"PapRAT has both C++ and Rust implementations," Fortinet FortiGuard Labs researcher Cara Lin said.
Bitter (aka APT-C-08) targets South Asian organizations
The threat actor known as Bitter — tracked under multiple aliases including APT-C-08, APT-Q-37, Hazy Tiger, Orange Yali, T-APT-17, and TA397 — has been observed directing a new cyberespionage effort at organizations in South Asia. Fortinet FortiGuard Labs researchers who studied the activity reported a previously unobserved remote access trojan, which they named PapRAT, as the primary payload used to establish and maintain access to compromised hosts.
Three distinct infection chains: LNK, VHDX, and URL shortcuts
The campaign is notable for using three different, living-off-the-land infection sequences rather than a single, obvious exploit. Fortinet describes the chains as follows:
- A Windows Shortcut (LNK) file that abuses the native ftp.exe utility to run scripts and create scheduled tasks that maintain contact with a command-and-control (C2) server.
- A VHDX disk image containing a LNK file that launches a lure Microsoft Excel spreadsheet while running an MSI installer in the background to deploy PapRAT.
- A URL shortcut (URL) file that fetches a LNK file via WebDAV; that LNK then leads to an MSI installer which deploys PapRAT.
Each chain leverages system-native tools and installer mechanisms to move from initial user interaction to persistent foothold, reducing reliance on noisy or easily detected binary drops.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePapRAT capabilities: C++ and Rust variants and command set
Fortinet's analysis shows PapRAT exists in both C++ and Rust implementations. The core MSI-delivered remote control implant supports a basic set of functions intended for reconnaissance, remote execution and data transfer:
- MSG — remote shell
- FDD — directory listing
- DEL — file deletion
- RUN — arbitrary file execution
- GDR — drive enumeration
- SS1 — screenshot capture
- UPP — upload local files to the C2 server (observed host: rivingtonclarks[.]com)
- DWW — download files from the C2 server
The Rust variant adds further controls that increase operational flexibility, including:
- MS2 — PowerShell command execution
- SLP — sleeping and polling resumption
- BYE — process termination
Living-off-the-land staging model and C2 orchestration
Fortinet observed Bitter using a staging model that separates reconnaissance, staging and final payload execution to limit forensic artefacts. A script-based approach fetches and runs commands from a remote server — for example, goodnfortunes[.]com — to collect directory and task lists, directory contents from Desktop, Documents and Downloads, installed antivirus product data, and mounted drives. Collected reconnaissance is saved as a file named "abc.pdf" and exfiltrated to the C2 via a curl command before the staged file is deleted from the host.
A second script variant retrieves a file called "talk.log" from techtalkhelp[.]com; that payload contains a Base64-encoded script that pulls additional instructions from the same server and executes them as PowerShell commands. In at least one sequence the MSI installer that delivers PapRAT subsequently drops WmRAT, a previously identified malware used by the same actor. Fortinet summarized the operational trade-offs: "This staging model gives the attacker operational flexibility, while the commands are updated server-side without pushing a new binary, avoiding PE drops and process injection that some security appliances could easily detect."
What this means for technologists, enterprises, and end users
- Technologists and security teams: Fortinet recommends monitoring scripting tools, scheduled tasks, and installer activity alongside signature detection. The actor's use of ftp.exe, curl and scheduled tasks — plus MSI installers and disk images — suggests defenders should instrument and alert on unexpected LNK files, URL shortcuts, VHDX artifacts and MSI execution.
- Procurement and enterprise IT leaders: Installers and disk images delivered through unsolicited messages should be treated with caution. The campaign demonstrates how standard delivery formats — disk images and MSI packages — can be repurposed to deliver remote access tooling and secondary payloads like WmRAT.
- End users and general IT staff: Unexpected LNK files, URL shortcuts, disk images and MSI packages, particularly when received via unsolicited messages, represent a heightened risk and merit escalation and containment rather than casual opening.
The technical picture is clear: Bitter continues to refine a modular, script-driven toolkit that privileges stealth and flexibility over blunt-force exploitation. Fortinet's findings show a preference for living-off-the-land techniques, staged server-side command updates and multiple installer-focused delivery paths — a combination that short-circuits simple signature-based detection and demands broader behavioral controls. The key remaining question is how quickly defenders will shift monitoring and response to the scripting and installer channels this campaign exploits.
