A cyberespionage group known variously as Bitter, APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397 has rolled out a previously unseen remote access Trojan dubbed PapRAT, targeting organizations across South Asia. The malware comes in two implementations—one in C++, the other in Rust—with the latter packing extra capabilities. Researchers at Fortinet FortiGuard Labs uncovered its deployment.
How PapRAT Operates
PapRAT is delivered via three distinct infection chains, each designed to blend into normal user workflows and evade detection. In the first scenario, attackers use a Windows Shortcut (.LNK) file that misuses the built-in “ftp.exe” tool to run scripts, setting up scheduled tasks that allow the malware to reach out to its command-and-control (C2) infrastructure.
The second route involves a VHDX disk image containing a LNK file. That LNK launches an Excel spreadsheet lure, while an MSI installer runs in the background to install PapRAT. The third attack path begins with a URL shortcut that pulls down a LNK file over WebDAV. Once launched, that LNK triggers an MSI installer that drops PapRAT—and in some cases another known malware called WmRAT—onto the target system.
Capabilities & Reconnaissance
Once on a host, PapRAT offers a suite of commands for remote control—file upload/download, deletion, directory and drive listing, screenshot capture, and arbitrary file execution. The Rust version expands that to include PowerShell execution, pausing and resuming activity, and a command to self-terminate.
Data collection is also stealthy: directory contents from Desktop, Documents, and Downloads folders; list of running tasks; mounted drives; and antivirus product details are harvested. The malware packages reconnaissance data—often under names like “abc.pdf”—and exfiltrates it via curl to remote servers. Afterward, staging files are deleted. In some variants a Base64-encoded script retrieves follow-up instructions via PowerShell commands.
Why It Matters & Mitigation Tactics
PapRAT’s design emphasizes minimal footprint. By relying heavily on living-off-the-land tools, scripts, scheduled tasks, and standard installer formats—rather than dropping new binaries or using process injection—it aims to fly under the radar of traditional antivirus and endpoint detection/prevention systems.
To counter the threat, organizations are urged to treat any unexpected LNK files, URL shortcuts, VHDX disk images, and MSI installers with suspicion—especially when they arrive unsolicited. Monitoring for installer activity, scheduled task creation, scripting tool execution, and unusual use of utilities like curl should be part of standard defense. Behavioral detection is increasingly critical when malware signatures alone may miss these evolving threats.
Analytically, the emergence of PapRAT shows how Bitter is refining its approach. The addition of Rust implementation, expanded command set, and multi-vector infection chains all point toward a more adaptable, persistent adversary. South Asian organizations—already frequent targets of espionage campaigns—must adapt swiftly. Security teams should watch for deployment of MSI installers from odd sources, use of WebDAV for file fetches, and even odd interactions with native tools like ftp.exe. The new tactics suggest that time to detection is shrinking—so prevention, zero-trust principles, and rapid incident response are now more crucial than ever.
