BITTER tahdid guruhi tomonidan Janubiy Osiyo tashkilotlariga maxsus masofaviy kirish trojanini (RAT) — PapRAT deb nomlangan — yetkazib beruvchi kampaniya.
FortiGuard faoliyatni yuqori ishonch bilan ushbu guruhga bog'laydi, bu lure fayl nomlari, buyruq va nazorat (C2) naqshlari, fayl metama'lumotlari va zararli dastur tahliliga asoslanadi.
Kampaniya uchta zanjirdan foydalanadi. Birinchisi zararli LNK faylga tayanadi, u Windowsning mahalliy ftp.exe yordam dasturini suiiste'mol qiladi.
"!" prefiksi ftp.exe'ni keyingi tokenni mahalliy shell buyrug'i sifatida ishga tushirishga majbur qiladi, shuning uchun "!more res.ico" skriptni cmd'ga quvur qiladi. Bu "yashash-yerda" texnikasi PowerShell yoki wscript'ga qaratilgan monitoringni chetlab o'tadi.
Skript Microsoft yangilanishi sifatida niqoblangan rejalashtirilgan vazifani yaratadi va C2 server bilan bog'lanish uchun curl'dan foydalanadi, natijani err.log nomli faylga saqlaydi.
So'ngra u soxta "Explorer bu faylni ocholmadi!" xabarini ko'rsatadi. Lure'lar orasida "NV-683 Request for Bilateral Meeting during 22nd HACGAM" ham bor.
Rejalashtirilgan vazifa Base64 bilan kodlangan skriptni oladi, u boshqa URL'dan keyingi buyruqlarni tortadi. Hujumchilar ushbu buyruqlarni server tomonida yangilaganligi sababli, ular yangi binar yuborishlari shart emas.
Bu PE tushirishlari va jarayon in'ektsiyasini oldini oladi, bu xavfsizlik qurilmalari osonroq aniqlaydi. Qayta tiklangan skriptlardan biri razvedka o'tkazadi, katalog ro'yxatlarini, ishlaydigan vazifalarni, o'rnatilgan antivirus ma'lumotlarini va o'rnatilgan drayverlarni to'playdi.
Ikkinchi zanjir "Letter from the Ambassador – 11th Belt and Road Summit" nomli VHDX disk tasviri bilan boshlanadi.
Hujum zanjirlari (Manba: FortiGuard).
O'rnatilgandan so'ng, u bitta ko'rinadigan LNK fayl va ikkita yashirin faylni ochadi: decoy elektron jadval va MSI o'rnatuvchi, Visa_Details.msi. LNK decoy'ni ochish bilan birga o'rnatuvchini yashirincha ishga tushiradi.
FortiGuard Labs kuzatishicha, BITTER 2013-yildan beri faol bo'lgan, hukumat, energetika va muhandislik sohalarini nishonga olgan Janubiy Osiyo kiberjosuslik aktori deb gumon qilinadi.
MSI'da haqiqiy o'rnatish funksiyasi yo'q. Uning yagona bajariladigan harakati Type 194 CustomAction bo'lib, u PapRAT'ni tushiradi.
Uchinchi zanjir "Official Invitation Majilis 2026 Gala Dinner.rar" bilan boshlanadi, u URL yorliqni o'z ichiga oladi.
MSI va XLSX'ni ishga tushirish uchun LNK fayl (Manba: FortiGuard).
Yorliq rappellingaart[.]com'dan WebDAV orqali LNK faylni oladi, so'ngra zanjir Imp_Details.msi'ni ishga tushirib PapRAT'ni joylashtiradi. Bu yerda PapRAT shuningdek ikkinchi implant, vnces.exe'ni yuklab oladi, bu WmRAT'dir.
C++ tuzilishi bruzsvc.exe sifatida niqoblanadi, uning versiya resursida "Microsoft Corporation" va "Microsoft redistributables" yozilgan.
U har 10 soniyada oddiy HTTP orqali signal yuboradi. U C2 xost, port va yo'llarni 0x50 kaliti bilan XOR-kodlaydi. U foydalanuvchi nomi va kompyuter nomini pastki chiziq bilan birlashtirib qurbonlarni aniqlaydi.
