Bitter Targets South Asia With PapRAT Remote Access Trojan

South Asian cyberespionage group Bitter has been observed targeting organizations in the region with PapRAT, a previously unreported remote access trojan. Fortinet FortiGuard Labs identified both C++ and Rust implementations of the malware, which provide attackers with command execution, file operations, system discovery and screenshot capture.

Bitter is also tracked as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17 and TA397. The campaign uses three infection chains that combine shortcut files, disk images, WebDAV, scripts and MSI installers to establish and maintain access to victim systems.

Three routes to the PapRAT payload

In the first chain, a Windows Shortcut file abuses the native ftp.exe utility to execute scripts and create scheduled tasks. Those tasks are intended to preserve contact with a command-and-control server. The activity reflects a living-off-the-land approach that uses legitimate Windows utilities rather than relying solely on a conventional malware executable.

A second route uses a VHDX disk image containing a LNK file. The shortcut opens a lure Microsoft Excel spreadsheet while an MSI installer runs in the background and deploys PapRAT. In the third chain, a URL shortcut retrieves a LNK file through WebDAV; that file ultimately leads to an MSI installer. This sequence also uses a script to download the installer with curl.

The scripts contact goodnfortunes[.]com to collect directory and task lists, information from the Desktop, Documents and Downloads folders, installed antivirus product data and mounted-drive details. They save the reconnaissance output as abc.pdf, exfiltrate it with curl and then delete the staged file. Another script version retrieves talk.log from techtalkhelp[.]com and contains Base64-encoded instructions that are executed as PowerShell commands.

Remote control and server-side staging

Fortinet said the staging model gives the operator flexibility because commands can be changed on the server without delivering a new binary. That approach avoids PE drops and process injection that some security appliances may detect more readily.

The MSI-delivered PapRAT supports remote shell access, directory and drive enumeration, file deletion, arbitrary file execution, screenshot capture, and uploads and downloads involving the command-and-control server rivingtonclarks[.]com. The Rust version adds PowerShell execution, a sleep-and-poll function and process termination. In the third chain, PapRAT also drops WmRAT, malware previously associated with Bitter.

What defenders should monitor

The campaign shows why shortcut files, URL shortcuts, disk images and MSI packages deserve scrutiny when they arrive through unsolicited messages. Fortinet recommends monitoring malicious behavior across scripting tools, scheduled tasks and installer activity alongside detection of known malware signatures.

For businesses, the practical implication is to investigate unusual LNK, URL, VHDX and MSI activity as a connected sequence, especially where native utilities such as ftp.exe, curl and PowerShell collect host data, create persistence or contact unfamiliar infrastructure.