PapRAT Cyber Espionage Campaign Leaves a ‘BITTER’ Taste in South Asia
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
A known South Asian cyber espionage group has been targeting organizations across the region with attacks designed to compromise Windows systems, establish persistence, and give attackers remote control over infected machines using custom malware.
The attacks, attributed “with high confidence” to the South Asian threat group known as BITTER (aka TA397), involve three distinct infection chains and demonstrate the group’s expanding malware capabilities, according to new research from FortiGuard Labs published today.
BITTER, one of several threat groups linked to India, has been active since at least 2013 and has historically targeted government, energy, and engineering organizations. The group is known for using tailored attack campaigns to gain persistent access to victim networks, collect information, and maintain remote control over compromised systems.
At the center of the latest threat campaign is PapRAT, a custom remote access Trojan (RAT) that gives attackers extensive control over compromised Windows systems, including the ability to execute commands, manipulate files, capture screenshots, and download additional payloads, according to FortiGuard Labs.
“This campaign illustrates how BITTER combines native Windows tools with custom malware to establish and maintain access to targeted systems,” Cara Lin, a FortiGuard Labs threat researcher, wrote in the post.
Evolution of PapRAT
BITTER has recently revamped PapRAT from a C++ code base to Rust, expanding its functionality in the process from eight commands to 11, according to the report. Additional capabilities in the latest version include PowerShell execution, a sleep directive, and a clean-exit command.
“PapRAT’s C++ and Rust implementations indicate continued investment in BITTER’s toolset,” Lin wrote.
Indeed, attackers have increasingly adopted Rust for malware development for various reasons, including its cross-platform development capabilities and potential evasion advantages.
The latest updates to PapRAT also underscore the importance of certain defensive measures, including “monitoring malicious behavior across scripting tools, scheduled tasks, and installer activity alongside detecting known malware signatures,” Lin wrote.
BITTER Attack Chains
Researchers observed three distinct attack chains being used by BITTER, all of which exploit legitimate Windows functionality to disguise malicious behavior.
These tactics demonstrate “how advanced cyberespionage operations deliberately abuse native system tools to evade traditional endpoint detection,” notes Shane Barney, chief information security officer at Keeper Security.
The first attack chain uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain contact with the attackers’ command-and-control (C2) server.
The second uses a VHDX disk image containing an LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT.
The third attack begins with a URL shortcut that retrieves an LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers, according to FortiGuard Labs.
“By co-opting native Windows utilities like ftp.exe and scheduled tasks to establish initial command-and-control communication, threat actors operate within trusted administrative channels before deploying custom malware,” Barney observes. “When an intrusion leverages trusted system processes, signature-based controls simply have nothing to alert on.”
Defending PapRAT Attacks
This so-called “hybrid tradecraft,” which combines legitimate Windows functionality with custom malware, requires organizations to focus on strict privilege boundaries and identity security rather than relying on endpoint signatures alone as part of a comprehensive defense strategy, Barney says.
To defend against these attacks, organizations should treat unexpected LNK files, URL shortcuts, disk images, and MSI packages with caution, particularly when delivered through unsolicited messages, Lin recommended in the post.
“Combining user awareness with controls that detect suspicious execution chains and outbound C2 traffic can help limit exposure to campaigns that blend legitimate Windows functionality with custom malware,” she wrote.
The third attack chain is particularly problematic for defenders because removing PapRAT from compromised systems may not eliminate the attacker’s access, observes Jason Soroko, senior fellow at Sectigo.
This means defenders need to look deeper into their systems “to check what else was installed and identify scripts and scheduled tasks that could keep fetching commands,” he says. A comprehensive recovery effort must look beyond the file that triggered the original alert to identify any additional payloads, persistence mechanisms, or other components of the compromise.
Read more about:
