Malware News A fake ambassador’s letter is one lure BITTER hackers are using to deliver PapRAT spyware, targeting government, energy and engineering organisations.

[Khushal]

Content source

https://www.fortinet.com/it/blog/threat-research/bitter-expands-its-arsenal-with-paprat

BITTER is a suspected South Asian cyberespionage group active since at least 2013, with a history of targeting the government, energy, and engineering sectors. Over the past several months, FortiGuard Labs has tracked a campaign targeting South Asian organizations that uses PowerShell scripts and a custom remote access trojan (RAT), which we call PapRAT, to establish persistent access to victim environments. Based on lure filenames, command-and-control (C2) communication patterns, file metadata, and malware analysis, we attribute this activity to BITTER with high confidence.

The campaign uses three distinct infection chains. The first uses a malicious LNK file that abuses the native Windows ftp.exe utility to execute scripts and create scheduled tasks that maintain contact with the attacker’s C2 server. The second uses a VHDX disk image containing a LNK file that opens a decoy spreadsheet while silently launching an MSI installer to deploy PapRAT. The third begins with a URL shortcut that retrieves a LNK file through WebDAV, leading to an MSI installer that deploys PapRAT. In this chain, PapRAT also delivers WmRAT, a secondary implant previously documented by other researchers.

PapRAT has both C++ and Rust implementations. Its name is derived from artifacts in the Rust build: the PDB filename “requpap.pdb” and the PE product name “papsolutions.” Its capabilities include command execution, file uploads and downloads, file deletion, directory and drive enumeration, and screenshot capture. The Rust variant adds PowerShell execution and other commands.

BITTER Expands Its Arsenal with PapRAT | FortiGuard Labs

FortiGuard Labs examines a BITTER cyberespionage campaign targeting South Asian organizations through three attack chains and the PapRAT remote access trojan…

www.fortinet.com

This blog examines the three infection chains, analyzes PapRAT’s capabilities, and traces its evolution from C++ to Rust.

 

[Bot]

Hi Khushal. The important part here is not merely another RAT, but how BITTER combines ordinary Windows components with unusual attachment types to avoid simplistic controls. The “ambassador’s letter” is actually a VHDX disk image containing a shortcut, hidden decoy spreadsheet and malicious MSI; opening the shortcut displays the spreadsheet while installing PapRAT in the background.

The FortiGuard analysis does not describe a zero-click exploit. Each chain depends on the recipient opening a shortcut or mounted-image content. Nevertheless, successful execution is serious: PapRAT provides remote command execution, file transfer and deletion, enumeration and screenshots, while the third chain can add WmRAT.

Useful defensive opportunities include:

• Quarantine unexpected LNK, URL, VHD/VHDX, RAR and MSI files arriving from external senders—particularly diplomatic invitations and meeting requests.
• Alert when shortcuts or Explorer launch ftp.exe, cmd.exe, curl.exe or msiexec.exe, and when MSI packages execute from WebDAV/network paths.
• Hunt for suspicious scheduled tasks under plausible names such as MicrosoftUpdates, especially tasks repeatedly piping files from user-writable locations into cmd.
• Restrict or remove ftp.exe and WebDAV access where they have no business requirement; use application control for unapproved MSI execution.
• Treat the opening of a convincing decoy document as no assurance whatsoever that the attachment was harmless—the decoy is part of the trick.

Fortinet’s BITTER attribution is reported with high confidence from several overlapping indicators, but that attribution should still be kept distinct from the directly observed malware behaviour. The latter is the more immediately useful part for defenders.

Sources

• BITTER Expands Its Arsenal with PapRAT | FortiGuard Labs