Bitter Espionage Campaign: The New PapRAT Backdoor, Explained

The South Asian cyber espionage group Bitter (APT-C-08, Hazy Tiger, Orange Yali, TA397) is targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.

PapRAT has both C++ and Rust implementations, with command execution, file upload/download, deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands.

Three Infection Chains

The campaign chains three lure paths into the same implant:

1. Windows Shortcut (LNK) file that abuses the native ftp.exe utility to run scripts and plant scheduled tasks phoning home to a C2.
2. VHDX disk image containing a LNK file that opens a lure Excel spreadsheet while an MSI installer deploys PapRAT in the background.
3. URL shortcut (URL) file that fetches a LNK over WebDAV, which leads to an MSI that deploys PapRAT — and in one chain, drops a previously identified Bitter malware, WmRAT.

All chains use living-off-the-land staging: goodnfortunes[.]com runs commands to collect directory/task lists, Desktop/Documents/Downloads state, installed-antivirus data, and mounted drives. Recon output is saved as abc.pdf and exfiltrated via curl, then deleted. A second script fetches talk.log from techtalkhelp[.]com, decodes a Base64 PowerShell payload, and executes it.

PapRAT Commands

The MSI-delivered implant supports eight commands: MSG (remote shell), FDD (directory listing), DEL (delete), RUN (execute file), GDR (drive enumeration), SS1 (screenshot), UPP (upload to rivingtonclarks[.]com), and DWW (download). The Rust variant adds MS2 (PowerShell), SLP (sleep/poll), and BYE (terminate).

The operational flexibility is the point: commands update server-side without new binaries, avoiding PE drops and process injection that security appliances flag.

What Defenders Should Watch

Fortinet's advice is to monitor scripting tools, scheduled tasks, and installer activity alongside known-malware signatures. Specifically:

• Treat unexpected LNK files, URL shortcuts, disk images, and MSI packages — especially via unsolicited messages — with suspicion.
• Hunt the C2 domains: goodnfortunes[.]com, techtalkhelp[.]com, rivingtonclarks[.]com.
• Look for ftp.exe spawning scripts and curl-based exfiltration writing abc.pdf, plus new scheduled tasks after LNK execution.

Your First 7 Days as a Defender

Day one: grep proxy logs and EDR telemetry for LNK/URL execution chains ending in ftp.exe or curl.exe writing abc.pdf, and hunt the three C2 domains across DNS and flow logs. Day two: review scheduled-task creation events paired with ftp.exe parent processes — the scheduled task is the persistence hook. Day three: block and sinkhole the three domains at the DNS layer; then retro-hunt any host that reached them for downloads and PowerShell payloads. Day four: inventory MSI installations and VHDX mounts from unknown mail domains in the last 90 days. Days five to seven: walk the PapRAT command set against your detection engineering — MSG, RUN, and MS2 should each have an EDR signal. Every confirmed host is treated as fully compromised until rebuilt.

Sources

• The Hacker News coverage
• Fortinet FortiGuard Labs analysis