Bitter Deploys New PapRAT Backdoor in C++ and Rust: LNK, VHDX and WebDAV Chains Abuse ftp.exe, curl and MSI Installers, Then Drop WmRAT

Medium · 2026-11-11 · By H.A

Bitter Deploys New PapRAT Backdoor in C++ and Rust: LNK, VHDX and WebDAV Chains Abuse ftp.exe, curl and MSI Installers, Then Drop WmRAT

The South Asia-focused Bitter group is spreading a new C++/Rust remote access trojan, PapRAT, through three living-off-the-land infection chains that end with WmRAT on targets in the region.

Overview

The South Asia-focused espionage group Bitter (also tracked as TA397, APT-Q-37, APT-C-08, Hazy Tiger, Orange Yali and T-APT-17) is deploying a previously undocumented remote access trojan called PapRAT against organisations in South Asia. Researchers describe three separate infection chains. All of them lean heavily on built-in Windows tools such as ftp.exe, curl and scheduled tasks, plus disk images and MSI installers, to stay quiet. PapRAT exists in both C++ and Rust versions, and in one chain it goes on to install WmRAT, a malware family long associated with Bitter.

The Campaign

The three chains:

  1. LNK + ftp.exe: A malicious shortcut abuses the native ftp.exe client to run scripts and create scheduled tasks that keep checking in with the attackers' server.
  2. VHDX disk image: A virtual disk contains a shortcut that opens a decoy Excel spreadsheet while an MSI installer runs in the background and deploys PapRAT.
  3. URL shortcut + WebDAV: A .url file fetches a shortcut over WebDAV, which leads to an MSI installer. A script then uses curl to download the installer, PapRAT is deployed, and PapRAT drops WmRAT.

In the first chain, the reconnaissance is entirely "living off the land". A script pulls commands from the attacker's server and collects directory listings, scheduled-task lists, the contents of Desktop, Documents and Downloads, installed antivirus products, and mounted drives. The results are written to a file named abc.pdf, sent out with curl, and then deleted. A second version downloads talk.log, which contains Base64-encoded content that fetches further instructions and runs them in PowerShell. The commands are changed on the server side, so no new executable is dropped. Researchers note this avoids PE files on disk and process injection.

Timeline

Tradecraft

PapRAT (MSI-deployed C++ build) supports eight commands:

The Rust variant adds MS2 (PowerShell execution), SLP (sleep and resume polling) and BYE (terminate). Persistence comes from scheduled tasks, and C2 runs over HTTP. Public reports differ on the beacon interval (5 to 10 seconds), so treat the timing as variable. Lures are reported as diplomatic-themed documents.

Indicators of Compromise

Domains:

File artefacts:

Detection

# Recently created scheduled tasks and their actions
Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt (Get-Date).AddDays(-14) } |
  Select-Object TaskName,TaskPath,Date,@{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}}

Recommended Actions

Analyst Assessment

PapRAT is an incremental but meaningful upgrade to Bitter's toolkit. The group is now maintaining parallel C++ and Rust implants, and it is moving more of its reconnaissance into server-driven scripts that never write a new binary to disk. That makes signature-based detection much less effective, and behavioural rules around ftp.exe, curl uploads, disk-image mounts and new scheduled tasks much more important. Targeting stays regional and espionage-focused, so the risk is concentrated on South Asian government, diplomatic and defence organisations. Severity is rated Medium for the wider population and high for those sectors.

REEF SENTINEL