South Asian organizations have been targeted in a cyberespionage campaign deploying a previously undocumented remote access trojan called PapRAT. The activity has been attributed to the suspected South Asian state-aligned threat group known as Bitter, which refreshed its custom malware repository to deepen surveillance capabilities across the region.

According to analysis by Fortinet FortiGuard Labs reported by The Hacker News, the threat actor built PapRAT in both C++ and Rust implementations. The backdoor provides typical surveillance functions, including directory enumeration, file theft, arbitrary command execution, and display monitoring, allowing operators to systematically harvest intelligence from compromised networks.

Three Flexible Infection Sequences

Researchers identified three separate attack paths deployed by Bitter, each leveraging living-off-the-land techniques to circumvent conventional endpoint defenses and bypass email inspection gateways.

The first infection sequence relies on a weaponized Windows shortcut (LNK) file. Rather than executing an embedded payload directly, the shortcut abuses the built-in Windows utility ftp.exe to run external scripts and establish persistent scheduled tasks. This mechanism connects back to a command-and-control server hosted at goodnfortunes[.]com, which dynamically serves reconnaissance instructions.

The second vector delivers a virtual hard disk (VHDX) image containing a malicious shortcut. When opened, the LNK file displays a decoy Microsoft Excel spreadsheet to distract the victim while quietly triggering a Windows Installer (MSI) package in the background to execute the primary PapRAT payload.

The third infection chain initiates through a URL shortcut file that reaches out via WebDAV to pull down a secondary LNK file. A script then downloads an MSI installer using curl, installing PapRAT and ultimately dropping WmRAT, a recognized backdoor previously tied to Bitter campaigns.

Living-off-the-Land Reconnaissance and PapRAT Internals

In the initial phase of the intrusion, the attacker-controlled scripts gather critical environment data, including lists of running tasks, mounted storage volumes, installed antivirus engines, and contents stored in standard user folders such as Desktop, Documents, and Downloads. The gathered reconnaissance data is packaged into a temporary file named abc.pdf, exfiltrated via curl, and subsequently deleted to limit digital footprints.

In alternative staging runs, the operators fetched a secondary script disguised as talk.log from techtalkhelp[.]com. This payload contains Base64-encoded instructions that execute dynamically in memory through PowerShell, avoiding typical on-disk portable executable (PE) drops and process injection hooks monitored by security software.

Once installed via the MSI package, the C++ variant of PapRAT connects to its command infrastructure at rivingtonclarks[.]com and accepts eight baseline commands:

  • MSG: Spawns an interactive remote shell
  • FDD: Retrieves file directory listings
  • DEL: Deletes specific files from the filesystem
  • RUN: Executes arbitrary binaries
  • GDR: Enumerates logical drives
  • SS1: Captures desktop screenshots
  • UPP: Transmits host files to the C2 server
  • DWW: Downloads remote payloads onto the endpoint

The newer Rust-based iteration includes all C++ capabilities alongside three expanded commands: MS2 for executing PowerShell scripts, SLP for modifying polling intervals and sleep timers, and BYE to terminate malicious processes cleanly.

Targeting Profile and Attribution

The campaign specifically singled out entities across South Asia, aligning with historic target profiles of Bitter, an espionage actor tracked alternatively as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397. The adversary has maintained persistent operations against regional diplomatic, military, and energy interests for over a decade.

The dual use of Rust and C++ reflects a broader pattern among espionage operators migrating legacy codebases to modern programming languages. Modern languages can complicate static detection and reverse-engineering efforts while allowing rapid implementation of cross-compatible backdoor modules.

What You Should Do

Security teams defending networks across targeted regions should take immediate measures to mitigate the initial delivery vectors and execution mechanisms exploited in these operations:

  • Restrict unapproved container and script files: Block or quarantine incoming emails carrying archive or virtual disk attachments, including VHDX, ISO, LNK, and URL shortcuts.
  • Audit living-off-the-land binaries: Monitor or restrict command-line executions of native utilities such as ftp.exe and curl.exe, particularly when invoked as child processes of script engines or scheduled tasks.
  • Monitor MSI installer activity: Restrict standard user rights from launching arbitrary MSI files and flag automated installations originating from non-standard or temporary user paths.
  • Block outbound command-and-control infrastructure: Ingest known campaign infrastructure, including goodnfortunes[.]com, techtalkhelp[.]com, and rivingtonclarks[.]com, into network perimeter and DNS firewalls.
  • Inspect WebDAV network traffic: Restrict outbound WebDAV connectivity and monitor unusual remote file accesses initiated by shortcut files.