer and screenshots.
   • PapRAT Rust variant: a more recent build that switches to HTTPS and adds three commands (PowerShell execution, pause, exit).
   • In the third chain PapRAT downloads WmRAT, a C++ RAT documented previously by other researchers, which FortiGuard cites as an additional link to Bitter.
   • Because chain 1 uses trusted system processes, signature-based controls have little to alert on, and hunting for PapRAT alone could miss part of the campaign.

   Remediation

   • Handle unexpected LNK files, internet shortcuts, disk images and MSI installers with care (FortiGuard).
   • Apply least-privilege access, tighter limits on native scripting engines and removal of standing administrative rights (Keeper Security comment).
   • Hunt for the scheduled tasks and curl/ftp.exe abuse, not only the implant, since removing the first implant found may not evict the attacker.
4. feeds.fortinet.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:00

   BITTER APT deploys PapRAT via living-off-the-land chains, LNK and MSI loaders, with new Rust variant

   ler a análise desta fonte ocultar

   FortiGuard Labs reports a BITTER campaign that mixes native Windows tooling with custom malware to gain and keep access to targeted systems. One of three infection chains abuses ftp.exe, curl, scripts and scheduled tasks without dropping a traditional malware executable, which may reduce visibility for endpoint controls that focus on executables. The other two chains deliver PapRAT through LNK files and MSI installers. PapRAT supports system reconnaissance, file manipulation, secondary payload delivery, screenshot capture and remote command execution. A Rust variant of PapRAT sits alongside the C++ version, which indicates continued investment in BITTER's toolset.

   Technical Details

   • Chain 1: fileless-style execution using ftp.exe, curl, scripts and scheduled tasks.
   • Chains 2 and 3: PapRAT delivered via LNK files and MSI installers. The article also mentions URL shortcuts and disk images as lures to treat with caution.
   • The Rust PapRAT variant extends the command set from eight to eleven, adding PowerShell execution, a sleep directive and a clean exit command.
   • Related payloads named in the detections: SectopRAT (fileless) and WmRAT, along with DLL and DB files.
   • FortiGuard AV signatures: LNK/Agent.BC!tr, LNK/Agent.F!tr, W64/PapRAT.A!tr, W32/WmRAT.A!tr.
   • Infrastructure includes netmansrvdns[.]com, rappellingaart[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, goodnfortunes[.]com, felixfuturenext[.]com and gomescareerplans[.]com.

   Remediation

   • Treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution, especially when they arrive through unsolicited messages.
   • Monitor scripting tools, scheduled task creation and installer activity, not only known malware signatures.
   • Detect suspicious execution chains and outbound C2 traffic.
   • Block the listed domains and URLs and hunt for the listed hashes.
   • Fortinet states that FortiGuard Web Filtering and AntiVirus already cover the campaign URLs and payloads.
5. darkreading.com ↗ · pub. 02/11/2026 11:00 · coletado 02/11 12:00 primeiro registro só resumo do feed

   India-linked BITTER group runs PapRAT cyberespionage campaign against South Asian organizations via three attack chains

   ler a análise desta fonte ocultar

   The India-linked threat group BITTER is running a cyberespionage campaign against organizations in South Asia, delivering a malware family tracked as PapRAT. According to the report, the operators abuse legitimate Windows functionality across three distinct attack chains. The source article is only a headline and standfirst, so it gives no detail on victims, infrastructure, indicators or vulnerabilities.

   Technical Details

   • Attribution: BITTER, described as a known India-linked threat group.
   • Malware: PapRAT.
   • Tradecraft: three separate attack chains that use legitimate Windows functionality (living off the land). The article excerpt does not name the specific features or binaries.