BITTER Delivers PapRAT via Fake Diplomatic Invitations
Original title: Hackers Hide PapRAT Malware in Fake Diplomatic Invitations to Take Control of Windows Systems
The BITTER group uses custom RAT PapRAT and WmRAT in lures targeting South Asian organizations.
BITTER threat group campaigns deliver PapRAT and WmRAT through malicious LNK files, VHDX images, and RAR archives disguised as diplomatic invitations. Chains abuse native Windows tools like ftp.exe and scheduled tasks to fetch scripts from C2 servers without dropping executables. PapRAT supports remote shell, file operations, and screenshots while WmRAT beacons over HTTP or HTTPS.
- Lures include NV-683 Request for Bilateral Meeting and Official Invitation Majilis 2026 Gala Dinner
- Scheduled tasks disguised as Microsoft updates
- PapRAT drops via Type 194 CustomAction in MSI
- WmRAT variant from PDB requpap.pdb
- C2 domains include rappellingaart[.]com and rivingtonclarks[.]com
Impact: remote access and system compromise
- 1.Block C2 domains: rappellingaart[.]com, rivingtonclarks[.]com, techtalkhelp.com
- 2.Monitor for suspicious LNK files and scheduled tasks
- 3.Disable WebDAV access to untrusted hosts
- Threat actors
- BITTER
- Victims
- South Asian organizations
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | chestergreenfarming.com | clarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, and netmansrvdns[.]com. The campaign shows BITTER blendi |
| domain | gomescareerplans.com | htalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com, and netmansrvdns[.]com. The c |
| domain | goodnfortunes.com | WebDAV access to untrusted hosts and the listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[ |
| domain | netmansrvdns.com | com, gomescareerplans[.]com, chestergreenfarming[.]com, and netmansrvdns[.]com. The campaign shows BITTER blending native Windows tools |
| domain | rappellingaart.com | Guard). The shortcut retrieves an LNK file over WebDAV from rappellingaart[.]com, and the chain then runs Imp_Details.msi to deploy PapRAT |
| domain | rivingtonclarks.com | e listed C2 domains: goodnfortunes[.]com, techtalkhelp.com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergre |
| domain | techtalkhelp.com | etmansrvdns[.]com Hostname rappellingaart[.]com URL hxxps://techtalkhelp[.]com/talk.log URL hxxp://www[.]rivingtonclarks[.]com/beautiQue |
| domain | www.rivingtonclarks.com | s are reversed and ROT-3 shifted. One decodes to the C2 URL www[.]rivingtonclarks[.]com/banana/. This matches an earlier “Banana Login” panel, |
| sha256 | a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c | ingtonclarks[.]com/beautiQuewonders/banaNa.php SHA256 (LNK) a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c SHA256 (LNK) e3992f8c945b0761242377cba32d91b0a390c7cecd7947 |
| sha256 | e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b | 90d10a45125ab5011dcf9d2806feae2935f09cab07da4c SHA256 (LNK) e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b Note: IP addresses and domains are intentionally defanged ( |
| url | https://techtalkhelp.com/talk.log | stname netmansrvdns[.]com Hostname rappellingaart[.]com URL hxxps://techtalkhelp[.]com/talk.log URL hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/b |
| url | http://www.rivingtonclarks.com/beautiQuewonders/banaNa.php | llingaart[.]com URL hxxps://techtalkhelp[.]com/talk.log URL hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php SHA256 (LNK) a3081df333ca7f18bd90d10a45125ab5011dcf9d28 |
From the original article
3 min read at gbhackers.com
A campaign by the BITTER threat group that delivers a custom remote access trojan (RAT) called PapRAT to South Asian organizations. FortiGuard attributes the activity to the group with high confidence, based on lure filenames, command-and-control (C2) patterns, file metadata, and malware analysis The campaign uses three chains. The first relies on a malicious LNK […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.