Bitter Deploys New PapRAT Backdoor in C++ and Rust: LNK, VHDX and WebDAV Chains Abuse ftp.exe, curl and MSI Installers, Then Drop WmRAT

Medium · 2026-11-11 · By H.A

The South Asia-focused Bitter group is spreading a new C++/Rust remote access trojan, PapRAT, through three living-off-the-land infection chains that end with WmRAT on targets in the region.

Overview

The South Asia-focused espionage group Bitter (also tracked as TA397, APT-Q-37, APT-C-08, Hazy Tiger, Orange Yali and T-APT-17) is deploying a previously undocumented remote access trojan called PapRAT against organisations in South Asia. Researchers describe three separate infection chains. All of them lean heavily on built-in Windows tools such as ftp.exe, curl and scheduled tasks, plus disk images and MSI installers, to stay quiet. PapRAT exists in both C++ and Rust versions, and in one chain it goes on to install WmRAT, a malware family long associated with Bitter.

The Campaign

The three chains:

1. LNK + ftp.exe: A malicious shortcut abuses the native ftp.exe client to run scripts and create scheduled tasks that keep checking in with the attackers' server.
2. VHDX disk image: A virtual disk contains a shortcut that opens a decoy Excel spreadsheet while an MSI installer runs in the background and deploys PapRAT.
3. URL shortcut + WebDAV: A .url file fetches a shortcut over WebDAV, which leads to an MSI installer. A script then uses curl to download the installer, PapRAT is deployed, and PapRAT drops WmRAT.

In the first chain, the reconnaissance is entirely "living off the land". A script pulls commands from the attacker's server and collects directory listings, scheduled-task lists, the contents of Desktop, Documents and Downloads, installed antivirus products, and mounted drives. The results are written to a file named abc.pdf, sent out with curl, and then deleted. A second version downloads talk.log, which contains Base64-encoded content that fetches further instructions and runs them in PowerShell. The commands are changed on the server side, so no new executable is dropped. Researchers note this avoids PE files on disk and process injection.

Timeline

• Early November 2026: Researchers publish an analysis of PapRAT and the three chains.
• 9 November 2026: Wider public reporting of the campaign. Public reporting gives no start date for the intrusions.

Tradecraft

PapRAT (MSI-deployed C++ build) supports eight commands:

• MSG: remote shell
• FDD: directory listing
• DEL: file deletion
• RUN: execute a file
• GDR: enumerate drives
• SS1: screenshot
• UPP: upload files to the C2
• DWW: download files from the C2

The Rust variant adds MS2 (PowerShell execution), SLP (sleep and resume polling) and BYE (terminate). Persistence comes from scheduled tasks, and C2 runs over HTTP. Public reports differ on the beacon interval (5 to 10 seconds), so treat the timing as variable. Lures are reported as diplomatic-themed documents.

Indicators of Compromise

Domains:

• goodnfortunes[.]com (command retrieval for recon scripts)
• techtalkhelp[.]com (hosts talk.log second-stage script)
• rivingtonclarks[.]com (PapRAT C2 for file upload)

File artefacts:

• abc.pdf: staged reconnaissance output (not a real PDF), created and deleted in user-writable folders
• talk.log: Base64-encoded second-stage script

Detection

• Alert on ftp.exe launched by explorer.exe or from a .lnk with script arguments (-s:). Legitimate use of the Windows FTP client is rare on modern endpoints.
• Flag curl.exe uploading files (-F, --upload-file, -T) from user sessions, especially files named abc.pdf.
• Watch for VHD/VHDX mounts started from email or downloads, followed by msiexec.exe running from the mounted volume.
• Monitor .url files that point at WebDAV (file:// or \\host@SSL\) shares, and rundll32/davclnt.dll WebDAV activity.
• Review new scheduled tasks created by script hosts.

# Recently created scheduled tasks and their actions
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-14) } |
  Select-Object TaskName,TaskPath,Date,@{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}}

Recommended Actions

• Block the listed domains at DNS and proxy, and search historical logs for contact with them.
• Block or quarantine .lnk, .url, .vhd/.vhdx and .iso attachments at the mail gateway, and disable automatic mounting of disk images where practical.
• Restrict ftp.exe and curl.exe for standard users with AppLocker or WDAC if there is no business need.
• Restrict MSI installation to managed software deployment channels.
• Turn on PowerShell Script Block Logging and command-line process auditing so these script-only chains are visible.
• Brief diplomatic, government and defence staff in the region on shortcut and disk-image lures.

Analyst Assessment

PapRAT is an incremental but meaningful upgrade to Bitter's toolkit. The group is now maintaining parallel C++ and Rust implants, and it is moving more of its reconnaissance into server-driven scripts that never write a new binary to disk. That makes signature-based detection much less effective, and behavioural rules around ftp.exe, curl uploads, disk-image mounts and new scheduled tasks much more important. Targeting stays regional and espionage-focused, so the risk is concentrated on South Asian government, diplomatic and defence organisations. Severity is rated Medium for the wider population and high for those sectors.