Zararli dastur sakkizta buyruqni qo'llab-quvvatlaydi: masofaviy shell bajarilishi (msg), katalog ro'yxati (FDD), fayl o'chirish (DEL), ixtiyoriy fayl bajarilishi (RUN), drayver ro'yxati (GDR), skrinshotlar (SS1), yuklashlar (UPP) va yuklab olishlar (DWW). Yuklash va yuklab olishlar bir martalik parol kodi va ClientID'ni o'z ichiga oladi.
Yangi Rust varianti PDB fayl "requpap.pdb" va mahsulot nomi "papsolutions" dan nom oladi. U 42 soniya kutadi, so'ngra har 5 soniyada HTTPS orqali so'rov yuboradi. Maqsad server LNK va "icon.ico" ni o'z ichiga oladi.
![Image 3: Files on rappellingaart[.]com (Source : FortiGuard).](https://www.fortinet.com/it/blog/threat-research/bitter-expands-its-arsenal-with-paprat/jcrcontent/root/responsivegrid/tablecontent/par/image1401868303.img.png/1793308530787/fg19.png)
rappellingaart[.]com'dagi fayllar (Manba: FortiGuard).
Uning doimiylari teskari va ROT-3 siljigan. Biri C2 URL www[.]rivingtonclarks[.]com/banana/ ga dekodlanadi. Bu avvalgi "Banana Login" paneliga mos keladi, bu asbob-uskunalar to'plamidagi meva-so'z nomlash naqshining bir qismidir.
Rust tuzilishi MS2 (PowerShell bajarilishi), SLP (kutish va so'rovni qayta boshlash) va BYE (jarayon chiqishi) ni qo'shadi. C2 telemetriyasi maqsadlar Janubiy Osiyoda jamlanganligini ko'rsatadi.
WmRAT C++ RAT bo'lib, tizim ma'lumotlarini to'playdi, skrinshot oladi, kataloglarni ro'yxatlaydi va buyruqlarni bajaradi. Proofpoint uni 2024-yil dekabrda MiyaRAT bilan birga, turk mudofaa tashkilotiga hujumlarda hujjatlashtirgan.
Ushbu kampaniya RAR arxivlari, muqobil ma'lumot oqimlari, rejalashtirilgan vazifalar va curl buyruqlaridan foydalangan. 2025-yil iyunida Proofpoint va Threatray BITTER'ni Hindiston hukumati manfaatlariga mos razvedka to'plovchi davlat tomonidan qo'llab-quvvatlanadigan guruh deb baholadi.
Ular shuningdek Xitoy, Madagaskar, Mavrikiy va Janubiy Koreyadan diplomatik tashkilotlar sifatida niqoblanishini ham qayd etdilar.
Himoyachilar ftp.exe'ning shell buyruqlarini ishga tushirishini va fayllarni cmd'ga quvur qiladigan rejalashtirilgan vazifalarni kuzatishlari kerak.
Shuningdek, ular conhost'ning boshsiz ishlashini, sertifikat tekshiruvini o'chirgan curl'ni va o'rnatilgan VHDX tasvirlarini kuzatishlari kerak. Ishonchsiz xostlarga WebDAV kirishini va ro'yxatdagi C2 domenlarini bloklash kerak: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com va netmansrvdns[.]com.
Kampaniya BITTER'ning mahalliy Windows vositalarini maxsus zararli dastur bilan aralashtirib, jim turishini ko'rsatadi. Birinchi zanjir an'anaviy bajariladigan fayllardan qochadi, bu faylga yo'naltirilgan endpoint nazoratlari uchun ko'rinishni kamaytiradi.
IOC'lar
| IOC Turi | Ko'rsatkich |
|---|---|
| Xost nomi | netmansrvdns[.]com |
| Xost nomi | rappellingaart[.]com |
| URL | hxxps://techtalkhelp[.]com/talk.log |
| URL | hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php |
| SHA256 (LNK) | a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c |
| SHA256 (LNK) | e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b |
Eslatma: IP manzillari va domenlar tasodifiy yechilish yoki giperhavola qilishni oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.
ANYRUN Sandbox'ini SOC'ga integratsiya qilib, 21 daqiqa tezroq MTTR bilan kiber tahdidlarni ta'sirdan oldin to'xtating.
A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations.
FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis
The campaign uses three chains. The first relies on a malicious LNK file that abuses the native Windows ftp.exe utility.
The “!” prefix makes ftp.exe run the following token as a local shell command, so “!more res.ico” pipes a script into cmd. This living-off-the-land technique sidesteps monitoring that focuses on PowerShell or wscript.
