BITTER espionage group targets South Asia with new PapRAT trojan, Fortinet says

Fortinet’s FortiGuard Labs says BITTER, a suspected South Asian espionage group active since at least 2013, has run a campaign against South Asian organizations over the past several months. The campaign uses three infection chains built on Windows shortcut files. Two of them install PapRAT, a new remote access trojan that runs commands, moves files and takes screenshots. Fortinet attributes the activity to BITTER with high confidence.

In the first chain, a shortcut file uses Windows’ built-in ftp.exe to run a script. The script creates a scheduled task that fetches commands from the attackers’ server every 30 minutes, then shows a fake error so the victim thinks the file didn’t open. No malware executable is dropped, which Fortinet says can reduce what endpoint tools see. One set of commands Fortinet collected listed folders, running processes, installed antivirus and drives, and sent the results back.

The second chain uses a VHDX disk image named as a letter from an ambassador. Its shortcut opens a decoy spreadsheet while it quietly runs an MSI installer carrying PapRAT. The third starts with a RAR archive holding an internet shortcut, which pulls a shortcut file over WebDAV and then installs PapRAT the same way. There, PapRAT downloaded WmRAT, a trojan other researchers had documented, which Fortinet cites as another link to BITTER.

PapRAT poses as a Microsoft component, bruzsvc.exe, and checks in with its server over plain HTTP every 10 seconds, naming each victim by user name and computer name. A newer version written in Rust polls over HTTPS every five seconds and adds commands to run PowerShell, sleep and exit, for 11 commands in all.

The lure file names refer to a command and staff program, a request for a bilateral meeting, an ambassador’s letter about a summit and a gala dinner invitation. Fortinet hasn’t named the organizations targeted, their countries or how many there were. It says its telemetry shows the targets concentrated in South Asia, and that BITTER has a history of targeting the government, energy and engineering sectors.