NEWS

Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

Fortinet details PapRAT, a new C++ and Rust backdoor used by the Bitter APT against South Asian organizations through LNK, VHDX and MSI chains.

Dylan H.

News Desk

November 9, 2026
2 min read
Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia

Overview

The South Asian cyberespionage group Bitter (also tracked as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan, PapRAT. Fortinet FortiGuard Labs researcher Cara Lin reported that it has both C++ and Rust implementations.

Capabilities

Common features include command execution, file upload and download, file deletion, directory and drive enumeration, and screenshot capture. The MSI-delivered version supports eight commands:

CommandFunction
MSGRemote shell
FDDDirectory listing
DELFile deletion
RUNArbitrary execution
GDRDrive enumeration
SS1Screenshot
UPPUpload to C2
DWWDownload from C2

The Rust version adds MS2 (PowerShell execution), SLP (sleep and polling resumption), and BYE (process termination).

Infection Chains

  1. A Windows LNK file abuses the native ftp.exe utility to run scripts and create scheduled tasks for C2 contact.
  2. A VHDX disk image holds an LNK that opens a decoy Excel spreadsheet while silently running an MSI installer that deploys PapRAT.
  3. A URL shortcut fetches an LNK over WebDAV, leading to an MSI installer. A related chain uses a script that downloads an MSI via curl, and PapRAT then drops WmRAT, a malware family previously tied to Bitter.

Infrastructure and Behavior

  • A living-off-the-land script contacts goodnfortunes[.]com to collect directory and task lists, Desktop, Documents and Downloads contents, installed antivirus data, and mounted drives. Results are saved as abc.pdf, sent via curl, and deleted.
  • A second script fetches talk.log from techtalkhelp[.]com, holding Base64-encoded PowerShell that pulls further instructions.
  • The MSI-delivered PapRAT uses rivingtonclarks[.]com as its upload C2 endpoint.

Commands are updated server-side, so the operators can change behavior without shipping a new binary, avoiding PE drops and process injection that security tools might flag.

Defensive Guidance

  • Treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, especially from unsolicited messages.
  • Monitor behavior across scripting tools, scheduled tasks, and installer activity rather than relying only on known signatures.
  • Block or alert on the domains above and on ftp.exe launched with script arguments.
  • Restrict mounting of VHDX/ISO images from email and downloads where practical.

Sources