BITTER espionage group deploys new PapRAT backdoor via three infection chains targeting South Asian organizations

Fortinet FortiGuard Labs published research on Nov 2 saying it has tracked, over several months, a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan it calls PapRAT for persistent access, attributing it to BITTER with high confidence ^[1]. The Hacker News reports that the campaign uses three infection chains, an LNK abusing ftp.exe, a VHDX image containing an LNK and a URL shortcut fetching an LNK via WebDAV, and that PapRAT has C++ and Rust versions able to run commands, transfer files and capture screenshots ^[1][2]. Organizations should treat unexpected LNK files, URL shortcuts, disk images and MSI packages with caution and monitor scripting tools, scheduled tasks and installer activity ^[2].

Industries mainly affected: Cross-industry

exe, a VHDX image containing an LNK and a URL shortcut fetching an LNK via WebDAV, and that PapRAT has C++ and Rust versions able to run commands, transfer files and capture screenshots ^[1]