Bitter APT drops a new PapRAT backdoor on South Asian targets using malicious VHDX disk images

What happened

Fortinet’s FortiGuard Labs disclosed a cyber-espionage campaign that deploys a new remote access trojan it calls PapRAT. FortiGuard attributes the campaign with high confidence to Bitter, also tracked as TA397, based on lure filenames, command-and-control patterns, file metadata and malware analysis (Infosecurity Magazine). Bitter is described as a suspected South Asian cyber-espionage group (Infosecurity Magazine) believed to be based in South Asia and active since at least 2013 (CybersecurityNews). Fortinet credits researcher Cara Lin and had tracked the campaign for several months before publishing (Infosecurity Magazine).

Targets. The campaign primarily hit organizations in South Asia, with telemetry also showing activity in Southeast Asia and South Korea (Infosecurity Magazine). No specific victim organizations are named (CybersecurityNews). Bitter’s broader history includes government, energy and engineering organizations (CybersecurityNews).

Lures. Victims were approached with a bilateral meeting request, an ambassador’s letter about the 11th Belt and Road Summit, and a 2026 gala dinner invitation, all arriving in unsolicited messages (Infosecurity Magazine, CybersecurityNews).

Three infection chains. FortiGuard documented three delivery routes (Infosecurity Magazine, CybersecurityNews):

1. Living off the land (LNK). A malicious Windows shortcut abuses the built-in ftp.exe to run a hidden script, creates scheduled tasks named “MicrosoftUpdates”, uses curl to fetch commands from attacker servers, and shows a fake Explorer error pop-up. No PapRAT or other malware binary is dropped, so operators can change their server-side instructions without pushing a new binary (Infosecurity Magazine, CybersecurityNews).
2. MSI hidden in a VHDX disk image. A disk image titled “Letter from the Ambassador - 11th Belt and Road Summit” contains a visible LNK plus hidden files “Attachment-2.xls” (a decoy spreadsheet) and “Visa_Details.msi”. The shortcut runs the installer in the background and opens the decoy (CybersecurityNews).
3. MSI via WebDAV from a RAR archive. A RAR archive named “Official Invitation Majilis 2026 Gala Dinner.rar” holds a URL shortcut that pulls a further shortcut and script over WebDAV; the script creates a scheduled task and installs “Imp_Details.msi”. This chain led to WmRAT. Cofense is cited for the fact that WebDAV connections skip the usual browser warnings (CybersecurityNews).

PapRAT capabilities. The original PapRAT is built in C++, disguised as a Microsoft component, and supports eight commands covering shell execution, folder listing, file deletion, program execution, drive listing, screenshots, and file upload and download. It beacons over plaintext HTTP every 10 seconds, uses XOR key 0x50 to hide the C2 address, and identifies victims as username_computername (Infosecurity Magazine, CybersecurityNews). A newer Rust variant switches to HTTPS and adds three commands (PowerShell execution, sleep and exit) for 11 in total, waits 42 seconds before starting, checks in every 5 seconds, and obfuscates constants with reversed text and ROT-3 (Infosecurity Magazine, CybersecurityNews). The dropped file is named “bruzsvc.exe” with product name “Microsoft redistributables”, and the Rust build carries the PDB name “requpap.pdb” and product name “papsolutions” (CybersecurityNews). In the WebDAV chain, PapRAT’s download command fetched “vnces.exe” (WmRAT), a C++ RAT used for system information, screenshots and command execution; FortiGuard cites WmRAT, previously documented by other researchers, as a further link to Bitter (Infosecurity Magazine, CybersecurityNews).

CVEs: none. No CVEs are mentioned in the reporting (Infosecurity Magazine, CybersecurityNews). This is a social-engineering and living-off-the-land campaign, not the exploitation of a software flaw.

Am I affected?

You are at risk if you run Windows endpoints in a government, diplomatic, energy or engineering organization in South Asia, Southeast Asia or South Korea, and users there may open attachments from unsolicited meeting or event invitations (Infosecurity Magazine, CybersecurityNews).

Hunt for these signs (CybersecurityNews):

• A scheduled task named “MicrosoftUpdates”, or ftp.exe spawning scripts or curl.
• Files named “bruzsvc.exe” or “vnces.exe”, or the PDB string “requpap.pdb”.
• Mounted VHDX images or RAR archives carrying hidden MSI files such as “Visa_Details.msi” or “Imp_Details.msi”.

Indicators of compromise reported by CybersecurityNews (defanged in the source) (CybersecurityNews):

• Hostnames: netmansrvdns[.]com (WmRAT C2); rappellingaart[.]com (hosts shortcut, script and MSI files).
• URLs: hxxps://techtalkhelp[.]com/talk.log; hxxp://www[.]rivingtonclarks[.]com/beautiQuewonders/banaNa.php (PapRAT C2); hxxps://goodnfortunes[.]com/ucl.php (upload and C2); hxxps://felixfuturenext[.]com/Epistemological/; hxxp://gomescareerplans[.]com/docs.
• SHA256 (LNK): a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c; e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b; ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88.
• SHA256 (PapRAT): 569a21b519aaac8c92f653d708ab6ef34e3f38ea967f47e041d1e2425f6a4b33.
• SHA256 (WmRAT): 411c0b9a2f98b927d806a685faf0c1ab1005647b4816157008892347fb88546b.

What to do now

1. Block and alert on the IOCs above at your proxy, DNS and endpoint tooling, then sweep for the hostnames, file names and hashes across your estate (CybersecurityNews).
2. Treat LNK files, internet shortcuts, disk images and MSI installers as suspect, as FortiGuard advises, especially when they arrive in unsolicited meeting or event invitations (Infosecurity Magazine).
3. Restrict native scripting engines and remove standing admin rights, so an intrusion that runs only on trusted system processes still has nothing easy to abuse (Infosecurity Magazine).
4. Do not assume one implant is the whole intrusion. A search for PapRAT alone could miss part of the campaign, and removing the first implant found might not remove the attacker (Infosecurity Magazine).
5. Hunt for the living-off-the-land chain directly: scheduled tasks named “MicrosoftUpdates”, ftp.exe running scripts, and curl reaching out to unknown servers, since that chain drops no binary to detect (Infosecurity Magazine, CybersecurityNews).
6. Warn diplomatic and policy staff about the specific lures in use: a bilateral meeting request, an ambassador’s letter on the 11th Belt and Road Summit, and a 2026 gala dinner invitation (Infosecurity Magazine, CybersecurityNews).

Sources

• Infosecurity Magazine, New PapRAT Backdoor Used in Bitter Cyber-Espionage Campaign
• CybersecurityNews, Hackers Use Malicious VHDX Files to Deliver PapRAT in Attacks
• Dark Reading, PapRAT cyberespionage campaign targets South Asia