The script creates a scheduled task disguised as a Microsoft update and uses curl to contact the C2 server, saving output in a file named err.log.
It then shows a fake “Explorer was unable to open this file!” message. Lures include “NV-683 Request for Bilateral Meeting during 22nd HACGAM.”
The scheduled task fetches a Base64-encoded script that pulls further commands from another URL. Because attackers update those commands server-side, they don’t need to push a new binary.
This avoids PE drops and process injection that security appliances detect more easily. One recovered script performs reconnaissance, collecting directory listings, running tasks, installed antivirus data, and mounted drives.
The second chain starts with a VHDX disk image named “Letter from the Ambassador – 11th Belt and Road Summit.”
Attack chains (Source : FortiGuard).
Once mounted, it exposes one visible LNK file and two hidden files: a decoy spreadsheet and an MSI installer, Visa_Details.msi. The LNK silently runs the installer while opening the decoy.
FortiGuard Labs observed that, BITTER is a suspected South Asian cyberespionage actor active since at least 2013, with a history of targeting government, energy, and engineering sectors.
The MSI has no legitimate installation function. Its only executable action is a Type 194 CustomAction that drops PapRAT.
The third chain begins with “Official Invitation Majilis 2026 Gala Dinner.rar,” which holds a URL shortcut.
LNK file to start MSI and XLSX (Source : FortiGuard).
The shortcut retrieves an LNK file over WebDAV from rappellingaart[.]com, and the chain then runs Imp_Details.msi to deploy PapRAT. Here, PapRAT also downloads a secondary implant, vnces.exe, which is WmRAT.
The C++ build masquerades as bruzsvc.exe, with “Microsoft Corporation” and “Microsoft redistributables” in its version resource.
It beacons over plaintext HTTP every 10 seconds. It XOR-encodes its C2 host, port, and paths with the key 0x50. It identifies victims by joining username and computer name with an underscore.
The malware supports eight commands, covering remote shell execution (msg), directory listing (FDD), file deletion (DEL), arbitrary file execution (RUN), drive enumeration (GDR), screenshots (SS1), uploads (UPP), and downloads (DWW). Uploads and downloads include a one-time password code and a ClientID.
A newer Rust variant takes its name from the PDB file “requpap.pdb” and the product name “papsolutions.” It waits 42 seconds, then polls over HTTPS every 5 seconds. The destination server contains an LNK and the “icon.ico.”
![Image 3: Files on rappellingaart[.]com (Source : FortiGuard).](https://www.fortinet.com/it/blog/threat-research/bitter-expands-its-arsenal-with-paprat/jcrcontent/root/responsivegrid/tablecontent/par/image1401868303.img.png/1793308530787/fg19.png)
Files on rappellingaart[.]com (Source : FortiGuard).
Its constants are reversed and ROT-3 shifted. One decodes to the C2 URL www[.]rivingtonclarks[.]com/banana/. This matches an earlier “Banana Login” panel, part of a fruit-word naming pattern in the toolset.
The Rust build adds MS2 (PowerShell execution), SLP (sleep and resume polling), and BYE (process exit). C2 telemetry shows targets concentrated in South Asia.
WmRAT is a C++ RAT that gathers system information, takes screenshots, lists directories, and executes commands. Proofpoint documented it in December 2024, alongside MiyaRAT, in attacks on a Turkish defense organization.
That campaign used RAR archives with alternate data streams, scheduled tasks, and curl commands. In June 2025, Proofpoint and Threatray assessed that BITTER is a state-backed group collecting intelligence aligned with Indian government interests.
They also noted that it masquerades as diplomatic entities from China, Madagascar, Mauritius, and South Korea.
Defenders should monitor ftp.exe launching shell commands and scheduled tasks that pipe files into cmd.
They should also watch for conhost running headless, curl with disabled certificate checks, and mounted VHDX images. Block WebDAV access to untrusted hosts and the listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, and netmansrvdns[.]com.
The campaign shows BITTER blending native Windows tools with custom malware to stay quiet. The first chain avoids traditional executables, which reduces visibility for file-focused endpoint controls.
IOCs
| IOC Type | Indicator |
|---|---|
| Hostname | netmansrvdns[.]com |
| Hostname | rappellingaart[.]com |
| URL | hxxps://techtalkhelp[.]com/talk.log |
| URL | hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php |
| SHA256 (LNK) | a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c |
| SHA256 (LNK) | e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b |
Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.