Ethical Hacking News
A sophisticated cyberespionage campaign targeting South Asian organizations has been uncovered by Bitter, a South Asian cyber espionage group. The group has deployed a new remote access trojan called PapRAT, which has been designed to execute a range of commands. The malware has been delivered via three different infection chains and has been designed for remote control. The findings underscore the importance of monitoring malicious behavior and detecting known malware signatures, and highlight the need for increased vigilance and robust cybersecurity measures to prevent such attacks.
South Asian cyber espionage group Bitter (also known as APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has deployed a new remote access trojan (RAT) called PapRAT.PapRAT has been designed to execute a range of commands, including command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture.The malware has both C++ and Rust implementations, with the Rust variant adding PowerShell execution and other commands.The Bitter group has used three different infection chains to deploy PapRAT, including Windows Shortcut, VHDX disk image, and URL shortcut.The infection chains use a living-off-the-land (LotL) approach to execute commands from a remote server, collecting directory and task lists, and other information.The malware is designed for remote control, with eight commands, including MSG for remote shell and DEL for file deletion.The Bitter group has refined its custom arsenal, combining elements of previous attack chains to deploy PapRAT and its associated malware WmRAT.
The cybersecurity landscape has recently witnessed a significant escalation in the sophistication and complexity of cyberespionage campaigns, with the latest example being the deployment of a new remote access trojan (RAT) called PapRAT by a South Asian cyber espionage group known as Bitter. This group, also known by its aliases APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397, has been observed targeting South Asian organizations with PapRAT, a previously unreported malware that has been designed to execute a range of commands, including command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture.
According to Fortinet FortiGuard Labs researcher Cara Lin, PapRAT has both C++ and Rust implementations, and its capabilities are quite extensive. The Rust variant adds PowerShell execution and other commands, which further underscores the sophistication of this malware. The Bitter group has made use of three different infection chains to deploy PapRAT, including a Windows Shortcut (LNK) file that abuses the native "ftp.exe" utility to run scripts and create scheduled tasks designed to maintain contact with a command-and-control (C2) server.
Another infection chain employed by the Bitter group involves a VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet, while running an MSI installer in the background to deploy PapRAT. A third infection chain uses a URL shortcut (URL) file that fetches a LNK file via WebDAV, which then leads to an MSI installer that deploys PapRAT. These infection chains are notable for their use of a living-off-the-land (LotL) approach, which allows the attackers to execute commands from a remote server ("goodnfortunes[.]com"), allowing them to collect directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives.
The harvested reconnaissance information is saved as "abc.pdf" and exfiltrated back to the C2 server via a curl command, after which the staged file is deleted from the host. A second version of the script has been found to retrieve a file called "talk.log" from "techtalkhelp[.]com." The payload contains a Base64-encoded script to obtain additional instructions from the same server and execute them as PowerShell commands. This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect.
The PapRAT malware delivered via the MSI installer in the second attack chain is designed for remote control. It supports eight commands, including MSG, for remote shell; FDD, for directory listing; DEL, for file deletion; RUN, for arbitrary file execution; GDR, for drive enumeration; SS1, for screenshot capture; UPP, for uploading local files to the C2 server ("rivingtonclarks[.]com"); and DWW, for downloading files from the C2 server. A Rust version of the malware incorporates three more commands, including MS2, for PowerShell command execution; SLP, for sleeping and polling resumption; and BYE, for process termination.
The third attack chain is notable for combining the salient aspects of the first two sequences by using a script to download an MSI installer via curl. Like before, the MSI installer serves as a conduit for PapRAT, which then proceeds to drop WmRAT, a malware previously identified as used by Bitter. The findings indicate that the threat actor continues to refine its custom arsenal to establish and maintain access to targeted systems.
"These changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures," Fortinet said. "Organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages." The deployment of PapRAT by the Bitter group highlights the need for increased vigilance and robust cybersecurity measures to prevent such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Bitter-Hackers-Deploy-New-PapRAT-Backdoor-in-Sophisticated-Cyberespionage-Campaign-Targeting-South-Asia-ehn.shtml
https://thehackernews.com/2026/11/bitter-hackers-deploy-new-paprat.html
Published: Mon Nov 9 10:16:58 2026 by llama3.2 3B Q4_K_M
