Do Son 
Attack chains | Image: FortiGuard Labs
At a Glance
| Malware Family | PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant |
| Threat Actor | Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group |
| Target / Victims | Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) |
| Delivery Vector | Spear-phishing emails distributing malicious LNK files, VHDX disk images, and WebDAV URL shortcuts |
| Key Capabilities | Native ftp.exe LOLBin abuse, custom scheduled task persistence, XOR and ROT-3 string obfuscation, screen capture, file transfers, and PowerShell execution |
TL;DR
FortiGuard Labs uncovered a cyberespionage campaign deploying PapRAT malware against government and energy targets in South Asia. The threat actor known as BITTER uses three separate infection paths to breach victim networks. Furthermore, the operators upgraded the BITTER PapRAT malware from C++ to Rust to expand its command set and evade detection.
Delivery and Attribution
The operation began with targeted spear-phishing messages sent to government, engineering, and energy entities in South Asia. In these attacks, the operators used lure files referencing regional diplomatic and military events. Specific filenames cited by researchers referenced meetings during the 22nd Heads of Asian Coast Guard Agencies Meeting. Another lure referenced letters regarding the 11th Belt and Road Summit. In a third variant, the attackers distributed invitations to a 2026 gala dinner.
According to the FortiGuard Labs research report, analysts attribute this activity to the threat actor known as BITTER with high confidence. The attribution rests on lure filenames, command-and-control communication structures, and shared infrastructure patterns. Additionally, suspected attribution links BITTER to South Asian state-sponsored espionage operations dating back to 2013. Reporting confirms that BITTER, alternatively tracked as TA397, has targeted regional defense and industrial sectors for over a decade.
Infection Chain
The campaign relies on three distinct delivery paths to establish a foothold on victim endpoints. The first chain uses a shortcut file that abuses the native Windows ftp.exe tool to bypass security controls. In this technique, the shortcut executes an icon file containing a shell escape directive. As FortiGuard Labs noted, “In ftp.exe, the ‘!’ prefix executes the following token as a local shell command rather than an ftp directive.” Consequently, this command pipes script instructions into the command processor and closes the file transfer session.
Scheduled Tasks and Multi-Stage Loaders
The executed script creates scheduled tasks disguised as legitimate Microsoft or BIOS updates. Next, it uses the curl utility to fetch encoded commands from a remote server into public user directories. To deceive victims, the script displays a fake error message stating that Windows Explorer could not open the file. Meanwhile, background commands collect directory trees, process lists, and antivirus details. It saves the stolen survey data into a temporary PDF before exfiltration.
The second and third chains deliver compiled installers. In the second flow, a mounted VHDX disk image presents a shortcut file. This shortcut opens a decoy Excel delegate sheet while running a Windows Installer package in the background. In the third flow, an internet shortcut pulls a shortcut file across WebDAV to execute a similar installer package. Both installers run a custom action to drop the primary PapRAT malware binary onto the system.
Command-and-Control and Data-Exfiltration Behaviour
Once launched, the PapRAT malware masquerades as a legitimate Microsoft redistributable background service. It checks in with its command server every 10 seconds over plain HTTP. The malware registers the victim using a unique client identifier built from the username and computer name. To hinder network inspection, the developers encoded server hostnames and port numbers using an XOR key.
Task Execution and Secondary Implants
In the original C++ build, the server controls infected systems using JSON responses across eight core tasks. These commands permit operators to spawn command shells, list directories, delete files, list storage drives, capture screenshots, and transfer files. Furthermore, in the WebDAV infection chain, the attackers used the file download task to deliver WmRAT as a secondary payload. Security researchers at FortiGuard Labs observed that “WmRAT is a remote access trojan written in C++ that can gather basic information, take screenshots, list directories and files, and execute commands from C2.”
Evolution to Rust
Recently, BITTER rebuilt the backdoor in the Rust programming language. This updated BITTER PapRAT malware variant incorporates significant changes to evade security analysis. The Rust binary stores its internal strings in reverse order with a ROT-3 character shift. It also delays network contact for 42 seconds after startup before polling its server every five seconds. Most importantly, the Rust version expands its capabilities to eleven commands. It introduces dedicated directives for running PowerShell commands, sleeping, and terminating execution cleanly.
Defense and Detection Guidance
Defenders must monitor endpoints for living-off-the-land techniques that abuse standard system utilities. Security teams should alert on instances where ftp.exe or conhost.exe spawns command shells with hidden window parameters. Additionally, administrators should inspect Windows Task Scheduler for unusual tasks executing scripts stored in public user folders.
Organizations should also block outbound WebDAV traffic at network firewalls and restrict mounting external VHDX files on unmanaged workstations. Finally, security personnel must hunt for residual persistence mechanisms after an incident. Deleting the main PapRAT malware binary alone leaves scheduled tasks and secondary scripts active.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
