{"id":4038,"date":"2026-11-09T15:51:59","date_gmt":"2026-11-09T15:51:59","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4038"},"modified":"2026-11-09T15:51:59","modified_gmt":"2026-11-09T15:51:59","slug":"bitter-hackers-deploy-new-paprat-backdoor-in-cyberespionage-campaign-targeting-south-asia","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4038","title":{"rendered":"Bitter Hackers Deploy New PapRAT Backdoor in Cyberespionage Campaign Targeting South Asia"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Nov 09, 2026<\/span><\/span><span class=\"p-tags\">Cyber Espionage \/ Threat Intelligence<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgQwQpjbb2oT57o807l7YmQ31V2RbyxqqO4hENkKlfikKKH-LeqSUiYz5AaPCCFWml-l_RaN1JMiwbJa9lJe7z7Ijzdk66icRP70eETLZ7lLomkSa3JjezoxbRNeDEkTv0K-26dSzHKxAjc7xyLA9RbIiERPLqyRu5QzfyrPeyIA4dfLzMil5wDkYN9n4sG\/s1700-nu-rw-lo-l85-e365\/command.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>The South Asian cyber espionage group known as <strong>Bitter<\/strong> (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed targeting South Asian organizations with a previously unreported remote access trojan called PapRAT.<\/p>\n<p>\u00abPapRAT has both C++ and Rust implementations,\u00bb Fortinet FortiGuard Labs researcher Cara Lin <a href=\"https:\/\/www.fortinet.com\/blog\/threat-research\/bitter-expands-its-arsenal-with-paprat\" target=\"_blank\">said<\/a>. \u00abIts capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands.\u00bb<\/p>\n<p>The campaign is notable for making use of three different infection chains &#8211;<\/p>\n<ul>\n<li>A Windows Shortcut (LNK) file that abuses the native \u00abftp.exe\u00bb utility to run scripts and create scheduled tasks designed to maintain contact with a command-and-control (C2) server.<\/li>\n<li>A VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet, while running an MSI installer in the background to deploy PapRAT.<\/li>\n<li>A URL shortcut (URL) file that fetches a LNK file via WebDAV, which then leads to an MSI installer that deploys PapRAT.<\/li>\n<\/ul>\n<p>The living-off-the-land (LotL) approach is designed to execute commands from a remote server (\u00abgoodnfortunes[.]com\u00bb), allowing it to collect directory and task lists, directory information from Desktop, Documents, and Downloads, installed antivirus product data, and mounted drives.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-governance-platform-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi9hjzSN2bSutSbaNO6ZWEm02wC6hue03kC4VKPSfsdPvcDX2PAvPE-u9QrLCw3POvN3hXFPlyYyFgkAgtKrs4I2oSb9BkIFOWQ_k1ISfIBdT2AoWNvq2Q2DF_3AyA4fJriKPHkTjqYFxu-Y_H4IH9uqscX8lh-puQ5cPmc_veAEr9p4fC0497XT8Fktlp6\/s728-nu-rw-lo-l85-e365\/tl-insidem-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The harvested reconnaissance information is saved as \u00ababc.pdf\u00bb and exfiltrated back to the C2 server via a curl command, after which the staged file is deleted from the host.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>A second version of the script has been found to retrieve a file called \u00abtalk.log\u00bb from \u00abtechtalkhelp[.]com.\u00bb The payload contains a Base64-encoded script to obtain additional instructions from the same server and execute them as PowerShell commands.<\/p>\n<p>\u00abThis staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect,\u00bb Fortinet said.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhWMY-HXWglo0k2-giGMVmQpfMkCWZagxy4RIuM34OU91TLTjTxyMOnrk-wvhwGVFqolNYJrsMC2xRbI1FIMD7332uh0E9a7QUGCrLaGSyvZdoo6mDzyyMRTndh2zzYsJbfDU0spon79FEmCglrMiJkpI6iRUPLexoyXbs48DKWjmhbgZe8bYEgT6FMYiIo\/s1700-nu-rw-lo-l85-e365\/red.png\" style=\"display: block;  text-align: center; clear: left; float: left;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhWMY-HXWglo0k2-giGMVmQpfMkCWZagxy4RIuM34OU91TLTjTxyMOnrk-wvhwGVFqolNYJrsMC2xRbI1FIMD7332uh0E9a7QUGCrLaGSyvZdoo6mDzyyMRTndh2zzYsJbfDU0spon79FEmCglrMiJkpI6iRUPLexoyXbs48DKWjmhbgZe8bYEgT6FMYiIo\/s1700-nu-rw-lo-l85-e365\/red.png\" alt=\"\" border=\"0\" data-original-height=\"652\" data-original-width=\"1200\"\/><\/a><\/div>\n<p>The PapRAT malware delivered via the MSI installer in the second attack chain is designed for remote control. It supports eight commands &#8211;<\/p>\n<ul>\n<li>MSG, for remote shell<\/li>\n<li>FDD, for directory listing<\/li>\n<li>DEL, for file deletion<\/li>\n<li>RUN, for arbitrary file execution <\/li>\n<li>GDR, for drive enumeration<\/li>\n<li>SS1, for screenshot capture<\/li>\n<li>UPP, for uploading local files to the C2 server (\u00abrivingtonclarks[.]com\u00bb)<\/li>\n<li>DWW, for downloading files from the C2 server<\/li>\n<\/ul>\n<p>A Rust version of the malware incorporates three more commands &#8211;<\/p>\n<ul>\n<li>MS2, for PowerShell command execution<\/li>\n<li>SLP, for sleeping and polling resumption<\/li>\n<li>BYE, for process termination<\/li>\n<\/ul>\n<p>A notable aspect of the third attack chain is that it combines the salient aspects of the first two sequences by using a script to download an MSI installer via curl. Like before, the MSI installer serves as a conduit for PapRAT, which then proceeds to drop WmRAT, a malware previously identified as used by Bitter.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-dd\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiWypk5aSrjVVXdRpyJaxKDe9VERLYId6cVdoZUwHGSe-EMh90qROsc-jk3uEKqB8-L4eSpBaka7err1zF86IrsEA4S2IZ8yyEsoZTsiGq2YvGuaCtdFvE8-ej7uEBhLbYJNENjs9umU6qmZCJ1aAzvG-ZDO0NtTVddy5hIGv4FBpDJp8UeOxYEzF5AeuK1\/s728-nu-rw-lo-l85-e36\/core-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The findings indicate that the threat actor continues to refine its custom arsenal to establish and maintain access to targeted systems.<\/p>\n<p>\u00abThese changes underscore the importance of monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures,\u00bb Fortinet said. \u00abOrganizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Nov 09, 2026Cyber Espionage \/ Threat Intelligence The South Asian cyber espionage group known as Bitter (aka APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397) has been observed&hellip;<\/p>\n","protected":false},"author":1,"featured_media":4039,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[594,179,4088,6,4090,229,338,4089,483,431],"class_list":["post-4038","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-asia","tag-backdoor","tag-bitter","tag-campaign","tag-cyberespionage","tag-deploy","tag-hackers","tag-paprat","tag-south","tag-targeting"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4038","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4038"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4038\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4039"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4038"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4038"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4038"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}