Bitter deploys PapRAT backdoor against South Asian organizations
Original title: Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia
Fortinet describes C++ and Rust PapRAT builds delivered through LNK, VHDX, and WebDAV chains, with one chain also dropping WmRAT.
Fortinet FortiGuard Labs says the South Asian espionage group Bitter is targeting South Asian organizations with PapRAT, a previously unreported remote access trojan. The malware has C++ and Rust implementations and supports command execution, file transfer, deletion, directory and drive listing, and screenshots; the Rust build adds PowerShell execution. Three chains use an LNK that abuses ftp.exe and scheduled tasks, a VHDX that launches an Excel lure and MSI installer, or a URL shortcut that fetches a LNK over WebDAV. One chain later drops WmRAT.
Unconfirmed: Fortinet attributes the activity to Bitter; the report does not name individual victim organizations.
- Bitter is also known as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397.
- Reconnaissance is saved as abc.pdf and sent to the C2 with curl, then deleted.
- A second script retrieves talk.log from techtalkhelp[.]com and runs Base64 PowerShell instructions.
- PapRAT C2 servers named include goodnfortunes[.]com and rivingtonclarks[.]com.
- The Rust variant adds MS2, SLP, and BYE commands.
Impact: Remote control, file theft, screenshots, and follow-on malware
- 1.Treat unexpected LNK files, URL shortcuts, disk images, and MSI packages from unsolicited messages with caution.
- 2.Monitor scripting tools, scheduled tasks, and installer activity, not only known malware signatures.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | goodnfortunes.com | oach is designed to execute commands from a remote server ("goodnfortunes[.]com"), allowing it to collect directory and task lists, direc |
| domain | rivingtonclarks.com | t capture UPP, for uploading local files to the C2 server ("rivingtonclarks[.]com") DWW, for downloading files from the C2 server A Rust ve |
| domain | techtalkhelp.com | t has been found to retrieve a file called "talk.log" from "techtalkhelp[.]com." The payload contains a Base64-encoded script to obtain |
From the original article
2 min read at thehackernews.com
The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT. "PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said. "Its capabilities include command execution, file
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.