PapRAT: South Asian orgs — Bitter APT deploys new C++/Rust backdoor via LNK/VHDX/URL infection chains
Severity: medium · Patch status: no-fix-needed · Since 2026-11-02
FortiGuard Labs (researcher Cara Lin, published 2026-11-02) attributes a backdoor it calls PapRAT to the South Asia-focused espionage group Bitter, with high confidence, on the basis of lure filenames, C2 communication patterns, file metadata and malware analysis. The post describes the targets as South Asian organizations, with telemetry also showing activity in Southeast Asia and South Korea, and names no specific countries. Three infection chains use lure documents (an ambassador's letter, a bilateral meeting request, a gala dinner invitation). The first is a LNK file that abuses ftp.exe to run scripts and scheduled tasks that poll attacker servers via curl, and that profiles the victim into abc.pdf before uploading it; no malware binary is dropped in that chain. The second is a VHDX disk image holding a LNK, a decoy spreadsheet and a hidden MSI that deploys PapRAT. The third is a URL shortcut inside a RAR archive that leads to a LNK, a scheduled task and an MSI that deploys PapRAT, which in turn downloads WmRAT. PapRAT has a C++ build with eight commands (remote shell, directory listing, file upload, download and deletion, command execution, drive enumeration, screenshots) and a later Rust build with eleven commands that adds PowerShell execution, sleep and exit. No software vulnerability is exploited and no fix exists, so detection and user caution are the mitigations.
What to do
- Treat unsolicited LNK files, URL shortcuts (including ones inside RAR archives), VHDX disk images and MSI packages as suspicious, and block or inspect them at email gateways
- Monitor for abuse of ftp.exe, curl and scheduled tasks that poll remote servers every 15 to 49 minutes, and for connections to goodnfortunes[.]com, techtalkhelp[.]com, rivingtonclarks[.]com, rappellingaart[.]com, gomescareerplans[.]com, chestergreenfarming[.]com and netmansrvdns[.]com
- Detect known PapRAT and WmRAT behaviour and alert on MSI installers that spawn unusual child processes
- Harden endpoints against living-off-the-land techniques and review EDR telemetry for reconnaissance output such as abc.pdf
- Educate users in at-risk South Asian sectors about lure documents that arrive as shortcuts, disk images or archives
Sources
All live incidents on Threat Watch
