Bitter Uses Three Infection Chains to Deploy PapRAT Across South Asia
Summary
FortiGuard Labs attributes a South Asian campaign with high confidence to Bitter (TA397). Three Windows infection chains deploy PapRAT, whose Rust version adds capabilities; one chain also delivers WmRAT.
Key points
- FortiGuard Labs attributes the campaign with high confidence to Bitter, also known as TA397.
- Researchers observed three infection chains targeting Windows systems with PapRAT, a custom RAT that can execute commands, manipulate files, capture screenshots, and download payloads.
- One chain uses a malicious LNK file and ftp.exe to run scripts and create scheduled tasks for continued C2 contact.
- A second chain uses a VHDX disk image and LNK file to show a decoy spreadsheet while an MSI installer deploys PapRAT.
- A third chain uses a URL shortcut to retrieve an LNK file via WebDAV, followed by an MSI installer; PapRAT also delivers WmRAT in this chain.
- PapRAT has been rewritten from C++ to Rust and expanded from eight commands to 11, adding PowerShell execution, a sleep directive, and a clean-exit command.
- Recommendations include caution with unsolicited LNK files, URL shortcuts, disk images, and MSI packages, and checking for additional payloads, scripts, and scheduled-task persistence during recovery.
Article Details
- Event Type
- Cyberespionage campaign attributed with high confidence to Bitter (also known as TA397), using three infection chains to compromise Windows systems and deploy custom malware.
- Impact
- PapRAT provides remote control of compromised systems, including command execution, file manipulation, screenshot capture, and delivery of additional payloads. One attack chain also deploys WmRAT; the article cautions that removing PapRAT may not eliminate access if additional payloads or persistence mechanisms remain.
MITRE ATT&CK
People
Cara LinFortiGuard Labs threat researcher who wrote about the campaign and its infection chains.Jason SorokoSectigo senior fellow who discussed persistence risks and recovery after PapRAT infections.Shane BarneyKeeper Security chief information security officer who commented on the campaign's use of native Windows tools and defensive implications.
Threat Actors
Malware
PapRATAt the center of the latest threat campaign is PapRAT, a custom remote access Trojan (RAT) that gives attackers extensive control over compromised Windows systems, including the ability to execute commands, manipulateWmRATfile through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers, according to FortiGuard Labs.
Products
Countries
Industries
Energygroups linked to India, has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain persistentEngineeringto India, has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain persistent access toGovernmentthreat groups linked to India, has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain