Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations.

FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis

The campaign uses three chains. The first relies on a malicious LNK file that abuses the native Windows ftp.exe utility.

The “!” prefix makes ftp.exe run the following token as a local shell command, so “!more res.ico” pipes a script into cmd. This living-off-the-land technique sidesteps monitoring that focuses on PowerShell or wscript.

The script creates a scheduled task disguised as a Microsoft update and uses curl to contact the C2 server, saving output in a file named err.log.

It then shows a fake “Explorer was unable to open this file!” message. Lures include “NV-683 Request for Bilateral Meeting during 22nd HACGAM.”

The scheduled task fetches a Base64-encoded script that pulls further commands from another URL. Because attackers update those commands server-side, they don’t need to push a new binary.

This avoids PE drops and process injection that security appliances detect more easily. One recovered script performs reconnaissance, collecting directory listings, running tasks, installed antivirus data, and mounted drives.

The second chain starts with a VHDX disk image named “Letter from the Ambassador – 11th Belt and Road Summit.”

Attack chains (Source : FortiGuard).

Once mounted, it exposes one visible LNK file and two hidden files: a decoy spreadsheet and an MSI installer, Visa_Details.msi. The LNK silently runs the installer while opening the decoy.

FortiGuard Labs observed that, BITTER is a suspected South Asian cyberespionage actor active since at least 2013, with a history of targeting government, energy, and engineering sectors.

The MSI has no legitimate installation function. Its only executable action is a Type 194 CustomAction that drops PapRAT.

The third chain begins with “Official Invitation Majilis 2026 Gala Dinner.rar,” which holds a URL shortcut.

LNK file to start MSI and XLSX (Source : FortiGuard).

The shortcut retrieves an LNK file over WebDAV from rappellingaart[.]com, and the chain then runs Imp_Details.msi to deploy PapRAT. Here, PapRAT also downloads a secondary implant, vnces.exe, which is WmRAT.

The C++ build masquerades as bruzsvc.exe, with “Microsoft Corporation” and “Microsoft redistributables” in its version resource.

It beacons over plaintext HTTP every 10 seconds. It XOR-encodes its C2 host, port, and paths with the key 0x50. It identifies victims by joining username and computer name with an underscore.

The malware supports eight commands, covering remote shell execution (msg), directory listing (FDD), file deletion (DEL), arbitrary file execution (RUN), drive enumeration (GDR), screenshots (SS1), uploads (UPP), and downloads (DWW). Uploads and downloads include a one-time password code and a ClientID.

A newer Rust variant takes its name from the PDB file “requpap.pdb” and the product name “papsolutions.” It waits 42 seconds, then polls over HTTPS every 5 seconds. The destination server contains an LNK and the “icon.ico.”

![Image 3: Files on rappellingaart[.]com (Source : FortiGuard).](https://www.fortinet.com/it/blog/threat-research/bitter-expands-its-arsenal-with-paprat/jcrcontent/root/responsivegrid/tablecontent/par/image1401868303.img.png/1793308530787/fg19.png)

Files on rappellingaart[.]com (Source : FortiGuard).

Its constants are reversed and ROT-3 shifted. One decodes to the C2 URL www[.]rivingtonclarks[.]com/banana/. This matches an earlier “Banana Login” panel, part of a fruit-word naming pattern in the toolset.

The Rust build adds MS2 (PowerShell execution), SLP (sleep and resume polling), and BYE (process exit). C2 telemetry shows targets concentrated in South Asia.

WmRAT is a C++ RAT that gathers system information, takes screenshots, lists directories, and executes commands. Proofpoint documented it in December 2024, alongside MiyaRAT, in attacks on a Turkish defense organization.

That campaign used RAR archives with alternate data streams, scheduled tasks, and curl commands. In June 2025, Proofpoint and Threatray assessed that BITTER is a state-backed group collecting intelligence aligned with Indian government interests.

They also noted that it masquerades as diplomatic entities from China, Madagascar, Mauritius, and South Korea.

Defenders should monitor ftp.exe launching shell commands and scheduled tasks that pipe files into cmd.

They should also watch for conhost running headless, curl with disabled certificate checks, and mounted VHDX images. Block WebDAV access to untrusted hosts and the listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, and netmansrvdns[.]com.

The campaign shows BITTER blending native Windows tools with custom malware to stay quiet. The first chain avoids traditional executables, which reduces visibility for file-focused endpoint controls.

IOCs

IOC TypeIndicator
Hostnamenetmansrvdns[.]com
Hostnamerappellingaart[.]com
URLhxxps://techtalkhelp[.]com/talk.log
URLhxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php
SHA256 (LNK)a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c
SHA256 (LNK)e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.