Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.

"PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands."

The campaign is notable for making use of three different infection chains –

A Windows Shortcut (LNK) file that abuses the native "ftp.exe" utility to run scripts and create scheduled tasks designed to maintain contact with a command-and-control (C2) server.
A VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet, while running an MSI installer in the background to deploy PapRAT.
A URL shortcut (URL) file that fetches a LNK file via WebDAV, which then leads to an MSI installer that deploys PapRAT.

The living-off-the-land (LotL) approach is designed to execute commands from a remote server ("goodnfortunes[.]com"), allowing it to collect directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives.

The harvested reconnaissance information is saved as "abc.pdf" and exfiltrated back to the C2 server via a curl command, after which the staged file is deleted from the host.

A second version of the script has been found to retrieve a file called "talk.log" from "techtalkhelp[.]com." The payload contains a Base64-encoded script to obtain additional instructions from the same server and execute them as PowerShell commands.

"This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect," Fortinet said.

The PapRAT malware delivered via the MSI installer in the second attack chain is designed for remote control. It supports eight commands –

MSG, for remote shell
FDD, for directory listing
DEL, for file deletion
RUN, for arbitrary file execution
GDR, for drive enumeration
SS1, for screenshot capture
UPP, for uploading local files to the C2 server ("rivingtonclarks[.]com")
DWW, for downloading files from the C2 server

A Rust version of the malware incorporates three more commands –

MS2, for PowerShell command execution
SLP, for sleeping and polling resumption
BYE, for process termination

A notable aspect of the third attack chain is that it combines the salient aspects of the first two sequences by using a script to download an MSI installer via curl. Like before, the MSI installer serves as a conduit for PapRAT, which then proceeds to drop WmRAT, a malware previously identified as used by Bitter.

The findings indicate that the threat actor continues to refine its custom arsenal to establish and maintain access to targeted systems.

"These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures," Fortinet said. "Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages."