BITTER uses malicious VHDX files and WebDAV to deliver PapRAT
Original title: Hackers Use Malicious VHDX Files and WebDAV Links to Infect Windows Devices With PapRAT Malware
BITTER deploys PapRAT RAT via VHDX files and WebDAV links targeting South Asian organizations since at least 2013.
A suspected espionage group BITTER is sending fake meeting letters and event invitations to organizations in South Asia. The files contain malicious VHDX disk images and WebDAV shortcuts that install the custom PapRAT remote access trojan on Windows computers. Fortinet researchers identified three infection chains relying on these methods. PapRAT communicates with attacker-controlled servers and supports commands for file management, screenshots, and executing additional tools like WmRAT.
- BITTER targets government, energy, and engineering organizations in South Asia
- Three infection chains use VHDX files, LNK shortcuts, and WebDAV
- PapRAT written in C++ and Rust; newer version uses HTTPS with 42-second wait
- C2 checks every 10 seconds or 5 seconds
- Avoid unexpected LNK files, disk images, and MSI packages
Impact: installation of custom remote access trojan PapRAT
- 1.treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution
- 2.watch for scripting tools, scheduled tasks, and installer activity
- Vendors
- Fortinet
- Products
- Windows
- Threat actors
- BITTER
- Victims
- organizations in South Asia
- Countries
- South Asia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | felixfuturenext.com | /goodnfortunes[.]com/ucl.php Data upload and C2 URL hxxps://felixfuturenext[.]com/Epistemological/ Campaign URL URL hxxp://gomescareerplans |
| domain | gomescareerplans.com | ixfuturenext[.]com/Epistemological/ Campaign URL URL hxxp://gomescareerplans[.]com/docs Campaign URL SHA256 (LNK) a3081df333ca7f18bd90d10a45 |
| domain | goodnfortunes.com | rks[.]com/beautiQuewonders/banaNa.php PapRAT C2 URL hxxps://goodnfortunes[.]com/ucl.php Data upload and C2 URL hxxps://felixfuturenext[.] |
| domain | netmansrvdns.com | of compromise (IoCs):- Type Indicator Description Hostname netmansrvdns[.]com WmRAT C2 Hostname rappellingaart[.]com Hosts shortcut, sc |
| domain | rappellingaart.com | r Description Hostname netmansrvdns[.]com WmRAT C2 Hostname rappellingaart[.]com Hosts shortcut, script, and MSI files URL hxxps://techtal |
| domain | techtalkhelp.com | art[.]com Hosts shortcut, script, and MSI files URL hxxps://techtalkhelp[.]com/talk.log Script download URL hxxp://www[.]rivingtonclarks |
| domain | www.rivingtonclarks.com | ps://techtalkhelp[.]com/talk.log Script download URL hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php PapRAT C2 URL hxxps://goodn |
| sha256 | 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b | 3f38ea967f47e041d1e2425f6a4b33 PapRAT sample SHA256 (WmRAT) 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b WmRAT sample Note: IP addresses and domains are intentional |
| sha256 | 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 | 4d1c598bfcf15cf5f3591c88 Malicious shortcut SHA256 (PapRAT) 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33 PapRAT sample SHA256 (WmRAT) 411c0b9a2f98b927d806a685faf0c1 |
| sha256 | a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c | xxp://gomescareerplans[.]com/docs Campaign URL SHA256 (LNK) a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c Malicious shortcut SHA256 (LNK) e3992f8c945b0761242377cba32 |
| sha256 | ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 | 7cecd79478439843d93e6d2b76b Malicious shortcut SHA256 (LNK) ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 Malicious shortcut SHA256 (PapRAT) 569a21b519aaac8c92f653d7 |
| sha256 | e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b | f9d2806feae2935f09cab07da4c Malicious shortcut SHA256 (LNK) e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b Malicious shortcut SHA256 (LNK) ccefbdec2718d864d9d33c743aa |
| url | http://gomescareerplans.com/docs | s://felixfuturenext[.]com/Epistemological/ Campaign URL URL hxxp://gomescareerplans[.]com/docs Campaign URL SHA256 (LNK) a3081df333ca7f18bd90d10a45125ab |
| url | https://felixfuturenext.com/Epistemological/ | hxxps://goodnfortunes[.]com/ucl.php Data upload and C2 URL hxxps://felixfuturenext[.]com/Epistemological/ Campaign URL URL hxxp://gomescareerplans[.]com/docs Campa |
| url | https://goodnfortunes.com/ucl.php | ngtonclarks[.]com/beautiQuewonders/banaNa.php PapRAT C2 URL hxxps://goodnfortunes[.]com/ucl.php Data upload and C2 URL hxxps://felixfuturenext[.]com/Epis |
| url | https://techtalkhelp.com/talk.log | pellingaart[.]com Hosts shortcut, script, and MSI files URL hxxps://techtalkhelp[.]com/talk.log Script download URL hxxp://www[.]rivingtonclarks[.]com/be |
| url | http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php | URL hxxps://techtalkhelp[.]com/talk.log Script download URL hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php PapRAT C2 URL hxxps://goodnfortunes[.]com/ucl.php Data |
From the original article
4 min read at cybersecuritynews.com
A suspected espionage group is sending fake meeting letters and event invitations to organizations in South Asia. The files look harmless, but they quietly install a custom remote access trojan called PapRAT on Windows computers. The campaign uses Windows disk images, shortcut files, and remote web folders to avoid easy detection.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.