BITTER group targets South Asian organisations with PapRAT

FortiGuard Labs has uncovered a cyber espionage operation targeting government, energy and engineering organisations across South Asia, attributed with high confidence to the BITTER group (TA397). The campaign deploys PapRAT—malware written in C++ and a newer Rust variant—alongside a secondary implant named WmRAT.

Victims are lured via spear-phishing emails containing three different infection paths that reference regional diplomatic and military events, including filenames linked to meetings at the 22nd Heads of Asian Coast Guard Agencies Meeting, the 11th Belt and Road Summit, and invitations to a 2026 gala dinner. The operation’s regional focus is supported by C2 telemetry and the lure themes.

The infection chain relies on three distinct delivery paths. The first uses a Windows shortcut that abuses ftp.exe to run a shell command, piping instructions into the command processor. The second and third chains drop the PapRAT binary through decoy documents and installers delivered via a mounted VHDX disk image or WebDAV-sourced shortcuts, with a decoy Excel sheet and a background Windows Installer package.

Once active, PapRAT masquerades as a legitimate Microsoft background service and periodically communicates with its command server over plain HTTP, using a XOR-encoded hostnames and ports. The original C++ build supports at least eight tasks (shell access, directory listing, file transfers, screenshot capture, etc.), while the WebDAV path delivers WmRAT as a secondary payload.

A Rust rewrite expands the command set to eleven, introduces reversed-string storage with ROT-3, delays initial contact, and adds dedicated directives for PowerShell and controlled termination.

Defence guidance in the report emphasises monitoring for living-off-the-land techniques, unusual ftp.exe or conhost.exe shells, and suspicious scheduled tasks. It also recommends blocking outbound WebDAV traffic and restricting mounting of external VHDX files, plus hunts for residual persistence after incidents.