A cyberespionage group identified as BITTER has launched a new campaign using deceptive meeting invites and event announcements to deploy a remote access trojan called PapRAT on Windows systems. Hidden beneath familiar-looking files, the malware installs silently, targeting government, energy, and engineering sectors across South Asia. This activity highlights BITTER’s continued refinement of its threat toolkit, which has been in use since at least 2013.
Three Infection Pathways: VHDX, WebDAV, and Shortcut Abuse
In one attack vector, recipients are sent a virtual hard disk image (VHDX) that masquerades as a trustworthy document—an example being “Letter from the Ambassador – 11th Belt and Road Summit.” Mounted like a physical drive, it contains just one visible shortcut file. Two hidden components—a decoy Excel file and an installer—sit behind the scenes. Clicking the shortcut activates the installer and opens the decoy simultaneously, keeping the victim unaware of the invisible payload.
Another infiltration route uses WebDAV, a Windows feature that lets remote servers appear as local folders. In this chain, an archive labeled as an event invite (e.g. “Official Invitation Majilis 2026 Gala Dinner.rar”) hides a URL shortcut to a script, which then fetches an MSI installer named “Imp_Details.msi.” Because WebDAV bypasses many traditional warning prompts, attackers can skip common browser warnings and deliver malicious content more freely.
The third chain is the subtlest: it employs a simple shortcut file that abuses Windows’ built-in ftp.exe to execute a script, establish scheduled tasks, and then use tools like curl to communicate with attacker-controlled servers. No executable is immediately dropped, and a fake error message disguises the attempt, making detection difficult for defenses relying solely on executable scanning.
P apRAT’s Capabilities and Evolution
PapRAT installs via MSI packages, disguising itself as a Microsoft component (e.g. “bruzsvc.exe”) or using misleading product names like “Microsoft redistributables.” Once active, it reaches out to hardcoded command-and-control (C2) servers over HTTP. Communications are obfuscated using a simple XOR key. Early versions—written in C++—support eight commands, including file transfer, screenshot capture, folder and process listing, and shell command execution.
A newer, more advanced variant is written in Rust, upgrading its capabilities. It shifts to HTTPS, delays startup, and checks in with the C2 every five seconds. Constant values are masked using reversed text and ROT-3 encoding. Additionally, this version adds commands for PowerShell execution, sleeping, and termination—bringing its capability set to eleven.
Detection, Indicators of Compromise, and Defensive Tips
Several indicators of compromise (IoCs) have been identified, including domain names used for C2 communication, URLs employed for script downloads, and SHA-256 hashes matching malicious shortcut files and loader samples. Key names like “netmansrvdns[.]com” and “felixfuturenext[.]com” feature in the observed infrastructure.
To guard against PapRAT, defenders are urged to scrutinize any unsolicited LNK files, URL shortcuts, VHDX images, and MSI installers—especially when received via email. Monitoring scheduled task creation, installer activity, scripting usage, and WebDAV attachments offers a stronger defense than relying purely on signature-based antivirus. Seeing related events—mounting VHDX, extracting archives, executing shortcuts, downloading MSI installers—together may signal compromise.
This campaign reflects the growing sophistication of BITTER’s operations and its focus on stealth. By combining multiple abuse techniques—VHDX mounting, WebDAV, shortcut files—and layering deception in installer naming and communication obfuscation, the group aims to evade standard detection. For organizations operating in sensitive sectors, strengthening visibility across these vectors is no longer optional—it’s essential.
