BITTER (TA397) Targets South Asian Government and Energy Sectors with Upgraded PapRAT Malware
FortiGuard Labs uncovered a cyberespionage campaign by the threat actor BITTER (also tracked as TA397) targeting government, engineering, and energy organizations in South Asia. The group uses spear-phishing lures referencing diplomatic and military events, such as the 22nd Heads of Asian Coast Guard Agencies Meeting and the 11th Belt and Road Summit, to deliver the PapRAT malware via three distinct infection chains. Notably, the operators rebuilt the PapRAT backdoor from C++ to Rust, expanding its command set from eight to eleven and adding anti-analysis techniques. BITTER is attributed with high confidence based on lure filenames, C2 infrastructure, and historical ties to South Asian state-sponsored espionage dating back to 2013.
Detalhes técnicos
The first infection chain abuses a shortcut file that leverages the native ftp.exe utility's ! prefix to execute local shell commands, bypassing security controls and creating scheduled tasks disguised as Microsoft or BIOS updates. These tasks use curl to fetch encoded commands and exfiltrate reconnaissance data (directory trees, process lists, antivirus info) disguised as a temporary PDF. The second chain uses a mounted VHDX disk image with a decoy Excel sheet to run a Windows Installer package, while the third uses WebDAV to deliver a similar installer; both drop the PapRAT binary via custom installer actions. PapRAT masquerades as a legitimate Microsoft redistributable service, beacons over plain HTTP every 10 seconds (5 seconds in the Rust variant after a 42-second delay), and uses XOR-encoded C2 hostnames/ports. The Rust variant stores strings in reverse order with a ROT-3 shift for obfuscation. In the WebDAV chain, attackers also delivered WmRAT, a secondary C++-based RAT capable of basic reconnaissance, screenshots, and command execution.
Remediação
Defenders should monitor for living-off-the-land abuse of ftp.exe and conhost.exe spawning hidden command shells, inspect Task Scheduler for suspicious tasks referencing scripts in public user folders, block outbound WebDAV traffic, and restrict mounting of external VHDX files on unmanaged endpoints. Incident responders should hunt for residual persistence mechanisms, as removing the main PapRAT binary alone leaves scheduled tasks and secondary scripts active.
Linha do tempo
-
BITTER (TA397) Targets South Asian Government and Energy Sectors with Upgraded PapRAT Malware
ler a análise desta fonte ocultar
FortiGuard Labs uncovered a cyberespionage campaign by the threat actor BITTER (also tracked as TA397) targeting government, engineering, and energy organizations in South Asia. The group uses spear-phishing lures referencing diplomatic and military events, such as the 22nd Heads of Asian Coast Guard Agencies Meeting and the 11th Belt and Road Summit, to deliver the PapRAT malware via three distinct infection chains. Notably, the operators rebuilt the PapRAT backdoor from C++ to Rust, expanding its command set from eight to eleven and adding anti-analysis techniques. BITTER is attributed with high confidence based on lure filenames, C2 infrastructure, and historical ties to South Asian state-sponsored espionage dating back to 2013.
Technical Details
The first infection chain abuses a shortcut file that leverages the native ftp.exe utility's
!prefix to execute local shell commands, bypassing security controls and creating scheduled tasks disguised as Microsoft or BIOS updates. These tasks use curl to fetch encoded commands and exfiltrate reconnaissance data (directory trees, process lists, antivirus info) disguised as a temporary PDF. The second chain uses a mounted VHDX disk image with a decoy Excel sheet to run a Windows Installer package, while the third uses WebDAV to deliver a similar installer; both drop the PapRAT binary via custom installer actions. PapRAT masquerades as a legitimate Microsoft redistributable service, beacons over plain HTTP every 10 seconds (5 seconds in the Rust variant after a 42-second delay), and uses XOR-encoded C2 hostnames/ports. The Rust variant stores strings in reverse order with a ROT-3 shift for obfuscation. In the WebDAV chain, attackers also delivered WmRAT, a secondary C++-based RAT capable of basic reconnaissance, screenshots, and command execution.Remediation
Defenders should monitor for living-off-the-land abuse of ftp.exe and conhost.exe spawning hidden command shells, inspect Task Scheduler for suspicious tasks referencing scripts in public user folders, block outbound WebDAV traffic, and restrict mounting of external VHDX files on unmanaged endpoints. Incident responders should hunt for residual persistence mechanisms, as removing the main PapRAT binary alone leaves scheduled tasks and secondary scripts active.