Bitter APT Group Targets South Asian Organizations with New PapRAT Malware
The South Asian cyber espionage group known as Bitter, also tracked as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17 and TA397, has been observed targeting organizations across South Asia with a previously undocumented remote access trojan called PapRAT.
According to Fortinet FortiGuard Labs, the malware is available in both C++ and Rust implementations and provides attackers with extensive remote control capabilities, including command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture.
The Rust variant introduces additional functionality, including PowerShell command execution and other commands.
Researchers identified three separate infection chains used to deliver the malware, demonstrating the group's continued development of custom tools and delivery techniques.
Three Infection Chains Used to Deploy PapRAT
The campaign uses different Windows-based delivery methods to compromise targeted systems.
1. Malicious Windows Shortcut Files
The first infection chain uses a Windows Shortcut (LNK) file that abuses the legitimate Windows ftp.exe utility to execute scripts.
The scripts create scheduled tasks designed to maintain communication with an attacker-controlled command-and-control (C2) server.
2. VHDX Disk Images and MSI Installers
The second infection chain distributes a VHDX virtual disk image containing a malicious LNK file.
When opened, the shortcut launches a decoy Microsoft Excel spreadsheet to make the activity appear legitimate. At the same time, an MSI installer executes in the background and deploys PapRAT.
3. URL Shortcuts and WebDAV
The third infection chain begins with a URL shortcut file that retrieves an LNK file through WebDAV.
The downloaded shortcut then leads to an MSI installer that deploys PapRAT. This infection chain also combines techniques from the earlier delivery methods by using scripts and curl to download the installer.
Living-off-the-Land Techniques for Reconnaissance
The attackers use legitimate Windows utilities and scripting capabilities to execute commands received from remote infrastructure, reducing their reliance on conventional malware execution methods.
One of the identified command-and-control domains is:
goodnfortunes[.]com
The scripts collect information about compromised systems, including:
- Directory and scheduled task listings.
- Files and directory information from Desktop, Documents and Downloads.
- Installed antivirus products.
- Mounted drives.
The collected reconnaissance information is saved in a file named abc.pdf and transferred to the C2 server using a curl command. After the transfer, the staged file is deleted from the compromised system.
Researchers also identified another script variant that retrieves a file named talk.log from:
techtalkhelp[.]com
The file contains a Base64-encoded script that obtains additional instructions from the same server and executes them as PowerShell commands.
According to Fortinet, this server-side staging approach allows attackers to modify their commands without distributing a new executable. It also reduces reliance on techniques such as PE file drops and process injection, which may be easier for some security products to detect.
PapRAT Provides Extensive Remote Control Capabilities
The PapRAT variant delivered through the MSI installer supports eight commands that allow attackers to remotely control compromised systems.
CommandFunctionMSGRemote shellFDDDirectory listingDELFile deletionRUNExecute arbitrary filesGDREnumerate drivesSS1Capture screenshotsUPPUpload local files to the C2 serverDWWDownload files from the C2 server
The malware uses the following domain for file transfer operations:
rivingtonclarks[.]com
The Rust implementation includes three additional commands:
CommandFunctionMS2Execute PowerShell commandsSLPSleep and resume pollingBYETerminate the process
These capabilities allow the operators to collect information, execute additional tools, manipulate files and maintain remote access to compromised machines.
PapRAT Can Also Deliver WmRAT
A notable feature of the third infection chain is its ability to deliver another malware family previously associated with Bitter.
After downloading and executing the MSI installer, PapRAT can proceed to deploy WmRAT, a malware family previously identified in operations attributed to the group.
This connection indicates that Bitter continues to integrate its existing malware arsenal with newer delivery methods and custom remote access tools.
Security Recommendations
Fortinet emphasized the importance of monitoring suspicious activity across scripting tools, scheduled tasks and installer execution rather than relying exclusively on known malware signatures.
Organizations should take the following precautions:
- Treat unexpected LNK files, URL shortcuts, VHDX disk images and MSI installers with caution.
- Monitor unusual execution of legitimate Windows utilities such as
ftp.exeandcurl. - Investigate unexpected scheduled task creation.
- Monitor suspicious PowerShell execution and encoded commands.
- Review outbound connections to unfamiliar domains.
- Monitor unusual file creation and deletion activity in user directories.
- Investigate unexpected MSI installations and DLL execution chains.
Bitter Continues to Expand Its Malware Arsenal
The PapRAT campaign highlights Bitter's continued development of custom malware and flexible infection chains targeting South Asian organizations.
By combining malicious shortcuts, virtual disk images, WebDAV downloads, MSI installers and legitimate Windows utilities, the group can establish remote access while making its activity harder to distinguish from normal system operations.
The addition of a Rust-based PapRAT variant and its ability to deploy WmRAT further demonstrate the group's evolving approach to cyber espionage and persistent access.
