Bitter Uses New PapRAT Backdoor in Campaign Targeting South Asia
Summary
Fortinet reports that Bitter is targeting South Asian organizations with PapRAT, a C++ and Rust remote access trojan delivered through three infection chains, including scripts and MSI installers.
Key points
- Fortinet researchers report that Bitter, also known as APT-C-08, is targeting organizations in South Asia with the previously unreported PapRAT.
- PapRAT has C++ and Rust implementations with remote-control capabilities; the Rust variant adds PowerShell execution and other commands.
- One script-based chain runs commands from goodnfortunes[.]com to collect system information, then sends it to the server as abc.pdf using curl and deletes the staged file.
- Another chain retrieves talk.log from techtalkhelp[.]com; its Base64-encoded script obtains further instructions and executes them as PowerShell commands.
- A third chain uses curl to download an MSI installer that delivers PapRAT, which then drops WmRAT, previously associated with Bitter.
- Fortinet advises caution with unexpected LNK files, URL shortcuts, disk images, and MSI packages, and recommends monitoring scripting tools, scheduled tasks, and installer activity.
Article Details
- Event Type
- Cyberespionage campaign deploying a previously unreported remote access trojan
- Impact
- The campaign targeted South Asian organizations. PapRAT can execute commands, upload and download files, delete files, enumerate directories and drives, and capture screenshots. The reported activity also collected system reconnaissance information and exfiltrated it to a C2 server; one attack chain used PapRAT to drop WmRAT.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | goodnfortunes[.]com | Reported C2 server used to receive commands and exfiltrated reconnaissance information. |
| DOMAIN | techtalkhelp[.]com | Reported malicious server used to provide talk.log and additional instructions for execution as PowerShell commands. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelReconnaissance information is sent to the C2 server using curl.T1059.001 · PowerShellThe retrieved script executes additional instructions as PowerShell commands.T1083 · File and Directory DiscoveryThe activity enumerates directories, files, and drives.T1105 · Ingress Tool TransferThe scripts retrieve files from remote servers, including an MSI installer and talk.log.T1518.001 · Security Software DiscoveryThe activity collects information about installed antivirus products.
People
Threat Actors
BitterThe article identifies Bitter as the group observed targeting South Asian organizations with PapRAT.Orange YaliThe article lists Orange Yali as an alias of Bitter, which it reports targeting South Asian organizations with PapRAT.T-APT-17The article lists T-APT-17 as an alias of Bitter, which it reports targeting South Asian organizations with PapRAT.