The South Asian cyber espionage group known as Bitter has been observed deploying a new remote access trojan (RAT) named PapRAT in a series of targeted attacks against organizations in the region. This development, reported by Fortinet’s FortiGuard Labs, highlights the group’s evolving tactics and the sophistication of their malware arsenal.
According to Fortinet researcher Cara Lin, PapRAT is notable for its dual implementations in C++ and Rust, offering capabilities such as command execution, file management, and screenshot capture. The Rust variant further enhances functionality by allowing PowerShell execution and additional commands, making it a versatile tool for cyber espionage.
Complex Infection Chains
The campaign leverages three distinct infection chains to deliver PapRAT:
- A Windows Shortcut (LNK) file that exploits the native “ftp.exe” utility to execute scripts and create scheduled tasks for maintaining contact with a command-and-control (C2) server.
- A VHDX disk image containing a LNK file that launches a decoy Microsoft Excel spreadsheet while running an MSI installer in the background to deploy PapRAT.
- A URL shortcut (URL) file that retrieves a LNK file via WebDAV, leading to an MSI installer that installs PapRAT.
This living-off-the-land (LotL) approach allows the malware to execute commands from a remote server, gathering sensitive information such as directory listings, installed antivirus data, and mounted drives. The reconnaissance data is then exfiltrated back to the C2 server using a curl command, after which the local copy is deleted to cover the tracks.
Operational Flexibility and Command Structure
In addition to its initial capabilities, a second version of the PapRAT script has been identified, which retrieves a Base64-encoded script from a different server to execute further commands. This staging model provides attackers with operational flexibility, enabling them to update commands server-side without needing to deploy new binaries, thus evading detection by security appliances.
The PapRAT malware supports a range of commands for remote control, including:
- MSG for remote shell access
- FDD for directory listing
- DEL for file deletion
- RUN for executing arbitrary files
- GDR for drive enumeration
- SS1 for capturing screenshots
- UPP for uploading files to the C2 server
- DWW for downloading files from the C2 server
The Rust version of PapRAT adds three additional commands, enhancing its functionality further. Notably, one of the attack chains combines elements from previous sequences, using a script to download an MSI installer via curl, which then drops another malware variant known as WmRAT, previously associated with Bitter.
Implications for Cybersecurity
The emergence of PapRAT underscores the need for organizations to enhance their monitoring of malicious behaviors, particularly those involving scripting tools, scheduled tasks, and installer activities. Fortinet emphasizes the importance of treating unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, especially when received through unsolicited communications.
As Bitter continues to refine its tactics and tools, cybersecurity professionals must remain vigilant and proactive in defending against such sophisticated threats. For further details on this evolving threat landscape, refer to The Hacker News.
