Cyber-Espionage Group Utilizes Windows Tools and PapRAT for Targeted Campaign
A disturbing development in the realm of cyber-espionage has emerged as a suspected South Asian group has been detected employing native Windows tools in tandem with a custom remote access trojan (RAT) identified as PapRAT. This strategy appears to be aimed at maintaining sustained access to various targeted organizations, highlighting an increasingly sophisticated approach to cyber operations.
On November 2, recently published research by Cara Lin from Fortinet’s FortiGuard Labs detailed this ongoing campaign. With a high degree of confidence, the findings attribute the activities to a group referred to as Bitter, also known by its tracking number TA397. This attribution was primarily based on in-depth analyses of lure filenames, command-and-control (C2) patterns, file metadata, and the overall characteristics of the malware.
FortiGuard Labs meticulously analyzed the campaign over several months and categorized the primarily affected organizations as being located in South Asia. However, the telemetry data indicates that the reach of this cyber operation extends beyond South Asia, showing notable activity also in Southeast Asia and South Korea. The lure files utilized in these cyber-attacks were cleverly designed to appear benign, referencing a variety of seemingly innocuous subjects including a bilateral meeting request, an ambassador’s letter associated with the 11th Belt and Road Summit, and even a gala dinner invitation planned for the year 2026.
Distinct Infection Chains with Minimal Malware Usage
In reviewing the operational methodology, FortiGuard Labs identified three distinct infection chains employed by the cyber-espionage group. Notably, one of these chains intriguingly did not rely on a traditional malware binary, taking a "living-off-the-land" approach instead. This first chain utilized a malicious Windows shortcut (LNK) file that exploited the built-in ftp.exe utility to execute scripts and create scheduled tasks.
These tasks were engineered to use the curl command to fetch updated directives from the attackers’ servers. As a noteworthy aspect, this chain did not detect any conventional executable malware, allowing operators the flexibility to modify instructions on their server without needing to distribute a new binary. Shane Barney, Chief Information Security Officer at Keeper Security, emphasized the risks associated with such intrusion methods, asserting that when trusted system processes are leveraged, signature-based controls fail to provide alerts. He proactively recommended implementing least-privilege access protocols, tightening limitations on native scripting engines, and eliminating standing administrative rights.
The other two infection chains employed a more direct approach by delivering PapRAT through Windows Installer (MSI) packages. In one instance, PapRAT was concealed within a decoy spreadsheet contained in a virtual hard disk (VHDX) image, while in the other, it was retrieved through an internet shortcut packaged in a RAR archive.
An Evolving Threat: PapRAT’s Variants and Features
PapRAT itself has shown noteworthy evolution in its functionalities. Initially built using C++, the trojan masqueraded as a genuine Microsoft component, communicating over plaintext HTTP and supporting a suite of eight commands that enabled remote shell access, file transfers, and the ability to take screenshots. A newer variant, constructed in Rust, has recently switched to using HTTPS for communication and introduced additional functionalities, including the capability to execute PowerShell commands, as well as commands for pausing and exiting the operation.
In a significant twist, the third infection chain retrieved PapRAT in conjunction with another RAT, referred to as WmRAT, which had previously been documented by other cybersecurity researchers. This association further substantiates the links between the ongoing campaign and the Bitter group.
Commenting on the situation, Jason Soroko, a senior fellow at the certificate lifecycle management firm Sectigo, highlighted the potential risks associated with this method. He cautioned that a singular focus on identifying PapRAT alone could lead to oversights in the broader scope of the campaign. Moreover, deleting the initial implant identified in the attack might not be sufficient to eradicate the threat altogether.
In conclusion, FortiGuard Labs has issued several recommendations aimed at mitigating risks associated with unexpected LNK files, internet shortcuts, disk images, and MSI installers. Alarmingly, in the first infection chain examined, there was found to be no evidence of PapRAT itself; instead, the analyzed elements consisted of a shortcut file, Windows tools, scripts, and scheduled tasks—a stark reminder of the ongoing and evolving threat posed by sophisticated cyber-espionage groups.