"When an intrusion leverages trusted system processes, signature-based controls simply have nothing to alert on," said Shane Barney, CISO at Keeper Security.
Bitter (TA397) and the campaign footprint
FortiGuard Labs published research on November 2 describing a sustained cyber-espionage campaign it attributes with high confidence to a suspected South Asian group tracked as Bitter, also known as TA397. FortiGuard's telemetry showed targeting focused on South Asian organizations, with additional activity visible in Southeast Asia and South Korea. Fortinet analyst Cara Lin linked lure filenames, command-and-control patterns, file metadata and malware analysis as the basis for the attribution.
Three infection chains — one without a traditional malware binary
FortiGuard documented three distinct infection chains used in the campaign. The most notable chain took a living‑off‑the‑land approach: a malicious Windows shortcut (LNK) abused the native ftp.exe utility to run scripts, create scheduled tasks and then use curl to fetch commands from attacker servers. FortiGuard found no traditional malware executable in that chain, noting that operators could change server‑side instructions without pushing a new binary.
The other two chains delivered PapRAT inside Windows Installer (MSI) packages. One MSI was concealed inside a virtual hard disk (VHDX) image with a decoy spreadsheet; the other MSI was fetched via an internet shortcut stored in a RAR archive. Lure files used by the campaign included references to a bilateral meeting request, an ambassador's letter about the 11th Belt and Road Summit and a 2026 gala dinner invitation.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildPapRAT's evolution: C++ build, Rust variant, HTTPS and WmRAT
FortiGuard observed multiple builds of PapRAT. An earlier C++ build impersonated a Microsoft component, beaconed over plaintext HTTP and supported eight commands — remote shell access, file transfers, screenshots among them. A newer Rust variant switched to HTTPS and added three commands, including PowerShell execution, pausing and exiting.
In one chain, PapRAT downloaded a secondary RAT called WmRAT, a C++ remote access trojan previously documented by other researchers; FortiGuard cited the inclusion of WmRAT as an additional indicator linking the activity to Bitter. Jason Soroko, senior fellow at Sectigo, warned that the campaign's use of Windows native tools meant "a search for PapRAT alone could miss part of the campaign," and that removing the first implant found might not remove the attacker.
Why native Windows tools complicate detection
FortiGuard's finding that one chain relied entirely on built-in Windows utilities underscores a detection challenge: when operators use trusted system processes — ftp.exe, curl, scheduled tasks and scripts — signature‑based defenses have little to flag. FortiGuard emphasized that the living‑off‑the‑land chain deployed no binary, so defenders confronting a discovered shortcut, script or scheduled task may be facing only a fragment of a broader intrusion.
Shane Barney's observation frames the tactical consequence: reliance on native tooling makes static signature lists insufficient, and it changes the response calculus for teams that discover a suspicious LNK file or an unusual scheduled task.
What this means for technologists, procurement leaders, and defenders
- Technologists and security teams should treat unexpected LNK files, internet shortcuts, disk images (VHDX) and MSI installers as high‑risk artifacts, since FortiGuard recommended handling those file types carefully and the campaign used all four delivery methods.
- Procurement leaders and enterprise defenders who manage privileged access ought to consider the operational reality FortiGuard described: attacks can operate without a new binary and can fetch changing instructions from attacker servers. The campaign demonstrates that controls limiting standing administrative rights and restricting native scripting engines bear directly on the threat model cited by FortiGuard and by Keeper Security's CISO.
- Incident responders should note FortiGuard's linkage methods — lure filenames, C2 patterns, file metadata and malware analysis — and the role of secondary malware (WmRAT) as an indicator that removing a single implant may be insufficient.
FortiGuard's analysis documents a campaign that pairs stealthy, no‑binary intrusion techniques with evolving, custom RATs. The combination — living‑off‑the‑land shortcuts and upgraded PapRAT builds that moved to Rust and HTTPS, plus the use of WmRAT — raises a clear operational question left by the record: will Bitter continue to combine non‑binary footholds with multi‑stage RAT deployments, or will operators shift again to evade the behavioural detections defenders must now adopt?
Read the original FortiGuard summary at https://www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/.
